HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Oct. 15, 2015.
- Organization as reported
- Centene Management Corporation, MO
- Entity type as reported
- Health Plan
- Category as reported
Theft
- Location of information as reported
- Other Portable Electronic Device
- Submission date
- Oct. 15, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14690, row:5829)
- Archived copy
- Held in the private archive (provenance)
An employee of a business associate (BA), Centene Management Company, impermissibly downloaded several data files containing the protected health information (PHI) of 8,208 individuals to an unauthorized removable storage device and then resigned from the organization. The former employee returned his company issued laptop on March 23, 2015. However, in violation of standard procedures, the laptop was not connected to the network for processing/reimagining at the time it was returned which allowed the impermissible downloads to go undetected. On October 8, 2015, a data loss prevention tool discovered the impermissible downloads when the former employee’s laptop was connected to the network for processing. The PHI involved in the breach included names, addresses, dates of birth, medical identification numbers, and in some cases social security numbers. The PHI downloaded belonged to members of the covered entities, Bridgeway Health Solutions and Superior Health Plan. The BA provided breach notification to HHS, affected individuals, and the media and also provided substitute notice. In response to the breach, the BA implemented and communicated a policy to help ensure the timely processing of returned information technology equipment. It also implemented a policy and software solution prohibiting the downloading of data to unauthorized, external storage. OCR provided technical assistance regarding the risk analysis and risk management provisions of the Security Rule.