HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 20, 2016.
- Organization as reported
- Memorial Hermann Health System, reporting on behalf of Memorial Hermann Health System Employee Group Health Plan, TX
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- July 20, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14473, row:5612)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Memorial Hermann Health System, reported that between December 12, 2015, and May 23, 2016, Memorial Hermann Health Solutions, the plan administrator for the Memorial Hermann Health System Employee Group Health Plan, impermissibly disclosed the protected health information (PHI) of 12,061 plan members to the CE’s primary care physicians (PCP). The disclosure included plan members’ names, addresses, dates of birth, telephone numbers and member identification. The plan members did not have an existing relationship with the PCP at the time of the disclosure, and therefore the disclosure was not for treatment purposes. The error occurred while implementing a new process in 2014, which was not effectively communicated to the leadership of the Health Plan. The CE met with the new leadership of the Health Plan to ensure the plan complies with its obligations to control data flow and to ensure the plan’s appropriate use of shared data. Following the incident, the CE provided evidence it notified affected individuals, the media, and posted substitute notification on its website.