HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 26, 2016.
- Organization as reported
- Nintendo of America Inc., WA
- Entity type as reported
- Health Plan
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Feb. 26, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14607, row:5746)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Nintendo of America, Inc., reported that on May 5, 2014, attackers impermissibly accessed and acquired data in possession of its business associate (BA), Premera. This data included the protected health information (PHI) of former and current participants in health plans of certain members of the Blue Cross Blue Shield Association dating back to 2002. The BA is a member of the Blue Cross Blue Shield Association and is the third-party administrator for the health plan. As a result, some former and current plan participants have been impacted. The CE reported that 6,248 individuals were affected and the PHI involved in the breach included demographic, clinical, and financial information. The BA provided breach notification to HHS, affected individuals, and the media. The CE had a BA agreement in place with Premera. OCR determined that Nintendo is in compliance with the Privacy, Security, and Breach Notification Rules.