HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 11, 2015.
- Organization as reported
- Blue Cross Blue Shield of North Carolina, NC
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Sept. 11, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14715, row:5854)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Blue Cross Blue Shield of North Carolina, discovered on August 24, 2015, that it had accidently sent payment letters to members that contained information for other members, affecting 806 individuals. The types of PHI in the letters included members' name, telephone numbers, health plans, effective dates, exchange identification numbers, payment amounts, and internal payment identification numbers. The CE provided breach notification to HHS, affected individuals, and the media, and posted substitute notice on its website. In response to the breach, the CE revised its mailing procedures to implement a two-step verification process before material is mailed. OCR obtained assurances that the CE implemented the corrective actions listed above.