HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 2, 2015.
- Organization as reported
- Tulare County Health & Human Services Agency, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- April 2, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14833, row:5972)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE) reported a breach of 845 individuals’ electronic protected health information (e-PHI), as a result of a workforce member e-mailing information regarding logging into CE’s health care portal, without blind copying the patients, and encrypting the e-mails. This action, or lack thereof, left every patient’s e-mail address exposed. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE improved safeguards by changing and strengthening password requirements, disabling all patients’ health portal accounts, and implementing new technical safeguards. In addition, the CE required all affected patients to re-register with its online portal, and revised and implemented new policies and procedures. The CE sanctioned the workforce members involved and re-trained the entire workforce. OCR provided technical assistance regarding the HIPAA Security Rule and obtained documented assurances that the CE implemented the corrective actions listed above.