HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Feb. 27, 2019.
- Organization as reported
- West Virginia Public Employees Insurance Agency, WV
- Entity type as reported
- Health Plan
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Feb. 27, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13518, row:4657)
- Archived copy
- Held in the private archive (provenance)
By purporting to be healthcare providers, unauthorized users registered for a portal operated by Availity, a subcontractor of the covered entity’s (CE) business associate (BA), Humana, gaining access to protected health information (PHI) for a period of six months. The breach affected approximately 1,400 individuals, including the PHI of 39 members of this CE, such as names, insurance identification numbers, benefit information, and care reminders. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE obtained written assurances from Availity that it implemented technical safeguards to limit the risk of such incidents in the future, and obtained written assurances from the BA regarding the HIPAA compliance of its subcontractors. OCR reviewed the CE’s BA agreement and opened a separate investigation of the Humana breach involving the subcontractor.