HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of March 17, 2015.
- Organization as reported
- Blue Cross Blue Shield of Michigan, MI
- Entity type as reported
- Health Plan
- Category as reported
Theft
- Location of information as reported
- Paper/Films
- Submission date
- March 17, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14856, row:5995)
- Archived copy
- Held in the private archive (provenance)
OCR opened an investigation of the covered entity (CE), Blue Cross Blue Shield of Michigan, after it reported that the protected health information (PHI) of 3,903 of its patients had been stolen for the purposes of identity fraud. The types of PHI disclosed included names, ages, genders, dates of birth, contract numbers, group names and numbers, and social security numbers. The CE provided breach notification to HHS, the media and affected individuals. Following the breach, the CE improved safeguards by masking social security numbers, removing members’ dates of birth, limiting search results to 25 records, and installing new printing devices that require employees to scan their coded badges when printing. OCR obtained assurances that the CE implemented the corrective actions listed above.