HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of April 27, 2010.
- Organization as reported
- TOWERS WATSON, VA
- Entity type as reported
- Business Associate
- Category as reported
Theft
- Location of information as reported
- Other
- Submission date
- April 27, 2010
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 16063, row:7202)
- Archived copy
- Held in the private archive (provenance)
A business associate (BA), Towers Watson, of the covered entity (CE), General Agencies Welfare Benefits Program, lost two electronic media disks containing protected health information (PHI) while transporting the disks between two BA offices. The disks contained the names, health plan numbers, and social security numbers of 1,874 individuals. The BA notified all affected individuals and provided two years of enhanced credit services. The CE notified HHS and the media and posted substitute notice on its website. The CE had the BA destroy any of its PHI that had been retained by the BA and executed a new BA agreement for any remaining PHI that the BA was unable to destroy because they were archival files. After OCR's investigation, the CE updated its privacy and breach notification policies and procedures. \ \