HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Jan. 22, 2013.
- Organization as reported
- BlueCross BlueShield of Western New York, NY
- Entity type as reported
- Business Associate
- Category as reported
Theft
- Location of information as reported
- Paper/Films
- Submission date
- Jan. 22, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15483, row:6622)
- Archived copy
- Held in the private archive (provenance)
The covered entity’s (CE) business associate (BA), Blue Cross Blue Shield, mailed a monthly premium notice with invoices that contained the protected health information (PHI) of 725 individuals which was never received by the CE. The PHI included names, member identification numbers, and social security numbers. Upon discovery of the breach, the BA contacted the U.S. Post Office regarding the undelivered mailing. The CE provided breach notification to HHS and the BA notified affected individuals. The BA revised its invoice procedures to assure the removal of social security numbers and member identification numbers, and send invoices via secure email. The breach incident involved a BA and occurred prior to the September 23, 2013, compliance date. OCR verified that the CE had a proper BA agreement in place that restricted the BA’s use and disclosure of PHI and required the BA to safeguard all PHI.