HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 11, 2014.
- Organization as reported
- BLUE CROSS AND BLUE SHIELD OF KANSAS CITY, MO
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Other
- Submission date
- April 11, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15117, row:6256)
- Archived copy
- Held in the private archive (provenance)
In February 2014, two members of the covered entity (CE), Blue Cross Blue Shield of Kansas City Plan, reported unauthorized charges on credit cards they used to make payments by phone to the CE. The CE determined that an employee violated its policies and procedures and may have put the financial information of 2,546 individuals at risk. The breach affected members that spoke with this employee regarding payment of premiums. The CE provided breach notification to HHS, affected individuals, and the media, and reported the matter to the FBI and local law enforcement. The CE reported that its background check contractor, Verifications Inc. (VI) provided an inaccurate criminal background check, which resulted in the hiring of the involved employee although the employee had been convicted of felony identity theft in April 2012. To prevent similar breaches from happening in the future, the CE terminated its contract with VI and established a relationship with a new background check vendor. The CE provided training to its workforce on its policies and procedures regarding HIPAA Security. OCR obtained documented evidence demonstrating that the CE implemented the corrective action listed above. The CE also ended the involved employee’s employment.