HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of March 21, 2014.
- Organization as reported
- HealthPartners Inc, MN
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Desktop Computer, Laptop, Other Portable Electronic Device
- Submission date
- March 21, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15145, row:6284)
- Archived copy
- Held in the private archive (provenance)
HealthPartners, which is both a covered entity (CE) and a business associate (BA), reported that on January 21, 2014, it received a call from a person claiming to be the ex-husband of an employee who had devices containing protected health information (PHI). Upon investigating, the CE/BA learned that while teleworking the employee’s husband assisted her with formatting data and creating spreadsheet reports, thus impermissibly disclosing PHI to her husband. The PHI included the demographic and clinical information of 37,606 individuals, as well as health plan and health provider information. The CE/BA provided breach notification to HHS, affected individuals, and the media. To resolve the issues raised in this matter, the CE/BA updated its confidentiality and teleworking policies, trained employees, and incorporated the refresher training into its new employee orientation. Additionally, the CE/BA implemented technical and administrative safeguards related to remote access including encryption software, limiting employees who can write to encrypted removable media, monitoring electronic PHI being transferred to encrypted removable media, and controls to prevent non-company devices from gaining access to the CE/BA’s production network. OCR obtained documented assurances that the CE/BA implemented the corrective actions steps listed above.