FLORIDAAccidentalHealthcareFinancial ServicesHealthcareMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)HighResolved

WellCare Health Plans, Inc.

bd_b77149e91ac15d9a · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 25, 2018

Filed

Sep 14, 2018

To disclose

7 weeks

Affected

26,942

Confidence

98%

Full breach record for WellCare Health Plans, Inc. →7 incidents on file

WellCare Health Plans, Inc. (FL) reported to HHS OCR on 2018-09-14 an Unauthorized Access/Disclosure affecting 26,942 individuals via Paper/Films. Between January 20 and June 20, 2018, appointment reminder letters were mistakenly mailed to wrong members, exposing name, age, Medicaid number, healthcare providers, and appointment reason. The CE terminated one staff member, retrained another, updated policies, and created an automated mailing procedure following OCR investigation.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Jul 25, 2018 → Notified Sep 14, 201851d ✓ HHS report on time7 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 186 days

discovery → filing · 7 weeks / 51 days

Jan 20, 2018

Begins

Jul 25, 2018

Discovered

Sep 14, 2018

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed26,942 affectedView incident

Name: WellCare Health Plans, Inc.
norm: wellcare health plans
Domain: wellcare.com
Industry: Insurance — Health

Name: WellCare Health Plans, Inc.
norm: wellcare health plans
Domain: wellcare.com
Industry: Insurance — Health
Industry: Healthcaresource defaultFinancial Servicesllm

Discovered: Jul 25, 2018
Breach occurred: Jan 20, 2018 – Jun 20, 2018
Undetected for: 186 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 14, 2018
Affected individuals: 26,942nationwide
Data types: Identity (basic)Government IDHealth (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: Paper / films
Covered-entity type: Health plan
Attack vector: Unauthorized Access
Threat actor: Internal
Regulator citations: HHS OCR investigation; OCR directed creation of new automated mail reminder procedure
Initial access: insider_action

During the incident: Terminated one responsible staff member
Retrained other responsible staff member on HIPAA requirements
Reviewed and updated policies and procedures
Created new automated procedure for mail reminder letters
Provided breach notification to HHS, affected individuals, substitute notice for unlocatable members, and notice to media
Changes made: Staff sanctions including termination and retraining
Policy and procedure review and update
Automated mail reminder letter process implemented
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(51 days from discovery to filing)
Compliance flags: HHS report on time · 51dHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jul 25, 2018
→ Notified: Sep 14, 2018
51d 60 days HHS report on time
HIPAA
Discovered: Jul 25, 2018
→ Notified: Sep 14, 2018
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jul 25, 2018 → Notified: Sep 14, 2018	51d	60 days	HHS report on time
HIPAA	Discovered: Jul 25, 2018 → Notified: Sep 14, 2018	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Sep 14, 2018
Raw hash: 50353b59e40024b0f0d6434950cf774dd1e16a6ce3442c23879ae86b8a6f643c

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.9 KB

Download View at source

Reporting entityWellCare Health Plans, Inc.

Victim entityWellCare Health Plans, Inc.

Incidentdiscovered Jul 25, 2018

Stated responseTerminated one responsible staff member

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing