HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Aug. 8, 2017.
- Organization as reported
- National DCP Health Plan, GA
- Entity type as reported
- Health Plan
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Aug. 8, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14101, row:5240)
- Archived copy
- Held in the private archive (provenance)
In March 2017, an employee of the covered entity (CE), National DCP Health Plan, followed a link included in a phishing email, and as a result, an unauthorized user accessed her email account. The types of protected health information (PHI) involved in the breach consisted of health plan enrollment data, including names, addresses, social security numbers, and dates of birth for 1,190 individuals. The CE provided breach notification to HHS, affected individuals, and on its website. It also reported the incident to the FBI and the Secret Service. In response to the incident and OCR’s investigation, the CE implemented multi-factor authentication for access to its email systems, improved safeguards for inbound email, and required several additional training sessions for its workforce, including training and testing for recognizing phishing email scams. OCR obtained assurances that the CE implemented the corrective actions listed above.