HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Dec. 19, 2016.
- Organization as reported
- Humana Inc. [case #HU16004F3], KY
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Dec. 19, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14326, row:5465)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Humana, Inc., mailed letters to subscribers instead of addressing the letters to their adult dependents due to a system error. The breach affected the protected health information (PHI) of 3,674 individuals, whose service notification letters were sent to their respective health plan subscribers instead of to the individual. The PHI on these service notification letters included names, identification numbers, dates of service, providers of services, and services approved. In response to the breach, the CE updated its Impermissible Use and Disclosures Policy and its Electronic Information Systems Policy, which now allows access only to those persons or software programs that have been granted access rights to view electronic PHI. The CE continues to provide HIPAA, Ethics, and Compliance Training to its staff. The CE provided timely breach notification to HHS, affected individuals, and media outlets in Louisville, KY and New Orleans, LA. OCR obtained assurances that the CE implemented the corrective actions listed above.