HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 28, 2016.
- Organization as reported
- Aetna Inc., CT
- Entity type as reported
- Business Associate
- Category as reported
Loss
- Location of information as reported
- Other
- Submission date
- Nov. 28, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14348, row:5487)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Aetna, reported that a compact disk (CD) containing the protected health information (PHI) of 18,854 individuals and the password to access the CD were lost when mailed to another office. The types of missing PHI included members’ names, dates of birth, and addresses. OCR reviewed the CE’s policies and procedures on uses and disclosure of PHI, safeguarding PHI, minimum necessary, and its business associate agreements. Following the breach, the CE invested in electronic information storage, ceased creating and mailing encrypted CDs, and retrained all workforce members on the procedures to protect PHI. OCR obtained assurances that the CE provided breach notification to affected individuals and the media in accordance with the Breach Notification Rule.