HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 13, 2017.
- Organization as reported
- Area Agency of Aging 1-B, MI
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- April 13, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14219, row:5358)
- Archived copy
- Held in the private archive (provenance)
A workforce member failed to encrypt emails containing spreadsheet attachments when they were sent to the intended recipient. The unencrypted emails contained the protected health information (PHI) of approximately 1,741 individuals and included names, case numbers, dates of service, and medical procedures codes. The covered entity (CE), Michigan Department of Health and Human Services/Aging and Adult Services Agency, provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE ensured that staff completed mandatory agency-wide HIPAA training. It also followed up with the involved staff. The person responsible for the unencrypted emails is no longer working with the agency. The CE improved technical safeguards to encrypt all outgoing emails and attachments. Finally, the CE initiated a review and update of its HIPAA policies and procedures. OCR obtained documented assurances that the CE implemented the corrective actions noted above.