Group Health

Disclosed Sep 23, 2016668 affectedConfirmed

The covered entity (CE), through its business associate (BA), erroneously mailed coverage termination letters to the wrong members/patients. The paper documents contained the protected health information (PHI) of approximately 668 individuals and included names, addresses, insurance group names, and medical record numbers. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE worked with the BA to take additional quality control steps. OCR obtained assurances that the CE/BA implemented the corrective actions listed above.

What is known

People affected	668 (as reported to HHS)
Disclosed	Sep 23, 2016
Attack	Insider
Data exposed	NamesHealth
Sector	Insurance · US
Status	Confirmed

Sources

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): Group Health (Health Plan, WA)

Notices filed

TotalSep 23, 2016

HHS archive668 people

Other breaches at Group Health

Insider breachInsider exposed names and health records. Reported to the HHS archive.802 affectedInsuranceUSAug 27, 2014 Lost or stolen device breachLost or stolen device exposed names and health records. Reported to the HHS archive.1,771 affectedInsuranceUSJan 2, 2013

History of this record

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (HHS archive), confirmed by HHS OCR. Record counts are as reported. Not legal advice.

Everything about Group Health