Yesterday, HHS' Office for Civil Rights announced that Blue Cross Blue Shield of Tennessee has agreed to pay $1.5 million to federal regulators and follow a corrective action plan in response to a 2009 data breach that could have affected more than one million people. The corrective action is the first resulting from the HITECH Act's breach notification rule. Health Data Management et al.