HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 27, 2018.
- Organization as reported
- MedWatch LLC, FL
- Entity type as reported
- Business Associate
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Network Server
- Submission date
- April 27, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13837, row:4976)
- Archived copy
- Held in the private archive (provenance)
On October 20, 2017, an information technology subcontractor for MedWatch, a business associate (BA), applied a misconfigured security patch to an online portal during a routine update causing some protected health information (PHI) to be viewable by the public. The breach affected 40,621 individuals who are members of the BA’s client health plans and third party administrators. The exposed PHI included various combinations of members’ demographic and health insurance information. Upon discovery of the breach on December 15, 2017, the BA immediately restricted access to the portal and requested that internet search engines remove all cached data. The BA notified its client covered entities and provided breach notification to HHS, affected individuals, and the media and posted substitute notice on its website. The BA improved technical safeguards, updated its policies, and retrained all staff and contractors on HIPAA Privacy and Security. OCR obtained assurances that the BA implemented the corrective actions listed above.