Motion Picture Industry Health Plans Data Breach (2014)

The covered entity (CE), Motion Picture Industry Health Plans (MPIHP), mistakenly sent mailings containing protected health information (PHI) to the prior address of approximately 700 individuals due to a computer error. The PHI involved in the breach included names, claim numbers, dates of service, and provider names. The CE provided breach notification to affected individuals, HHS, and the media, and posted substitute notice on its website. Following the breach, the CE instituted additional safeguards including automatic suppression of documents when conflicting addresses are contained in multiple computer systems. As a result of OCR's investigation, the CE updated its policies, conducted a new risk analysis, and developed a new risk management plan.