HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Dec. 21, 2018.
- Organization as reported
- DePaul University, IL
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- Dec. 21, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13590, row:4729)
- Archived copy
- Held in the private archive (provenance)
On December 14, 2018, a DePaul University employee inadvertently sent an email to participants in its health plan’s wellness program without blind copying the email recipients. This allowed the names of 656 individuals to be visible to other recipients of the email. The covered entity (CE) provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE send an email to recipients requesting that they delete the erroneous email, counseled and educated the employee who sent the email, and provided HIPAA refresher training to the benefits staff. The CE also implemented a new process to automate blind copying of recipients for any group email distribution or notices related to the CE's health and welfare benefits plan. OCR obtained documented assurances that the CE implemented these corrective action steps.