HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 6, 2018.
- Organization as reported
- CA Department of Developmental Services, CA
- Entity type as reported
- Health Plan
- Category as reported
Theft
- Location of information as reported
- Paper/Films
- Submission date
- April 6, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13865, row:5004)
- Archived copy
- Held in the private archive (provenance)
On February 11, 2018, unknown persons broke into the covered entity's (CE) legal and audits offices, ransacked the offices and paper files, vandalized property, and started a fire that set off the building’s sprinkler system, which caused water damage to many documents and workstations. The breach affected approximately 582,174 individuals including the CE's employees. The types of protected health information (PHI) involved in the breach included billing information such as names, unique state-issued client identifier numbers, service code, units billed, service dates, amounts paid, and/or medical records. The CE, California Department of Developmental Services, provided breach notification to HHS, affected individuals, and the media and also provided substitute notice. Following the breach, the CE immediately reported the incident to law enforcement. In addition, the CE conducted a network investigation and verified that encrypted laptops stolen from the office were not accessed following the theft. As a result of this incident, the CE utilized a vendor to clean up water and smoke damage, placed a 24-hour security guard in the building, and changed employee passwords. OCR provided technical assistance to the CE on its security management process.