HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 14, 2015.
- Organization as reported
- Affinity Health Plan, Inc., NY
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Sept. 14, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14712, row:5851)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Affinity Health Plan, Inc., mistakenly sent renewal letters to members that contained a different member’s name and address and their children’s names and identification numbers and coverage information. The breach affected 497 heads of household and 224 children. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE placed a hold on outgoing bulk mailings. As a result of OCR’s investigation, the CE reviewed and revised the organization’s mailing procedures to ensure that they comply with minimum necessary standards, and quality standards. The CE also retrained all staff on its updated policies and procedures and on HIPAA safeguards for members’ PHI. OCR obtained assurance that the CE implemented the corrective actions noted above.