HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Dec. 20, 2012.
- Organization as reported
- Health Advantage, AR
- Entity type as reported
- Health Plan
- Category as reported
Other
- Location of information as reported
- Paper/Films
- Submission date
- Dec. 20, 2012
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15510, row:6649)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Health Advantage, mailed Personal Health Statements to approximately 2,863 plan members’ previous addresses due to an internal programming error. This incident affected additional patients (addressed in separate breach reports) in that the covered entity had contracted with other covered entities, BCBS of Arkansas, the State of Arkansas Department of Finance and Administration Employee Benefits Division health plan and Baptist Health System’s health plan. The protected health information (PHI) involved in the breach included patients’ demographic information, health insurance identification numbers, descriptions of treatment or services received, and names of treating facilities or providers. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE corrected the programming error, purged outdated information from its system, and implemented new quality control procedures for mailings. As a result of OCR’s investigation, Health Advantage also revised or entered into multiple business associate agreements.