HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 26, 2018.
- Organization as reported
- Illinois Department of Healthcare and Family Services, IL
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- April 26, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13842, row:4981)
- Archived copy
- Held in the private archive (provenance)
The Illinois Department of Healthcare and Family Services (IDHFS), the covered entity (CE), reported that a state employee inadvertently changed the addresses of its clients to the incorrect addresses and subsequently mailed protected health information (PHI) to the wrong recipients. This breach affected approximately 4,968 individuals. The PHI involved included names, dates of birth, phone numbers, financial information, and clinical information. The CE notified HHS, affected individuals, and the media. As a result of this breach, IDHFS implemented additional administrative safeguards to prevent incidents of this nature. OCR obtained assurances that the corrective actions noted above were completed.