Affinity Health Plan, Inc.

Affinity Health Plan, Inc. mistakenly sent renewal letters to 497 heads of household and 224 children that contained other members’ names, addresses, identification numbers, and coverage information. In response, the company placed a hold on outgoing bulk mailings, revised its mailing procedures to comply with minimum necessary and quality standards, and retrained all staff on the updated policies. OCR investigated and obtained assurances that the corrective actions were implemented.

HHS OCR settled with Affinity Health Plan, Inc. for $1,215,780 regarding the impermissible disclosure of up to 344,579 individuals' PHI when photocopiers were returned to a leasing agent without erasing hard drive data. The investigation revealed that Affinity failed to incorporate the electronic protected health information stored in copier's hard drives in its analysis of risks and vulnerabilities as required by the Security Rule, and failed to implement policies and procedures when returning the hard drives to its leasing agents.

Affinity Health Plan reported to HHS on 2012-04-10 a Unauthorized Access/Disclosure affecting 933 individuals. Breached information located on Email.

Affinity Health Plan, Inc. (NY) reported to HHS OCR on 2010-04-14 a Theft/improper disposal breach affecting 344,579 individuals. Breached information was stored on photocopier hard drives that were returned to leasing agents without data erasure; CBS Evening News discovered the data on a purchased copier and alerted Affinity. OCR found Affinity failed to include photocopier ePHI in its risk analysis. A $1,215,780 settlement and corrective action plan were reached with HHS.