HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 14, 2010.
- Organization as reported
- Comprehensive Care Management Corporation, NY
- Entity type as reported
- Health Plan
- Category as reported
Theft
- Location of information as reported
- Desktop Computer, Email, Laptop, Network Server
- Submission date
- June 14, 2010
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 16037, row:7176)
- Archived copy
- Held in the private archive (provenance)
OCR opened an investigation of the covered entity (CE), Comprehensive Care Management Corporation, after it reported two former employees sent emails that contained the electronic protected health information (ePHI) of 1,020 individuals to their personal email accounts to open a competitor organization. The ePHI included names, addresses, and enrollment information. Upon discovery of the breach, the CE conducted an internal inquiry and found that the former employees disclosed the ePHI to its competitor. As a result of OCR's investigation, the CE replaced and strengthened external firewalls, restricted access to email websites, restricted the use of portable devices, limited the ability to upload data to external websites, and evaluated new monitor and control software for network information. In addition, the CE provided training to all staff on its HIPAA policies and procedures. The CE also entered into an agreement with its competitor who hired the former employees to return or destroy the ePHI.