HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 14, 2016.
- Organization as reported
- SUNSHINE STATE HEALTH PLAN, INC., FL
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- July 14, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14481, row:5620)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Sunshine State Health Plan, Inc., discovered that a case manager emailed a daily inpatient census report to an incorrect email address. The email contained the protected health information (PHI) of 1,479 individuals including member names, addresses, dates of birth, plan and eligibility information, hospitalization dates, Medicaid and Medicare ID numbers, diagnoses, and procedures. The CE provided breach notification to HHS, affected individuals, and the media and also posted substitute notice on its website. The CE offered free credit monitoring and identity theft restoration services. In response to the breach, the CE revised its encryption and decryption policy and procedures to require all employees to encrypt emails containing PHI and sensitive data. The CE also revised its confidentiality and release of PHI policy and its mitigation policies and procedures. The CE sanctioned the involved employee for violating its policies. OCR obtained assurances that the CE implemented the corrective actions listed above.