HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of March 26, 2018.
- Organization as reported
- Mississippi State Department of Health, MS
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- March 26, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13881, row:5020)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), the Mississippi State Department of Health, discovered that an employee accidentally sent an email on January 25, 2018, to contractors working on a joint project with an attached spreadsheet which the employee did not know contained the protected health information (PHI) of 30,799 individuals. The PHI in the spreadsheet included names, identification numbers, dates of birth, social security numbers, and sexually transmitted disease laboratory test results from 2017. The contractors confirmed that they did not retain or share the PHI. While the CE and the recipient of the email utilize transmission encryption protocols when sending emails, the CE was unable to confirm that the recipient email server accepted the email in encrypted format. There is no indication that the email had been intercepted. The CE provided timely breach notification to HHS, affected individuals, and the media. In response to the breach, the CE sanctioned the employees at fault and provided onsite HIPAA training to employees. OCR obtained assurances that the CE implemented the corrective actions listed above and performed its notification obligations.