HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 9, 2016.
- Organization as reported
- Washington State Health Care Authority (HCA), WA
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- Feb. 9, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14619, row:5758)
- Archived copy
- Held in the private archive (provenance)
A workforce member impermissibly emailed the protected health information (PHI) of 141,288 individuals to an unauthorized personal email account that belonged to another state employee related to the workforce member. The types of PHI involved in the breach included addresses, dates of birth, names, other identifiers, social security numbers, diagnoses, and other treatment information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the covered entity (CE), Washington State Health Care Authority, updated all relevant policies and procedures, implemented additional security measures, and retrained employees. The CE updated its access management program and hired new staff to focus solely on managing access to electronic systems. It also sanctioned the employee involved in the breach. OCR obtained written assurances that the CE implemented the corrective actions listed above.