HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Dec. 13, 2018.
- Organization as reported
- Contra Costa Health Plan, CA
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Electronic Medical Record, Email
- Submission date
- Dec. 13, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13602, row:4741)
- Archived copy
- Held in the private archive (provenance)
On May 22, 2018, the covered entity (CE), Contra Costa Health Plan, discovered that a business associate (BA) had provided services under a false identity. The CE investigated and determined that during her work for the CE the BA had access to 862 health plan enrollees’ protected health information (PHI), including demographic and clinical information. Following the breach, the CE immediately terminated the BA contract and the individual contractor’s access to the CE’s records. The CE conducted a thorough forensic audit trail investigation and did not find any evidence of improper access, use, or disclosure of enrollee PHI by the contractor. The CE provided breach notification to HHS, affected individuals, and the media. OCR obtained assurances that the CE implemented the corrective actions listed above.