Every public data breach

Disclosed this week47On record26,367

47 disclosed this week · 26,367 on record

Health Care Service

Disclosed Apr 24, 20191,182 affectedConfirmed

Official notice

The covered entity (CE), Health Care Service Corporation, reported that an employee inadvertently emailed a document containing the electronic protected health information (ePHI) of 574 individuals to an unauthorized individual. The ePHI involved included names, member identification numbers, diagnoses, medications prescribed, and other treatment information. The CE notified HHS and the affected individuals. In response to the breach, the CE implemented additional administrative safeguards and retrained employees on the requirement to safeguard sensitive data. OCR obtained assurances that the CE implemented the corrective actions noted.

What is known

People affected1,182 (as reported to HHS)
DisclosedApr 24, 2019
HappenedAug 16, 2019
AttackInsider
Data exposedNamesHealth
SectorHealthcare · US
StatusConfirmed

Sources

Official noticein.gov
Indiana Attorney General 2020 data breach report: Health Care Service
Official noticeocrportal.hhs.gov
HHS OCR breach report (archive, resolved): Health Care Service (Health Plan, IL)

Notices filed

TotalApr 24, 2019
HHS archive1,182 people
TotalSep 6, 2019
HHS archive998 people
Residents of INFeb 20, 2020
Indiana AG1 person
TotalMar 23, 2020
HHS archive574 people

Other breaches at Health Care Service

Insider breachInsider exposed names and health records. Reported to the HHS archive.2,944 affectedInsuranceUSApr 13, 2025Hacking breachHacking exposed names and health records. Reported to the HHS archive.221K affectedInsuranceUSAug 21, 2023Hacking breachHacking exposed names and health records. Reported to the HHS archive.543 affectedInsuranceUSJun 15, 2021Breach, details not statedBreach notice filed with the Indiana AG, details not stated.161 affectedHealthcareUSJun 4, 2018Lost or stolen device breachLost or stolen device exposed names, Social Security numbers, insurance details, financial details, emails, phone numbers, addresses and names. Reported to the HHS archive.501 affectedHealthcareUSMar 27, 2015Lost or stolen device breachLost or stolen device exposed names and health records. Reported to the HHS archive.501 affectedInsuranceUSOct 26, 2012Lost or stolen device breachLost or stolen device exposed names and health records. Reported to the HHS archive.501 affectedInsuranceUSJul 28, 2011
History of this record
records2026-09-25
998 to 1182by backfillSource
disclosed2026-09-25
2019-09-06 to 2019-04-24by backfillSource
records2026-09-25
574 to 998by backfillSource
disclosed2026-09-25
2020-02-20 to 2019-09-06by backfillSource
attack2026-09-25
unknown to insiderby backfillSource
data_types2026-09-25
[] to ["names","health"]by backfillSource
records_basis2026-09-25
organization to hhsby backfillSource
records2026-09-25
6 to 574by backfillSource
summary2026-09-25
empty to The covered entity (CE), Health Care Service Corporation, reported that an employee inadvertently emailed a document containing the electronic protected health information (ePHI) of 574 individuals to an unauthorized individual. The ePHI inby backfillSource
Added2026-09-25
First recordedby backfillSource

First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.

Everything about Health Care Service