PA Dept. of Human Services

As a result of programming error, the covered entity’s (CE's) online portal exposed the electronic protected health information (PHI) of former members of individuals' households to individuals when they reviewed benefit information. The breach affected the ePHI of approximately 2,130 individuals and included names, addresses, dates of birth, and financial information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE corrected the programming error and updated its testing process to search for similar errors in the future. As a result of OCR’s investigation, the CE conducted a risk analysis and implemented a risk management plan.