HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 21, 2017.
- Organization as reported
- BlueCross BlueShield of TN, Inc., TN
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- July 21, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14115, row:5254)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE) discovered on July 5, 2017, that it mailed a monthly report to employer health plan administrators that erroneously included the protected health information (PHI) of members enrolled in another group due to a software discrepancy. The mailings included demographic and health insurance information, affecting approximately 2,117 individuals. In response to the breach, the CE updated and tested all of its systems and manually reviewed every report prior to mailing until transitioning to an electronic-based reporting system in November 2017. The CE provided breach notification to HHS, affected individuals, and the media. The CE sent information to all employees explaining the incident and the steps it took to respond to the breach and used the incident to re-educate the employees about their responsibilities under HIPAA. OCR obtained assurances that the CE implemented the corrective actions listed above.