HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Dec. 26, 2017.
- Organization as reported
- Blue Cross Blue Shield of Massachusetts, MA
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- Dec. 26, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13958, row:5097)
- Archived copy
- Held in the private archive (provenance)
On February 20, 2017, one of BCBSMA’s employer accounts requested data on its current and past employees. BCBSMA erroneously emailed data about individuals who were not current or past employees of the account holder in an encrypted email. The emailed data contained protected health information (PHI) of 1,843 individuals, including names, addresses, birthdates, and social security numbers. On December 12, 2017, the employer used the incorrect data and sent letters to the listed individuals. After being informed by the individuals of the error, the account holder did not further re-disclose the PHI and it was destroyed. BCBSMA provided breach notification to HHS, affected individuals, and the media. OCR reviewed BCBSMA’s policies and procedures as they relate to this breach report, and they appear to comply with the Privacy, Security and Breach Notification Rules.