HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of May 11, 2012.
- Organization as reported
- Hogan Services Inc. Health Care Premium Plan, MO
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- May 11, 2012
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15633, row:6772)
- Archived copy
- Held in the private archive (provenance)
On March 30, 2012, Hogan Services Inc. (HSI), the sponsor of a fully insured employee health plan, erroneously distributed an email to 287 employees containing the electronic protected health information (ePHI) of approximately 1,134 individuals. The ePHI included names, social security numbers, dates of birth, gender, group health plan identification numbers, member identifications, enrollment dates, and types of coverage for employees and names, dates of birth, and relationship information for employees’ spouses and dependents enrolled in the group health insurance plan. Upon discovering the breach, HSI directed its email vendor to shut down its email server, and constructed an incident response team that went to each workstation and deleted the ePHI from employees’ computers, and shredded any copies of the email that had been printed. HSI provided breach notification to HHS and affected individuals. As a result of OCR’s investigation, HSI made a decision not to accept, store, or transmit ePHI, and it retrained its workforce regarding the HIPAA Rules. HSI also added encryption software to employees’ accounts that have access to ePHI. OCR obtained assurances that HSI implemented the corrective actions listed above.