Group Health Cooperative

Group Health, Inc. (an EmblemHealth company) disclosed an unintentional release of protected health information and Social Security numbers. On October 13, 2016, the company learned that Health Insurance Claim Numbers (HICNs), which mirror Social Security numbers, were inadvertently included on external mailing labels of Medicare Evidence of Coverage documents sent between October 3 and October 14, 2016. The error occurred when a vendor mistakenly used HICNs instead of random mailing identifiers. The company offered 24 months of identity protection services via AllClear ID.

Group Health reported to HHS on 2016-09-23 a Unauthorized Access/Disclosure affecting 668 individuals. Breached information located on Paper/Films. The covered entity, through its business associate, erroneously mailed coverage termination letters containing PHI (names, addresses, medical record numbers) to the wrong patients.

Group Health Cooperative notified Washington AG of a misdelivery error where termination letters containing member names, addresses, and member numbers were mailed to the wrong recipients. The incident affected 651 Washington residents. The breach was discovered on September 12, 2016, after letters were mailed between August 31 and September 2, 2016. No financial or health data was exposed. Kroll was engaged to provide one year of identity monitoring services.

Group Health Incorporated reported to HHS on 2014-08-27 a Unauthorized Access/Disclosure affecting 802 individuals. Breached information located on Paper/Films.

Group Health Cooperative reported to HHS on 2013-10-03 a misdelivery affecting 1,015 individuals. Breached information located on Paper/Films. An erroneous mailing displayed protected health information (PHI) including names, medical record numbers, diagnoses, and addresses in the envelope's address window. The entity notified HHS, affected individuals, and the media, and implemented corrective procedures.

Group Health Incorporated (NY, Health Plan) reported to HHS on 2013-01-02 a Theft/accidental disclosure affecting 1,771 individuals. PHI — including social security numbers embedded in a series of numbers — was exposed on the outside of postcard reminders mailed to subscribers. OCR investigated; the CE suspended mailings, modified procedures to eliminate SSNs from outbound mail, retrained staff, and provided one year of free credit monitoring to affected individuals. Breached information located on Paper/Films.