HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 10, 2014.
- Organization as reported
- Colorado Department of Health Care Policy & Financing, CO
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Other
- Submission date
- Oct. 10, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14958, row:6097)
- Archived copy
- Held in the private archive (provenance)
On July 30 and September 3, 2014, a business associate (BA) mistakenly sent postcards to the covered entity’s (CE) clients that contained viewable protected health information (PHI). The breached PHI included names, addresses, and referred to each client’s status as a public assistance client receiving behavioral health care services. The resulting breach affected approximately 15,380 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE and its BA ceased using postcards to conduct client satisfaction operations and implemented new policies and procedures to address the circumstances that led to the breach. The CE and BA also counseled and trained the employee responsible for approving the postcard and provided additional privacy training to all workforce members of the departments responsible for approving such mailings. OCR obtained assurances that the CE and BA implemented the corrective actions noted above.