HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 20, 2014.
- Organization as reported
- MetroPlus Health Plan, Inc., NY
- Entity type as reported
- Health Plan
- Category as reported
Other
- Location of information as reported
- Submission date
- Nov. 20, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14930, row:6069)
- Archived copy
- Held in the private archive (provenance)
An employee of Metro Plus Health Plan, Inc., emailed two unencrypted files to her personal and work email addresses containing the electronic protected health information (ePHI) of 31,980 members of the health plan, which included members’ names, addresses, dates of birth and social security numbers. Metro Plus Health Plan, the covered entity (CE), provided breach notification to HHS, the media, and affected individuals, including the offer of one year of credit monitoring services. The CE also documented the unauthorized disclosure of its members’ ePHI for accounting of disclosure purposes. Following the breach, the CE conducted an internal investigation, sanctioned the employee, ensured the ePHI was deleted from the employee’s personal email account, and reminded its employees regarding prohibitions against emailing members’ ePHI to personal email accounts. Additionally, the CE is expected to conduct a risk analysis and implement a corresponding risk management plan as required by the Security Rule.