HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Sept. 9, 2016.
- Organization as reported
- Public Education Employees' Health Insurance Plan, AL
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Network Server
- Submission date
- Sept. 9, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14430, row:5569)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Public Education Employees’ Health Insurance Plan, discovered that as a result of an information technology (IT) upgrade some documents that included protected health information (PHI) related to multiple members inadvertently became viewable to other members through its Member Online System (MOS). The PHI involved in the breach included members’ and dependents’ names, program identification numbers, birth dates, and retirement dates pertaining to 1,349 individuals. Some of the document also contained social security numbers. The CE provided breach notification to HHS, affected individuals, and the media. The CE provided credit monitoring services to all affected individuals for 12 months at no cost to them. In response to the breach, the CE investigated and worked in conjunction with Deloitte (the company hired to provide software and professional services for the new IT system) to revise the newly implemented software coding to terminate access to the documents involved in this incident. The CE and Deloitte were able to apply an emergency fix on the same day that the incident was discovered. Additionally, the CE revised its internal protocols for uploading documents. OCR obtained assurances that the CE implemented the corrective actions listed above.