HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 24, 2012.
- Organization as reported
- South Carolina Department of Health and Human Services, SC
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- April 24, 2012
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15645, row:6784)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), South Carolina Department of Health and Human Services, discovered that an employee sent Medicaid reports to her personal email from January 31, 2012, through April 4, 2012. The breach affected 228,435 individuals and the types of protected health information (PHI) involved in the breach included names, addresses, phone numbers, social security numbers and for 22,648 individuals, their Medicaid identification numbers. The CE provided timely breach notification to HHS, affected individuals, and the media. CE also posted notification about the breach on its website. In response to the breach, CE suspended access to most of its ad hoc electronic reporting, initiated a comprehensive review of its privacy and security safeguards, contacted local and federal law enforcement, and sanctioned the responsible employee. The CE also revised its security policies to restrict employee access to PHI to only that necessary for the individual’s job function and implemented an automated monitoring system to track user activity in its computer system. CE also implemented annual privacy and security training. OCR obtained assurances that the CE implemented the corrective actions listed above.