HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 14, 2015.
- Organization as reported
- Arkansas Blue Cross and Blue Shield, AR
- Entity type as reported
- Health Plan
- Category as reported
Theft
- Location of information as reported
- Desktop Computer
- Submission date
- July 14, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14754, row:5893)
- Archived copy
- Held in the private archive (provenance)
On June 16, 2015, two unencrypted desktop computers containing the protected health information (PHI) of approximately 560 individuals were stolen from the business associate (BA), Treat Insurance Agency, at its North Little Rock offices. The BA is an insurance broker that solicits and submits applications for health insurance coverage to the covered entity (CE), Arkansas Blue Cross and Blue Shield. The types of PHI involved in the breach included demographic, clinical and financial information. The CE provided breach notification to HHS, affected individuals, and the media. OCR reviewed the BA agreement in place between the CE and the BA and determined that the BA agreement was compliant with 45 C.F.R. §§ 164.314 and 164.504.