HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 17, 2017.
- Organization as reported
- Emblem Health - GHI, NY
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Feb. 17, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14267, row:5406)
- Archived copy
- Held in the private archive (provenance)
A business associate (BA) of Group Health Inc., the covered entity (CE), impermissibly disclosed the protected health information (PHI) of 7,083 individuals when it mailed 2015 1095-B tax forms to the wrong members. The types of PHI involved in the breach included members’ names, addresses, dates of birth, and social security numbers. The CE provided breach notification to HHS, affected individuals and the media, and provided free credit monitoring to the affected individuals. Following the breach, the CE developed a frequently asked question document to assist staff to respond to calls regarding the breach, re-mailed the 1095-B tax forms, requested the return of the forms or attestation that the health information received was destroyed, and moved the print function of the 1095-B tax forms to another BA. As a result of OCR’s investigation, the CE is expected to continue to request the return or verify that the health information was destroyed and ensure that the CE’s BAs are trained on the provisions of Privacy, Security and Breach Notification Rules.