HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 11, 2018.
- Organization as reported
- New York City Human Resources Administration/Department of Social Services, NY
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- May 11, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13818, row:4957)
- Archived copy
- Held in the private archive (provenance)
From January 1, 2017 to March 13, 2018, an internal programming error in the mailing system for Medicaid renewal forms may have caused forms to be mailed to the wrong post office box addresses, affecting 2135 individuals. The types of protected health information (PHI) on the forms included Medicaid clients’ names, other household members’ names, addresses, clients’ dates of birth and other household members’ dates of birth, clients' identification numbers (a unique Medicaid case number), household compensation, resources, and income information. The CE provided breach notification to HHS, the media, and the affected individuals, and posted notice to its website. Following the breach, the CE determined that the programming error occurred because of an unintended electronic interaction of the various systems used in the mailing process and deployed a technical fix. To mitigate any potential harmful effects on Medicaid beneficiaries, the CE re-opened any case that closed in 2018 for failure to return the Medicaid renewal form, and provided such clients with instructions for seeking reimbursement for medical bills incurred after their Medicaid coverage ended. For those affected individuals whose recertification period had not ended, the CE extended the eligibility period, so new Medicaid renewal forms could be sent to them. OCR obtained assurances that the CE implemented the corrective actions listed. Additionally, the CE is expected to mail individual notification letters to the 57 affected individuals identified after the CE filed its initial breach report, which had reported 2,078 affected individuals.