HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Aug. 15, 2014.
- Organization as reported
- State of Tennessee State Insurance Plan, TN
- Entity type as reported
- Health Plan
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Aug. 15, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15015, row:6154)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), State of Tennessee State Insurance Plan, discovered on June 10, 2014, that Onsite Health Diagnostics, a subcontractor of its business associate (BA) American Healthways Services, experienced a security incident in which an unknown source gained unauthorized access to its online scheduler during the period from January 4, 2014 to April 11, 2014. The incident resulted in unauthorized access to an information table containing names, dates of birth, addresses, email addresses, phone numbers, and genders of 60,582 individuals. The CE had a BA agreement in place with the BA. The CE provided breach notification to HHS and demanded that the BA submit a corrective action plan to make sure the problem that led to the breach had been remediated. The subcontractor provided breach notification to HHS, sent individual notification, and provided media notice. The subcontractor offered identity protection to the affected individuals and transitioned customers to an improved scheduling system. OCR obtained assurances from the CE that the CE, BA, and subcontractor implemented the corrective actions noted above.