HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of April 8, 2011.
- Organization as reported
- Union Security Insurance Company, MO
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Other
- Submission date
- April 8, 2011
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15871, row:7010)
- Archived copy
- Held in the private archive (provenance)
On February 18, 2011, a Union Security Insurance Co. policy holder notified the covered entity (CE) that while accessing their online account, they were also able to access the accounts of other policy holders. Approximately 1,500 individuals were affected by this breach. These accounts included names, dates of birth, social security numbers, and other identifiers. In addition, on May 17, 2013, an employee of the CE impermissibly emailed a spreadsheet which included identifiable data belonging to a customer group of the CE. Approximately 1,127 group members were affected by this breach. The email included names and social security numbers. The CE provided breach notification to HHS, affected individuals, and the media. To prevent similar breaches from happening in the future, the CE disabled its website, reversed the problematic coding, and increased the number of vulnerability scans of the CE’s website. The CE also retrained employees, to include distribution of its revised policy and procedure for safeguarding social security numbers. Following OCR’s investigation, the CE prohibited social security numbers on any document being sent to any customer. The CE provided OCR documentation that substantiates all its actions taken in response to the two breach incidents.