HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 9, 2015.
- Organization as reported
- California Physicians' Service d/b/a Blue Shield of California, CA
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Network Server
- Submission date
- June 9, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14778, row:5917)
- Archived copy
- Held in the private archive (provenance)
On May 18 2015, the covered entity (CE), Blue Shield of California, discovered that several authorized users who logged into their accounts were able to access the protected health information (PHI) of individuals who were not affiliated with their line of business due to a faulty update to the restricted web portal. The PHI of 843 individuals was affected and included names, addresses, birthdates, social security numbers, and other identifiers. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach, the CE disabled the portal, deployed a patch code to correct the problem, and improved the code testing process. The CE also sanctioned the developer who failed to follow the code merge process. OCR reviewed the CE’s HIPAA Notice of Privacy Practices Policy, as relevant to this breach investigation, and obtained assurances that the CE implemented the corrective actions listed above.