HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 18, 2015.
- Organization as reported
- Molina Healthcare, CA
- Entity type as reported
- Health Plan
- Category as reported
Theft
- Location of information as reported
- Desktop Computer
- Submission date
- Sept. 18, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14708, row:5847)
- Archived copy
- Held in the private archive (provenance)
A former employee of the covered entity’s (CE) business associate (BA), CVS Health, impermissibly exfiltrated the CE’s member information from its systems and saved the protected health information (PHI) onto his personal computer. The PHI involved in the breach included full names, member identification numbers, health card numbers, plan codes and states, and start and end dates. The breach affected approximately 54,203 individuals. The CE provided breach notification to HHS, affected individuals, and the media, and also provided substitute notification. The CE also offered individuals one year of free identity theft protection membership. As a result of this incident, the CE required the BA to improve safeguards by enhancing security for the BA’s fraud management tool and databases containing PHI, and updating its security procedures. OCR reviewed the CE’s policies, procedures, and/or documentation related to impermissible disclosures, safeguards, business associates, and breach notification and obtained assurances that the BA implemented the corrective actions listed above.