Health Plan Corrects Impermissible Disclosure of PHI through Training, Mitigation, and Sanctions
Covered Entity: Health Plans
Issue: Impermissible Uses and Disclosures

An employee of a major health insurer impermissibly disclosed the protected health information of one of its members without following the insurer's authorization and verification procedures. Among other corrective actions to resolve the specific issues in the case, OCR required the health insurer to train its staff on the applicable policies and procedures and to mitigate the harm to the individual. In addition, the employee who made the disclosure was counseled and given a written warning.