HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Nov. 22, 2016.
- Organization as reported
- Emblem Health - GHI, NY
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Network Server, Other, Paper/Films
- Submission date
- Nov. 22, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14353, row:5492)
- Archived copy
- Held in the private archive (provenance)
Group Health Inc., the covered entity, (CE) reported that its business associate (BA) mailed letters to approximately 88,112 members with their social security number on the mailing label. The types of protected health information (PHI) involved in the breach included names, addresses, and social security numbers. The CE provided breach notification to HHS, affected individuals, and the media and provided free credit monitoring to the affected individuals. Following the breach, the CE revised its mailing procedures, sanctioned the employees whose action contributed to the breach, and trained employees and vendors on information security, privacy and quality assurance for member mailings. As a result of OCR’s investigation, the CE is expected to transition to a new IT operating platform during 2018, which should reduce the likelihood of this type of incident occurring again. The CE is also expected to take additional corrective actions pursuant to a consent judgment reached by the CE with the Attorney General of the State of New York.