HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 22, 2019.
- Organization as reported
- Molina Healthcare, CA
- Entity type as reported
- Health Plan
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Feb. 22, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13519, row:4658)
- Archived copy
- Held in the private archive (provenance)
On December 27, 2018, Equian, LLC, a business associate (BA), notified the covered entity (CE), Molina, that the BA’s subcontractor, Wolverine Solutions Group, experienced a ransomware security incident on or about September 23, 2018, affecting individuals across several CEs. The incident affected the electronic protected health information (ePHI) of 895 of Molina’s members in six states, including names, addresses, health plan names, dates of service, and names of some healthcare providers. The CE provided breach notification to HHS and to affected individuals starting on February 22, 2019, and provided affected individuals with free identity protection for 12 months. In response to the security incident and corresponding investigation, the CE provided the BA with additional training on the HIPAA requirements and required that the BA ensure that its subcontractor implements systems security enhancements. OCR reviewed the applicable BA contracts and obtained assurances that the CE implemented the corrective action steps listed above.