HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Aug. 27, 2015.
- Organization as reported
- Metropolitan Atlanta Rapid Transit Authority, GA
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Aug. 27, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14721, row:5860)
- Archived copy
- Held in the private archive (provenance)
The Metropolitan Atlanta Rapid Transit Authority (MARTA), acting on behalf of its self-insured health plan, mailed 785 Voluntary Critical Illness Insurance forms to the incorrect employees. The correspondence contained protected health information (PHI) including names, addresses, social security numbers, and dates of birth. MARTA conducted a breach assessment and provided breach notification to HHS, affected individuals, and the media. In response to the incident, MARTA developed standard operating procedure for the Benefits Office for handling employees’ PHI and trained employees. Under the new procedures, the staff will not prepopulate employee forms, applications, worksheets, and confirmation statements with individually identifiable information nor will they send documents containing individually identifiable data to the internal print shop. OCR obtained assurances that MARTA implemented the corrective actions listed above.