Aon

Aon Consulting, a business associate, prepared a request-for-proposal document for a covered entity's vision benefit program that mistakenly included PHI of 22,642 individuals. The document was publicly posted online for five days. Breached information located on a Network Server. PHI exposed included Social Security numbers, dates of birth, gender, zip codes, and vision plan enrollment information. The covered entity implemented multi-layer review controls and enforced its BAA with Aon; Aon offered credit monitoring and identity theft insurance to affected individuals.

Affected (this filing): 22,642