The Special Agents Mutual Benefit Association (SAMBA) health plan is warning almost 14,000 people in relation to a February 2018 protected health information breach.
The data breach targeted eligible family members of clients who were covered by the Federal Employees Health Benefits Plan during 2017.
It is an Internal Revenue Service (IRS) requirement for SAMBA to issue a copy of Form 1095-B to all plan members every tax year. The form supports plan subscribers’ and covered family members’ compliance with the Affordable Care Act’s individual mandate.
The forms for the 2017 tax year were issued on or soon after February 19, 2018; however, a programming mistake lead to the forms being completed with information relating to other subscribers’ family subcribers.
Rather than detailing the subscribers’ family members covered by their health plan, the forms incorporated the names and Social Security numbers of other subscribers’ families and the dates of health insurance coverage during 2017. The forms were also mistakenly dated 2016.
SAMBA recorded that no subscribers’ Social Security numbers were revealed. The breach was kept to subscribers’ families. A review into the error showed that the incorrect mailing impacted 13,942 people.
The error was discovered on February 22, 2018, and a second mailing was issued with the proper tax year and family members’ details on the forms. Notification letters have also been transmitted to family members affected by the breach, and subscribers who received the wrong copy of Form 1095-B have also been alerted and instructed to destroy the 2016 version of the form.
No reports have been submitted to SAMBA to suggest the impermissibly disclosed data has been improperly used in any way; however, as a precaution against identity theft, all affected people have been advised to exercise caution and obtain credit reports and review them and their Explanation of Benefits statements carefully for any indication of fraud.
SAMBA’s Executive Director, Walter E. Wilson stated: “We are taking steps to prevent any future data incident, and as always will continue to review and improve our processes, policies, and procedures that address data privacy”.
