WellSpan Health
Disclosed Mar 23, 20179 years ago732 affectedConfirmed
As a result of a software error, a business associate (BA) misaddressed explanation of benefit (EOB) letters and they were delivered to persons other than the intended recipient. The breach affected approximately 732 individuals and the types of protected health information (PHI) included names, addresses, and clinical and diagnostic information. Breach notification was provided to HHS, affected individuals, and the media. Following the breach, the BA implemented a new audit process for mailings, and retrained staff members. OCR reviewed the CE's policies and procedures to ensure compliance with the Privacy and Security Rules.
What is known
| People affected | 732 (as reported to HHS) |
|---|---|
| Disclosed | Mar 23, 2017 |
| Attack | Insider |
| Data exposed | Names, Health |
| Sector | Insurance · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| HHS OCR breach report (archive, resolved): WellSpan Health (Health Plan, PA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Mar 23, 2017 | 732 |
History of this record
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (HHS archive), confirmed by HHS OCR. Record counts are as reported. Not legal advice.