HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Sept. 14, 2018.
- Organization as reported
- WellCare Health Plans, Inc., FL
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Sept. 14, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13690, row:4829)
- Archived copy
- Held in the private archive (provenance)
On July 25, 2018, the covered entity (CE), WellCare Health Plans, began receiving phone calls from members complaining that they had received a letter containing another member’s protected health information (PHI). The CE investigated and determined that between January 20, 2018, and June 20, 2018, appointment reminder letters for 26,942 members were mistakenly sent to the wrong members. The letters contained name, age, Medicaid number, healthcare providers, and a general reason for the appointment. Following the incident, the CE sanctioned the responsible staff members by terminating one individual, and retraining the other on HIPAA requirements. The CE also reviewed and updated its policies and procedures. As a result of OCR’s investigation, the CE created a new, automated procedure for mail reminder letters. The CE also provided breach notification to HHS, the affected individuals, substitute notice for affected members that couldn’t be located, and notice to the media.