HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 25, 2014.
- Organization as reported
- Iowa Medicaid Enterprise, IA
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- April 25, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15094, row:6233)
- Archived copy
- Held in the private archive (provenance)
On August 5, 2015, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), Midwest Region initiated a review of the covered entity (CE), Iowa Department of Human Services. This review stems from a complaint and security breaches that the CE self-reported to OCR-HQ (as required by 45 CFR § 164.408(b)), which occurred over a period of nine years from 2005 to 2014. The CE provided breach notification to HHS, affected individuals, and the media. To prevent similar breaches from happening in the future, the CE conducted multiple internal investigations, evidenced the performance of its risk analysis and corresponding risk management plan. It also sanctioned the employees involved in the breach incidents, provided training to its staff on its policies and procedures regarding Security Awareness. Additionally, the CE implemented annual security control reviews that assess its compliance with the Privacy, Security, and Breach Notification Rules and implemented new HIPAA policies and procedures. OCR obtained copies of the CE's executed business associate agreements and documentation that substantiates the CE's corrective actions described above.