HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Jan. 5, 2018.
- Organization as reported
- Agency for Health Care Administration, FL
- Entity type as reported
- Health Plan
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Jan. 5, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13949, row:5088)
- Archived copy
- Held in the private archive (provenance)
On November 20, 2017, the Agency for Health Care Administration, the covered entity (“CE”), discovered that one of its employees had been the victim of a phishing incident, potentially exposing the names, dates of birth, addresses, social security numbers, clinical and health insurance information of 29,641 individuals. The CE provided timely breach notification to HHS, to the affected individuals and to the media. At the time of the breach and currently, the CE trained its employees on its HIPAA policies and procedures and including the reporting of suspicious emails. In response to the breach, the CE retrained the employee at fault and its entire workforce on identifying and reporting potential phishing emails. OCR obtained assurances that the CE implemented the corrective actions listed above.