HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 30, 2023.
- Organization as reported
- Health First Health Plans, FL
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- June 30, 2023
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 10624, row:1763)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Health First Health Plans, reported an error with its query code that pulls member addresses from its system. The error caused member documents to be mailed to expired addresses. The CE found that a contractor failed to follow its Change Management Procedure. The error affected the protected health information (PHI) of 701 individuals. The PHI disclosed included member names, member IDs, member dates of birth, authorization, and prescription information. The CE notified the HHS Secretary, affected individuals, and the media. In response to the breach, the CE updated its Change Management Procedure and implemented a new procedure that outlined addresses that should be maintained in its system and for what purpose the addresses should be pulled. CE also provided associates and employees with additional training on the new and updated policies. OCR obtained assurances that the CE implemented the corrective actions noted above.