HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 3, 2019.
- Organization as reported
- Humana Inc, KY
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Network Server
- Submission date
- June 3, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13378, row:4517)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Humana, discovered that from March 15, 2019, to May 1, 2019, a programming error in its Go365 mobile application allowed some Go365 participants to see other participants’ protected health information. Go365 is a reward and incentive program that helps participants track and reach health goals. Humana determined that 863 individuals were affected, 357 of whom are Humana insurance members. The other 486 affected individuals are employees of self-insured entities that contract with Humana to administer their insurance programs. Humana formally notified all these entities of the breach (a total of 179 employers). The types of protected health information involved in the breach included participants' names, addresses, email addresses, identification numbers, biometric screening information, and other wellness information. Following the breach, Humana deployed two updates to the Go365 application and fixed the programming error and initiated ongoing monitoring to ensure the fix was effective. Humana provided breach notification to HHS, the affected individuals that are Humana insurance members, and to the employers of the other affected individuals. Humana did not provide media notification because there were no states in which more than 500 individuals were affected. OCR obtained assurances that Humana implemented the corrective actions listed above.