HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 26, 2017.
- Organization as reported
- Mississippi Division of Medicaid, MS
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- May 26, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14181, row:5320)
- Archived copy
- Held in the private archive (provenance)
On April 7, 2017 the covered entity (CE), Mississippi Division of Medicaid, discovered that beginning on May 2, 2014, an employee had used WuFoo, an online service, to create and post online forms to the CE’s external website for public use. While these forms were secure on the CE’s and WuFoo’s websites, they were not encrypted when emailed between Wufoo and the CE’s employees. These forms requested protected health information (PHI) from beneficiaries. As the form information was transmitted via unencrypted email across the public internet, the CE was unable to determine whether a third party inappropriately accessed the form information contained in these emails. The CE did not have a Business Associate Agreement (BAA) with WuFoo. The PHI contained in the unsecured forms included: beneficiary or potential applicants’ names, addresses, emails, enrollment dates, Medicaid and/or Medicare identification numbers, social security numbers, phone numbers, clinical information, and health plans. Approximately 4,524 people were affected by the breach. The CE provided breach notification to HHS, affected individuals, and the media, and also provided substitute notice on its website. Following the breach, the CE cancelled its WuFoo account and conducted an audit of all active contracts to ensure proper BAAs. It also revised its purchasing policy and Privacy and Security policies and trained staff on its new policies. Additionally, the CE structured the Privacy Officer position to report directly to the CE’s Executive Director and counseled the employee involved in the breach. OCR obtained assurances that the CE implemented the corrective actions listed above.