HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 1, 2018.
- Organization as reported
- SimplyWell, TX
- Entity type as reported
- Business Associate
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Other
- Submission date
- June 1, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13798, row:4937)
- Archived copy
- Held in the private archive (provenance)
SimplyWell, a sub-contractor business associate (BA), reported that one of its workforce members accidentally uploaded a file containing protected health information (PHI) of 597 individuals onto an online portal it maintained for a covered entity (CE). The file, which included names, dates of birth, and “non-smoker” status of the individuals, was potentially viewable by the CE’s members with access to the portal. The BA provided breach notification to HHS, affected individuals, and the media. OCR reviewed the BA's policies and procedures related to the incident and determined them to be consistent with the provisions of the Privacy and Security Rules. Following the breach, the BA retrained the involved workforce member on its policies and procedures and also sent reminders to its workforce members on its policies and procedures.