HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of April 3, 2012.
- Organization as reported
- CenterLight Healthcare, NY
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- April 3, 2012
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15664, row:6803)
- Archived copy
- Held in the private archive (provenance)
A workforce member emailed to his personal email address files containing the protected health information (PHI) of 642 individuals, including their names, Medicare numbers, Medicaid numbers, enrollment status, and some health plan names. The workforce member was a temporary worker who had intended to show his work product to potential employers to demonstrate his experience with such work. The covered entity (CE), CenterLight Healthcare, provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE ensured that the temporary worker deleted the email at issue from his personal email account and personal mobile device. The CE also attempted to secure the temporary worker’s written acknowledgment that confirmed that he either (i) did not save the files to his home desktop computer or (ii) deleted the files from his home desktop computer. The CE also sanctioned the worker. Additionally, the CE stopped using temporary workers, implemented an email encryption solution, and revised its HIPAA training. OCR obtained assurances that the CE implemented the corrective actions listed.