HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Jan. 18, 2019.
- Organization as reported
- ABB Inc. Active Employee Group Benefit Plan, NC
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Jan. 18, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13571, row:4710)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), ABB Inc. Active Employee Group Benefit Plan, contracts with BlueAdvantage Administrators of Arkansas, a business associate (BA), to be a third party administrator for the CE’s medical plan for its U.S. employees. Due to a mailing error, the BA impermissibly disclosed the protected health information (PHI) of 6,877 plan members, including member names, ID numbers, and addresses. The CE provided breach notification to HHS and the media, and the BA provided individual notification. In order to prevent a similar mistake from happening in the future, the BA reviewed and made changes to its procedures and retrained staff. The BA also cancelled the member cards and ID numbers affected by the mailing, and issued new cards and ID numbers. OCR determined that the CE had a business associate agreement in place with the BA and obtained assurances that the CE implemented the corrective actions listed above.