HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of July 2, 2015.
- Organization as reported
- UPMC Health Plan, PA
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- July 2, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14765, row:5904)
- Archived copy
- Held in the private archive (provenance)
An employee of the covered entity (CE), UPMC Health Plan, inadvertently sent an unsecure email with protected health information (PHI) to an incorrect, third-party email address. The breach included the electronic PHI of 722 individuals and included names, dates of birth, member identification numbers, phone numbers, types of insurance, and members' primary care providers. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE retrained staff members. OCR reviewed UPMC Health Plan’s risk analysis to ensure compliance with the Security Rule and obtained assurances that the CE implemented the corrective actions listed above.