HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Jan. 14, 2011.
- Organization as reported
- State of South Carolina Budget and Control Board Employee Insurance Program (EIP), SC
- Entity type as reported
- Health Plan
- Category as reported
Theft
- Location of information as reported
- Desktop Computer
- Submission date
- Jan. 14, 2011
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15909, row:7048)
- Archived copy
- Held in the private archive (provenance)
A workstation in the covered entity's (CE) finance department was infected with malware that recorded keystrokes and captured screenshots. The CE reported 5,596 individuals as being potentially affected by the malware. The types of PHI involved in the breach included names, addresses, dates of birth, benefits identification numbers, social security numbers, and in some cases, banking information. The CE provided breach notification to affected individuals, HHS, and the media. Following the breach, the CE disconnected the workstation from the network and provided the affected employee with new login credentials, a new hard drive, and additional training. The CE updated its Privacy and Security Rule policies and procedures and initiated mandatory annual supplemental training for all of its employees. The CE improved safeguards by implementing additional network security monitoring programs to actively protect workstation environments and limit the proliferation of malware infections on its network. OCR obtained assurances that the appropriate notifications were made and that the corrective actions listed above were completed.