- EFT Payments Issued as Checks:CareFirst identified on or around May 10 an issue in which some providers who were set up to receive ACH/EFT payments instead received paper checks. This issue remains under active investigation. Providers do not need to take any action at this time. We are working toward resolution and will continue to share updates as more information becomes available, including expected timing.
- ERAs Reflecting Check Information Instead of ACH:CareFirst is aware of an issue in which some Electronic Remittance Advices (ERAs) reflected check payment information instead of ACH/EFT details. This issue was resolved on May 29, 2026. CareFirst is currently working to reissue impacted ERAs to include the correct ACH/EFT information. Providers do not need to take any action at this time.
Change Healthcare notifying individuals of data breach. Learn more here.
HIPAA Security Standards
The Final HIPAA Security Rule was published on February 20, 2003. Most covered entities, including CareFirst, were required to comply with the Security Rule by April 21, 2005.
The Security regulation established specific standards to protect electronic health information systems from improper access or alteration. In addition, the rule adopts implementation specifications that provide instructions for implementing the security standards. Under the rule, covered entities must develop procedures to protect the confidentiality, integrity, and availability of electronic protected health information.
Implementation Specifications
Within the final rule, Implementation Specifications are marked as either Required or Addressable. If the Implementation Specification is Required, the covered entity must implement the standard as stated.
However, if the Implementation Specification is Addressable, the covered entity must do one of the following:
- implement one or more of the addressable implementation specifications;
- implement one or more alternative security measures;
- implement a combination of both; or
- not implement either an addressable implementation specification or an alternative security measure, after documenting that the cost of the proposed security measures exceeds the value of the content being secured.
An Implementation Specification marked as Addressable does NOT mean it is optional.
CareFirst is compliant with the Security rules. Shown below are tables summarizing the Security rule sections with the required and addressable implementation specifications.
Administrative Safeguards
| Standards | Sections | Implementation Specifications (R)= Required, (A)=Addressable |
|---|---|---|
| Security Management Process | 164.308(a)(1) | Risk Analysis (R) Risk Management (R) Sanction Policy (R) Information System Activity Review (R) |
| Assigned Security Responsibility | 164.308(a)(2) | (R) |
| Workforce Security | 164.308(a)(3) | Authorization and/or Supervision (A) Workforce Clearance Procedure (A) Termination Procedures (A) |
| Information Access Management | 164.308(a)(4) | Isolating Health care Clearinghouse Function (R) Access Authorization (A) Access Establishment and Modification (A) |
| Security Awareness and Training | 164.308(a)(5) | Security Reminders (A) Protection from Malicious Software (A) Log-in Monitoring (A) Password Management (A) |
| Security Incident Procedures | 164.308(a)(6) | Response and Reporting (R) |
| Contingency Plan | 164.308(a)(7) | Data Backup Plan (R) Disaster Recovery Plan (R) Emergency Mode Operation Plan (R) Testing and Revision Procedure (A) Applications and Data Criticality Analysis (A) |
| Evaluation | 164.308(a)(8) | (R) |
| Business Associate Contracts and Other Arrangement | 164.308(b)(1) | Written Contract or Other Arrangement (R) |
Physical Safeguards
| Standards | Sections | Implementation Specifications (R)= Required, (A)=Addressable |
|---|---|---|
| Facility Access Controls | 164.310(a)(1) | Contingency Operations (A) Facility Security Plan (A) Access Control and Validation Procedures (A) Maintenance Records (R) |
| Workstation Use | 164.310(b) | (R) |
| Workstation Security | 164.310(c) | (R) |
| Device and Media Controls | 164.310(c) | Disposal (R) Media Re-use (R) Accountability (A) Data Backup and Storage (A) |
Technical Safeguards
| Standards | Sections | Implementation Specifications (R)= Required, (A)=Addressable |
|---|---|---|
| Access Control | 164.312(a)(1) | Unique User Identification (R) Emergency Access Procedure (R) Automatic Logoff (A) Encryption and Decryption (A) |
| Audit Controls | 164.312(b) | (R) |
| Integrity | 164.312(c)(1) | (A) |
| Mechanism to Authenticate Electronic Protected Health Information | 164.310(c) | (A) |
| Person or Entity Authentication | 164.312(d) | (R) |
| Transmission Security | 164.312(e)(1) | Integrity Controls (A) Encryption (A) |