HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Dec. 21, 2017.
- Organization as reported
- Molina Healthcare, FL
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Other
- Submission date
- Dec. 21, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13961, row:5100)
- Archived copy
- Held in the private archive (provenance)
Molina Healthcare, Inc., the covered entity (CE), made an error when it prepared mailing lists for its business associate (BA), Merrill Communications, LLC, to use when it sent letters to Molina beneficiaries from October 13, 2017 through October 23, 2017. As a result of the error, when the BA sent the letters they were delivered to an incorrect beneficiary. The breach affected 1,380 individuals and the types of protected health information (PHI) listed in the letters included beneficiaries’ names, member identification numbers, dates of service, and the name of the beneficiaries’ physicians. The CE sent timely breach notification to HHS, the affected individuals, and the media. It also offered affected individuals 24 months of free identity theft protection. To mitigate the breach, the CE conducted an outreach campaign to collect copies of the misdirected mail and sanctioned and retrained the responsible employees. OCR obtained assurances that the CE implemented the corrective actions listed above.