HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of May 26, 2016.
- Organization as reported
- Orchid MPS Holdings, LLC Welfare Benefit Plan, MI
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- May 26, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14514, row:5653)
- Archived copy
- Held in the private archive (provenance)
On March 30, 2016, a vendor of Orchid MPS Holdings, LLC Welfare Benefit Plan, the covered entity (CE), improperly disclosed protected health information (PHI) by mailing IRS Forms 1095-C to the wrong recipients. The breach affected 771 individuals and included addresses, zip codes, names, and social security numbers. The CE provided breach notification to HHS and affected individuals. The CE instructed employees to return to Human Resources the 1095-C forms they received in error and provided free credit monitoring and identity theft protection to individuals affected by the breach. Following the breach, the CE terminated its contract with the vendor that caused the breach and entered into a business associate agreement with a new vendor. The CE also implemented additional procedures to reduce the incidence of error in the 1095-C reporting process, including personally distributing forms to current employees and ensuring the forms contain only the minimum necessary information. OCR obtained documented assurances that the CE implemented the corrective actions listed above.