HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 24, 2015.
- Organization as reported
- Healthfirst Affiliates that include Healthfirst PHSP, Inc., Managed Health, Inc., HF Management Services, LLC, and Senior Health Partners, NY
- Entity type as reported
- Health Plan
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Electronic Medical Record
- Submission date
- July 24, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14748, row:5887)
- Archived copy
- Held in the private archive (provenance)
On May 27, 2015, the U.S. Department of Justice (DOJ) informed the covered entity (CE), Healthfirst, that an individual who perpetrated a fraud against the CE in 2013 may have stolen 5,338 patients’ electronic protected health information (ePHI) from the CE’s online portal. The types of stolen ePHI included demographic, clinical, and claims information, including Medicare and Medicaid identification numbers. The CE provided breach notification to HHS, the affected individuals and the media. Following the breach, the CE strengthened security controls on its online portal and implemented multifactor validation for provider access to the portal. OCR obtained assurances that the CE implemented the corrective actions listed. Additionally, the CE is expected to conduct a risk analysis, implement a corresponding remediation plan, and ensure the implementation of policies and procedures relating to information system activity review, security incident response and reporting, access and audit controls, and creating/maintaining retrievable exact copies of ePHI.