HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 13, 2018.
- Organization as reported
- WellCare Health Plans, Inc., FL
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Other
- Submission date
- June 13, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13787, row:4926)
- Archived copy
- Held in the private archive (provenance)
On April 10, 2018, law enforcement notified Advanced Medical Reviews (AMR), a business associate (BA) of the covered entity (CE), WellCare Health Plans, that they had arrested an AMR employee for fraudulently impersonating a licensed physician. The employee, who had previously lost his medical license, allegedly used another physician’s credentials to gain employment and conduct medical reviews of 1,101 of the CE’s members which included accessing protected health information (PHI), including demographic and clinical information. The CE provided breach notification to HHS, affected individuals, and the media and established a toll-free information line and provided free credit monitoring. In response to the incident, the CE conducted a full examination of the incident, reviewed the impostor’s medical decisions, and worked closely with the BA to determine the extent of the breach. Additionally, the CE notified the relevant state and federal regulators. OCR obtained assurances that the CE implemented the corrective actions listed above.