HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 17, 2018.
- Organization as reported
- Independence Blue Cross, LLC, PA
- Entity type as reported
- Business Associate
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Other
- Submission date
- Sept. 17, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13688, row:4827)
- Archived copy
- Held in the private archive (provenance)
On July 19, 2018, the covered entity (CE) learned that an employee uploaded a file containing limited member information to a public-facing website that was publicly accessible between April 23, 2018, and July 20, 2018. The types of protected health information involved in the breach included demographic, clinical, and health claims information for approximately 16,762 subscribers. The CE immediately took steps to ensure the file was permanently removed from the website, and launched an investigation to determine the nature and scope of this incident, working with a forensics investigation firm. The CE noted that the website involved was under development by the employee and was not well known or marketed to the public. The CE undertook multiple efforts to obtain data from the website hosting company, but efforts did not yield meaningful results, as the company hosting the website was not able to provide any data to the CE for the period of time that the file was accessible. The CE provided breach notification to HHS, affected individuals, and the media and provided credit monitoring services to those affected. OCR reviewed the individual breach notification letters, as well as the security measures implemented to address risks and vulnerabilities. OCR obtained assurances that the CE implemented the corrective actions listed.