HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 13, 2018.
- Organization as reported
- Blue Cross & Blue Shield of Rhode Island, RI
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Sept. 13, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13691, row:4830)
- Archived copy
- Held in the private archive (provenance)
RedCard, a business associate (BA) that provides mailing services to Blue Cross & Blue Shield of Rhode Island, the covered entity (CE), impermissibly disclosed protected health information (PHI) when it improperly consolidated explanations of benefits (EOB) in mailings, causing EOB documents for different individuals who resided at the same address (i.e., family members) to be mailed together. The breach affected the PHI of 1,567 individuals and included names, plan identification numbers, healthcare provider’s names, types of medical service provided, and claim information. Following the breach, the BA ceased consolidating EOBs. The CE provided breach notification to HHS, the media, and the affected individuals. OCR reviewed the CE’s BA agreement with the BA and it appeared to be in compliance with the Privacy Rule.