HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 26, 2017.
- Organization as reported
- Arizona Department of Health Services, AZ
- Entity type as reported
- Healthcare Provider
- Category as reported
Loss
- Location of information as reported
- Paper/Films
- Submission date
- May 26, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14177, row:5316)
- Archived copy
- Held in the private archive (provenance)
On May 26, 2017, the Arizona Department of Health Services, the covered entity (CE) reported that a package of billing documents containing protected health information (PHI) was lost in the mail. The package contained the PHI of approximately 2,500 individuals from its newborn screening program. The types of PHI involved in the breach included names, dates of birth, addresses, phone numbers, health insurance information, and possibly social security numbers. The CE provided breach notification to the affected individuals, the media, and HHS. Following the breach and an investigation, the CE switched the mail carrier it used for shipping its billing information. Pursuant to OCR’s investigation, the CE improved its physical safeguards and implemented new policies and procedures for mailings. OCR obtained assurances from the CE that it has taken the actions above.