careSource, Inc Data Breach

Breach Overview

CareSource, Inc., a managed care organization operating in Minnesota, reported a data breach affecting 1,584 individuals to the U.S. Department of Health and Human Services on May 6, 2022. The incident involved unauthorized access to or disclosure of protected health information contained in paper records and films. The breach occurred through a business associate of CareSource, indicating that a third-party vendor or contractor with access to patient information was involved in the unauthorized disclosure. This type of breach highlights the ongoing challenges healthcare organizations face in managing physical records and ensuring that business partners maintain appropriate safeguards for sensitive patient information.

Company Response and Investigation

Following the discovery of the unauthorized access or disclosure, CareSource initiated an investigation to determine the scope and nature of the breach. The company worked to identify which patients were affected and what specific information may have been compromised. As required under the Health Insurance Portability and Accountability Act (HIPAA), CareSource submitted breach notification to federal authorities in May 2022, triggering the mandatory notification process for affected individuals. The involvement of a business associate suggests that CareSource conducted a thorough review of its vendor relationships and the circumstances that led to the unauthorized access or disclosure of the paper records and films.

Specific Details About the Breach

The breach specifically involved paper documents and films, which distinguishes it from the more commonly reported electronic health record breaches. Paper-based breaches typically occur through several mechanisms: improper disposal of documents, theft of physical files, mailing errors where documents are sent to incorrect recipients, unauthorized viewing by employees or contractors, or loss of documents during transport or storage. The fact that a business associate was involved suggests the breach may have occurred during document processing, storage, medical records retrieval services, document destruction services, or during the transfer of records between facilities. Films in healthcare settings typically refer to medical imaging such as X-rays, CT scans, MRIs, or other diagnostic imaging materials, which often contain patient identifiers along with sensitive medical information. The unauthorized access or disclosure classification indicates that someone who should not have had access to these materials either viewed them, obtained copies, or that the materials were inadvertently disclosed to unauthorized parties.

Organizational Context

CareSource is a managed care organization that provides health insurance and managed healthcare services. Founded in Ohio, CareSource has expanded operations to multiple states including Minnesota, where this breach occurred. As a managed care organization, CareSource administers health plans for Medicaid, Medicare, and Health Insurance Marketplace programs, serving vulnerable populations who rely on government-sponsored healthcare coverage. The organization handles extensive protected health information for its members, including medical histories, treatment records, insurance claims data, and personal identifying information. Managed care organizations like CareSource typically work with numerous business associates including claims processors, medical record storage companies, billing services, and healthcare providers, creating a complex network of entities with access to sensitive patient information. This interconnected ecosystem, while necessary for efficient healthcare delivery, creates multiple points where breaches can occur if proper safeguards are not maintained.

Personal Information Involved

While CareSource has not publicly disclosed the specific types of information contained in the compromised paper records and films, such documents in a managed care setting typically contain comprehensive protected health information. The records may have included patient names, dates of birth, addresses, telephone numbers, and member identification numbers. Medical information likely included diagnoses, treatment histories, medication lists, laboratory results, and physician notes. If the films involved diagnostic imaging, they would contain visual medical information along with patient identifiers embedded in the images. Depending on the nature of the records, the breach may have also exposed insurance information such as policy numbers, coverage details, and claims history. In some cases, paper records in healthcare settings may contain Social Security numbers, driver's license numbers, or financial account information, though the specific presence of such data in this breach has not been confirmed. The involvement of a business associate suggests these records were being processed, stored, or transported for a specific business purpose at the time of the unauthorized access or disclosure.

Number of People Affected

The breach affected 1,584 individuals who were members or patients of CareSource in Minnesota. Under HIPAA regulations, CareSource was required to notify each affected individual by mail within 60 days of discovering the breach. The notification letters typically inform patients about what happened, what information was involved, what steps the organization is taking in response, and what actions patients can take to protect themselves. Because this breach affected fewer than 500 individuals in a single state, it was reported to HHS as part of the annual notification process rather than requiring immediate public disclosure. However, the breach still represents a significant privacy violation for the affected individuals and demonstrates the ongoing challenges of protecting paper-based health information in an increasingly digital healthcare environment.

Industry Context and HIPAA Requirements

Paper-based breaches remain a persistent problem in healthcare despite the widespread adoption of electronic health records. According to HHS breach data, unauthorized access and disclosure incidents involving paper records account for a significant portion of reported breaches, particularly those affecting smaller numbers of individuals. These incidents often result from human error, inadequate training, or insufficient physical security measures. HIPAA requires covered entities like CareSource to implement appropriate administrative, physical, and technical safeguards to protect all forms of protected health information, including paper records. This includes policies for secure storage, controlled access, proper disposal through shredding or other destruction methods, and oversight of business associates who handle physical records. When breaches involve business associates, both the covered entity and the business associate may be held liable for HIPAA violations if investigations reveal inadequate safeguards or failure to comply with regulatory requirements. The involvement of a business associate in this breach underscores the importance of thorough due diligence when selecting vendors, comprehensive business associate agreements, and ongoing monitoring of third-party compliance with privacy and security requirements.