CareOregon

Disclosed Oct 5, 20228,022 affectedConfirmed

The covered entity (CE), CareOregon reported that due to an error in its mail merging system, it mailed the protected health information (PHI) of 8,022 individuals to unintended recipients. The PHI involved included names and health insurance information. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE corrected the mail merging system and implemented additional administrative and technical safeguards.

What is known

People affected	8,022 (as reported to HHS)
Disclosed	Oct 5, 2022
Discovered	Aug 9, 2022
Happened	Aug 8, 2022
Attack	Insider
Data exposed	NamesHealth
Sector	Insurance · US
Status	Confirmed

Sources

Official noticejustice.oregon.gov

Oregon DOJ breach notice: CareOregon

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): CareOregon (Health Plan, OR)

Notices filed

Residents of OROct 5, 2022

Oregon DOJ8,022 people

TotalOct 5, 2022

HHS archive8,022 people

Other breaches at CareOregon

Insider breachInsider exposed names and health records. Reported to the HHS OCR.6,988 affectedInsuranceUSMay 7, 2025

History of this record

sector2026-09-25

other to insuranceby backfillSource

attack2026-09-25

unknown to insiderby backfillSource

data_types2026-09-25

[] to ["names","health"]by backfillSource

records_basis2026-09-25

empty to hhsby backfillSource

records2026-09-25

empty to 8022by backfillSource

summary2026-09-25

empty to The covered entity (CE), CareOregon reported that due to an error in its mail merging system, it mailed the protected health information (PHI) of 8,022 individuals to unintended recipients. The PHI involved included names and health insuranby backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (Oregon DOJ), confirmed by Oregon DOJ. Record counts are as reported. Not legal advice.

Everything about CareOregon