"If your organization has a self-insured group health plan and uses Anthem as a TPA, there are a few steps that you can take while Anthem continues its forensic investigation: ... If breach notification obligations have not already been contractually delegated to Anthem, consider whether to formally delegate those obligations to Anthem now ... Create an internal security incident report to demonstrate that you are aware that a security incident affecting the group health plan has occurred, and document the actions that are being taken and the basis for any delay (e.g., that you are waiting on more information from Anthem) ... Once any required breach notifications have been made, ensure that you have some evidence (such as information from Anthem) demonstrating that the necessary breach notifications to affected individuals, HHS, the media, and potentially state regulators and credit reporting agencies have been made."  MORE >>