HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Feb. 21, 2014.
- Organization as reported
- StayWell Health Management, LLC, MN
- Entity type as reported
- Business Associate
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Network Server
- Submission date
- Feb. 21, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15173, row:6312)
- Archived copy
- Held in the private archive (provenance)
On February 21, 2014, StayWell Health Management, LLC, a business associate (BA) of the covered entity (CE), Missouri Consolidated Health Care Plan, erroneously made a spreadsheet accessible via an electronic link on the internet. The spreadsheet included participants’ complete names, email addresses, unique internal identification numbers, current status in the wellness program, information regarding email notifications, and whether a participant had completed two program surveys. Approximately 10,024 individuals were affected by the breach. The BA provided breach notification to affected individuals and the media. The CE provided breach notification to HHS. Following the breach, the CE ensured that the BA removed the spreadsheet from public accessibility via the internet and implemented the use of a legacy system in order to safeguard electronic protected health information (ePHI) in transit. The CE also updated its Privacy and Security Policy, to include encryption standards for safeguarding data in process, in transit, and at rest. OCR obtained documented assurances that the CE and BA implemented the corrective actions listed above.