HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 14, 2016.
- Organization as reported
- Texas Health and Human Services Commission, TX
- Entity type as reported
- Health Plan
- Category as reported
Loss
- Location of information as reported
- Paper/Films
- Submission date
- June 14, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14497, row:5636)
- Archived copy
- Held in the private archive (provenance)
Between April 19, 2016 and May 10, 2016, Iron Mountain, a business associate (BA) of the covered entity (CE), Texas Health and Human Services Commission, was unable to locate sixteen cartons of records containing protected health information (PHI). The types of PHI involved in the breach included the names, addresses, social security numbers, social security claim numbers, dates of birth, medical record numbers, Medicaid/individual numbers, case numbers, and bank account numbers for over 500 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the incident, the CE ensured that the BA retrained its workforce members on privacy and appropriate storage and tracking procedures. Additionally, the CE initiated a change to its procedure for reconciling file inventories and verifying file box destruction. OCR obtained assurances that the CE implemented the corrective actions noted above.