HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 11, 2018.
- Organization as reported
- Blue Cross and Blue Shield of North Carolina (Blue Cross NC), NC
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Oct. 11, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13661, row:4800)
- Archived copy
- Held in the private archive (provenance)
In response to member telephone complaints, the covered entity (CE), Blue Cross Blue Shield of North Carolina, investigated and determined that on September 26, 2018, the CE mistakenly sent low income subsidy (LIS) letters to the wrong members due to an employee’s failure to follow established quality review procedures. Each letter contained the name and Blue Cross NC ID number for another member. Following the incident, the CE sanctioned the responsible staff member by coaching her and tasking her with creating a new process for sending the LIS letters. As a result of OCR’s investigation, the CE updated its policies and procedures by adopting the new process for mailing out the LIS letters. The CE also provided breach notification to HHS, affected individuals, and the media.