- State
- OH
- Covered entity type
- Health Plan
- Individuals affected
- 1,139
- Business associate present
- No
- Type of breach
- Theft
- Location of breached information
- Other
- First seen by InfoSec Signals
- 9/23/2026
- Last seen in OCR export
- 9/23/2026
OCR description
The covered entity (CE) mistakenly mailed protected health information (PHI) to the wrong addresses of approximately 1,139 individuals following a computer error at the business associate (BA). The PHI involved in the breach included names, addresses, dates of birth, dates of service, claims information, and diagnoses. The CE provided breach notification to affected individuals, HHS, and the media, and posted substitute notice on its website. To prevent a similar breach from happening in the future, the CE and BA improved safeguards by updating policies to require multiple reviews of PHI in mailings. Following OCR's investigation, the CE updated its policies and procedures relating to the minimum necessary standard.
Change history
- 9/23/2026Added to OCR's archive list
Source: HHS OCR Breach Portal, U.S. Department of Health and Human Services, Office for Civil Rights about this source
Records are reproduced as published; entity names and figures are OCR's.