North Carolina Department of Health and Human Services
Disclosed Sep 29, 202512 months ago3,437 affectedConfirmed
The covered entity (CE), North Carolina Department of Health and Human Services, reported that an employee of its business associate (BA) mailed the protected health information (PHI) of 3,437 individuals to the wrong recipients. The PHI involved clinical and demographic information. The CE notified HHS, the affected individuals, the media, and provided substitute notice. In response to the breach, the CE and BA implemented additional administrative, technical, and security safeguards and retrained workforce members to better protect its PHI.
What is known
| People affected | 3,437 (as reported to HHS) |
|---|---|
| Disclosed | Sep 29, 2025 |
| Attack | Insider |
| Data exposed | Names, Health |
| Sector | Insurance · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| HHS OCR breach report (archive, resolved): North Carolina Department of Health and Human Services (Health Plan, NC)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Sep 29, 2025 | 3,437 |
Other breaches at North Carolina Department of Health and Human Services
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Feb 23, 2017Feb 23, 20179 years agoInsider | Feb 23, 20179 years ago | Insider | Insurance | Confirmed | 13K |
| Disclosed Oct 19, 2015Oct 19, 201510 years agoInsider | Oct 19, 201510 years ago | Insider | Insurance | Confirmed | 1,615 |
| Disclosed Jan 6, 2014Jan 6, 201412 years agoInsider | Jan 6, 201412 years ago | Insider | Healthcare | Confirmed | 49K |
History of this record
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (HHS archive), confirmed by HHS OCR. Record counts are as reported. Not legal advice.
Everything about North Carolina Department of Health and Human Services