San Francisco Department of Public Health

The San Francisco Department of Public Health reported that its business associate, Alluma, experienced a computer error that resulted in mislabeled letters containing protected health information being sent to incorrect recipients. The incident, affecting 622 individuals, involved paper records and films with demographic information. In response, the entity investigated the issue, implemented new technical safeguards, and updated its quality control process for renewal notices.

Affected (this filing): 622

San Francisco Department of Public Health (SFDPH) disclosed a data breach involving its vendor, Alluma. Between November 2018 and August 2019, enrollment letters for Healthy San Francisco participants were mailed to incorrect addresses due to a computer error. Affected data included names, addresses, application/participant IDs, and medical home information. No SSN or DOB was included. SFDPH issued notifications on September 27, 2019, and is reviewing vendor privacy protections.