HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Jan. 3, 2017.
- Organization as reported
- MetroPlus Health Plan, NY
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Other
- Submission date
- Jan. 3, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14309, row:5448)
- Archived copy
- Held in the private archive (provenance)
Staff members sent unencrypted files containing the electronic protected health information (ePHI) of 808 members of the covered entity (CE), including demographic information, to a vendor that was not a business associate (BA) of the covered entity (CE). The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE ensured that its vendor destroyed the ePHI and retrained the staff members responsible for the breach incident regarding information security. The CE updated its annual training to include information regarding interactions with its vendors, including data sharing, and implemented a new standard operating procedure regarding file transfers. The CE also documented the unauthorized disclosure of its members’ ePHI for accounting of disclosure purposes. As a result of OCR’s investigation, the CE is expected to perform a thorough and accurate risk analysis and establish a risk management plan. Also, the CE is expected to implement technical security measures to guard against unauthorized access to ePHI that is being transmitted over an electronic communications network. In addition, the CE is expected to provide periodic security updates to workforce members regarding safeguarding ePHI in transmission, and revise its policies and procedures regarding breach notification and provide training to workforce members on the revised policies and procedures.