HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 28, 2018.
- Organization as reported
- State of Alaska Department of Health and Social Services, AK
- Entity type as reported
- Health Plan
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Desktop Computer, Email
- Submission date
- June 28, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13770, row:4909)
- Archived copy
- Held in the private archive (provenance)
The State of Alaska Department of Health and Human Services (Alaska), the covered entity (CE), reported that it was the victim of a cyber-attack that affected the electronic protected health information (ePHI) of 942,528 individuals. The ePHI involved included names, addresses, Social Security numbers, drivers’ license information, health insurance information, claims information, clinical information, and financial information. Upon discovering the breach, Alaska requested and received assistance from the FBI to conduct its investigation of the breach incident to determine the accurate number of individuals affected and how the virus and unauthorized software was placed on its computer system. Alaska notified HHS, affected individuals, the media, and provided substitute notice. During OCR’s investigation, we provided technical assistance to Alaska on risk analysis, risk management, and security policies and procedures to ensure adequate safeguards of Alaska’s ePHI. As a result, Alaska updated its security policies and procedures, and sanctioned the responsible employee.