HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 8, 2014.
- Organization as reported
- Highmark Inc., PA
- Entity type as reported
- Business Associate
- Category as reported
Theft
- Location of information as reported
- Paper/Films
- Submission date
- July 8, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15047, row:6186)
- Archived copy
- Held in the private archive (provenance)
Health profile and care summaries and corresponding cover letters were incorrectly mailed to senior members of the covered entity (CE), Highmark Health, and their physicians. The protected health information involved in the breach included the names, addresses, telephone numbers, dates of birth, unique medical identifiers (UMI), gender, medications, and health information of 2,589 individuals. The CE provided breach notification to HHS, the media, and affected individuals. Following the breach, the CE issued a new UMI to each member impacted by the incident. The CE determined that a process failure by an employee was the root cause for the incorrect mailing and subsequently terminated the employee. As a result of OCR's investigation, the CE instituted new quality review procedures for mailings and retrained employees on its privacy practices and departmental policies, processes and procedures. OCR obtained details of the CE's revised policies on its health profiles to assure they include only the minimum necessary information.