AdminisTEP (TX), a print and mail sorting business associate, improperly stuffed and mailed letters exposing other enrollees' names, addresses, subscriber IDs, claims amounts, and service descriptions. The breach affected approximately 4,469 enrollees. The covered entity notified HHS, media, and individuals, offered free one-year identity theft protection, and placed AdminisTEP on a corrective action plan with QA checks and random audits. OCR obtained assurances of corrective action implementation.
Affected (this filing): 4,469