COLORADOAccidentalHealthcareFinancial ServicesGovernmentHealthcareMisdeliveryBusiness Associate (HIPAA)Customer Data InvolvedIdentity (basic)Government IDHealth (basic)FinancialHighResolved

Colorado Department of Health Care Policy and Financing

bd_12b4a28100ad123b · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

Aug 18, 2015

To disclose

—

Affected

1,622

Confidence

97%

Full breach record for Colorado Department of Health Care Policy and Financing →5 incidents on file

Between May 25, 2015 and July 5, 2015, the Governors' Office of Technology (a business associate) sent PHI-containing letters to the wrong Medical Assistance Program clients due to a technical error in their computer system. Affected data included names, addresses, state ID numbers, Medicaid case numbers, employer names, income amounts, Advanced Premium Tax Credit amounts, program approvals/denials, and dates of birth. Up to 3,537 individuals were impacted; 1,622 reported to HHS. Deloitte (subcontractor) fixed the Colorado Benefits Management System software and added mailing QC controls. OCR obtained written corrective-action assurances. Location of breached info: Paper/Films.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline

May 25, 2015

Begins

Aug 18, 2015

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,622 affectedView incident

Name: Colorado Department of Health Care Policy and Financing
norm: colorado department of health care policy and financing
Domain: hcpf.colorado.gov
Industry: Insurance — Health

Name: Colorado Department of Health Care Policy and Financing
norm: colorado department of health care policy and financing
Domain: hcpf.colorado.gov
Industry: Insurance — Health
Industry: Healthcaresource defaultFinancial ServicesllmGovernmentllm

Discovered: Not extracted — the OCR public portal omits it
Breach occurred: May 25, 2015 – Jul 5, 2015
Materiality determined: —
Notification sent: —
Affected individuals: 1,622nationwide
Data types: Identity (basic)Government IDHealth (basic)Financial
HHS breach type: Unauthorized access or disclosure
Where the data lived: Paper / films
Covered-entity type: Health planBusiness associate involved
Attack vector: Unauthorized Access
Threat actor: Partner
Regulator citations: OCR obtained written assurances that the CE, BA and its subcontractor implemented corrective actions.
Third party: via Governors' Office of Technology (BA); Deloitte (subcontractor)

During the incident: Covered entity provided breach notification to HHS, affected individuals, and the media.
BA's subcontractor (Deloitte) fixed software in the Colorado Benefits Management System to ensure letters are addressed to appropriate recipients.
Additional quality control procedures for mailings were implemented.
Changes made: Software fix applied to Colorado Benefits Management System by Deloitte.
Additional mailing quality control procedures implemented.
Written assurances of corrective action obtained by OCR.
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Aug 18, 2015
Raw hash: b3b116486dc01a9d8bd81852d0081d685c3ff81abddfbcfd49c60a7b6d8d55d4

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.2 KB

Download View at source

Reporting entityColorado Department of Health Care Policy and Financing

Victim entityColorado Department of Health Care Policy and Financing

IncidentUnauthorized Access

Stated responseCovered entity provided breach notification to HHS, affected individuals, and the media.

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing