HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Aug. 18, 2015.
- Organization as reported
- Colorado Department of Health Care Policy and Financing, CO
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Aug. 18, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14730, row:5869)
- Archived copy
- Held in the private archive (provenance)
Between May 25, 2015 and July 5, 2015, the Governors’ Office of Technology, a business associate (BA), sent letters containing protected health information (PHI) on behalf of the covered entity (CE), the Colorado Department of Health Care Policy and Financing, to the wrong Medical Assistance Program clients due to a technical error in the BA’s computer system. The breach affected up to 3,537 individuals, and the types of PHI involved (which varied from household to household) included names, addresses, state identification numbers, Medicaid case numbers, employers’ names, amount of income, amount of approved Advanced Premium Tax Credit, approvals/denials for the Medical Assistance Program, and dates of birth. The CE provided breach notification to HHS, affected individuals, and the media. To prevent a recurrence of this type of incident, the BA’s subcontractor, Deloitte, fixed the software that is used for the Colorado Benefits Management System to ensure that the CE’s letters are addressed to the appropriate recipients, and implemented additional procedures for quality control of mailings. OCR obtained written assurances that the CE, BA and its subcontractor implemented the corrective actions noted above.