HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Aug. 20, 2026.
- Organization as reported
- Blue Cross Blue Shield of Illinois, IL
- Entity type as reported
- Business Associate
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Aug. 20, 2026
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 8876, row:15)
- Archived copy
- Held in the private archive (provenance)
The business associate (BA), Blue Cross Blue Shield of Illinois, reported that an employee mailed the protected health information (PHI) of 3,831 individuals to the wrong recipients. The PHI involved names and medications. The BA notified HHS, the media, and the affected individuals. In its mitigation efforts, the BA retrained its workforce and enhanced its quality control processes to prevent a reoccurrence. OCR provided technical assistance to the BA regarding the HIPAA Rules.