WILLIAMSVILLE, N.Y. (WIVB) — Independent Health said Friday the private health information of 541 members from Williamsville Central School District was inadvertently attached to a secure report sent to business partners of the insurance company between August 2019 and August 2021.

The names, member identification numbers, medical diagnosis codes and descriptions were embedded in the reports and sent to stop-loss carriers and brokers over two years.

Independent Health said finding the sensitive information in the report would have been “extremely difficult.”

Frank Sava, a spokesperson for Independent Health, said no social security numbers or personal financial information got disclosed. He said it’s unlikely information was misused because the reports were sent to HIPAA-covered entities that understand the requirements to keep data private.

“As part of Independent Health’s safety and security protocols, we conduct regular extensive reviews,” Sava said. “During a recent review on August 13, 2021, we found protected health information (PHI) inadvertently embedded in a hidden cache in a secure report sent on a monthly basis to stop-loss carriers and brokers between August 2019 and August 2021 for 541 members from Williamsville Central School District, a self-funded plan client.”

The 541 members will receive two years of free identity protection and monitoring services. Sava said the error was a human error, and the company is working to prevent it from happening again.

If you were affected and have questions, call Independent Health at (716) 631-2661 or toll-free at 1-800-257-2753.