HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 29, 2011.
- Organization as reported
- Department of Personnel and Administration, CO
- Entity type as reported
- Business Associate
- Category as reported
Theft
- Location of information as reported
- Other
- Submission date
- June 29, 2011
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15822, row:6961)
- Archived copy
- Held in the private archive (provenance)
\The covered entity's (CE) business associate (BA) mailed a compact disk (CD) containing electronic protected health information (ePHI) through the inter-office mail system for delivery in another city. The CD, containing ePHI of 3,589 individuals, was lost en route. The PHI included state Medicaid and children's health plan data. Immediately following the breach, the CE completed a risk analysis to identify additional concerns and developed a risk management plan. The CE provided breach notification to the affected individuals, HHS, and the media and provided substitute notification on its website. To prevent a similar breach from happening in the future, the CE required all future ePHI to be encrypted prior to shipment. OCR obtained assurances that the CE implemented the corrective action listed above. \ \