HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 2, 2013.
- Organization as reported
- TSYS Employee Health Plan, GA
- Entity type as reported
- Health Plan
- Category as reported
Theft
- Location of information as reported
- Submission date
- Oct. 2, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15308, row:6447)
- Archived copy
- Held in the private archive (provenance)
TSYS Employee Health Plan, the covered entity (CE), discovered that an employee of the CE’s business associate (BA), Paragon Benefits, Inc., misappropriated a digital file that contained protected health information (PHI) for 5,232 beneficiaries. The CE sent timely breach notification to HHS, to affected individuals, to the media and posted substitute notification on its website. In response to the breach, the CE provided affected individuals with identity theft protection, credit monitoring, tax forms, contact information for the Federal Trade Commission, and instructions on how to put a credit freeze on a credit account. OCR determined that the CE and BA had an effective BA agreement in place at the time of the breach. The CE terminated its contract with the BA as of December 31, 2012, but the BA continues to provide services for outstanding claims that it submitted on the CE’s behalf. The CE obtained assurances from the BA that additional security measures have been implemented. OCR obtained assurances that the CE implemented the corrective actions listed above.