Sharp Health Plan

# Sharp Health Plan Data Breach Report ## Incident Overview Sharp Health Plan, a California-based health insurance organization, experienced an unauthorized access and disclosure incident involving paper and film records on or before January 8, 2024, when the breach was reported to the California Attorney General's office. The breach resulted in the potential exposure of protected health information (PHI) belonging to approximately 8,200 individuals. The unauthorized access occurred through physical compromise of paper-based and film-based medical records, representing a significant departure from digital breach incidents but equally concerning under HIPAA regulations. Sharp Health Plan's discovery and subsequent notification of this incident demonstrates the organization's compliance with breach notification requirements, though the nature of paper-based records suggests potential lapses in physical security controls. ## Discovery and Response Timeline Sharp Health Plan identified the unauthorized access to paper and film records and initiated an investigation into the scope and nature of the breach. Upon determining that the incident met the threshold for HIPAA breach notification—affecting more than 500 California residents—the organization submitted notification to the California Attorney General on January 8, 2024. The organization's response included a comprehensive review of affected records, notification preparation, and coordination with relevant regulatory authorities. While specific details regarding the discovery method and exact date of the unauthorized access were not disclosed in the breach submission, the January 8, 2024 submission date indicates the organization moved to notify affected individuals and authorities within a reasonable timeframe following discovery. The involvement of a business associate in this breach suggests that Sharp Health Plan may have contracted with a third party for records management, storage, or related services, potentially indicating that the unauthorized access occurred at a vendor facility or through a vendor's negligence. ## Specific Details of the Breach The breach involved unauthorized access to and potential disclosure of information contained in paper documents and film records maintained by or on behalf of Sharp Health Plan. Paper and film-based records represent a distinct category of healthcare data storage that requires physical security controls such as locked storage facilities, restricted access protocols, and environmental protections. The unauthorized access may have resulted from several common vectors in paper-based breaches: inadequate physical security measures, improper disposal or storage procedures, theft by an employee or contractor, unauthorized access to storage areas, or failure to implement proper chain-of-custody procedures. The involvement of a business associate suggests the records may have been stored, processed, or managed at a location outside of Sharp Health Plan's direct control, potentially at a records management company, imaging service provider, or other healthcare vendor. Paper and film records are particularly vulnerable to unauthorized access because they lack the audit trails and access controls inherent in electronic health record (EHR) systems, making detection of unauthorized access more difficult and potentially delayed. ## Organizational Context Sharp Health Plan operates as a health insurance organization serving California residents. As a health plan entity, Sharp Health Plan is a covered entity under HIPAA and bears direct responsibility for the protection of all PHI in its possession or control, regardless of whether that information is stored electronically or in physical form. The organization's operations likely include enrollment management, claims processing, utilization review, and member services—all functions that generate and require access to sensitive health information. The fact that the organization maintains paper and film records suggests either legacy systems still in use, specific regulatory requirements for certain record types, or business processes that have not been fully digitized. The involvement of a business associate indicates that Sharp Health Plan has outsourced certain functions, which is common in the health insurance industry but requires thorough business associate agreements (BAAs) and oversight mechanisms to ensure compliance with HIPAA security and privacy requirements. ## Patient Impact and Notification Approximately 8,200 individuals were affected by this breach and notified of the unauthorized access to their health information. These individuals represent Sharp Health Plan members or individuals whose health information was maintained in the compromised paper and film records. The affected population likely includes current and former health plan members whose records were retained for operational, legal, or regulatory purposes. Notification to affected individuals was required under California's breach notification law (California Civil Code § 1798.82) and HIPAA's Breach Notification Rule, which mandate notification without unreasonable delay and no later than 60 calendar days after discovery of a breach affecting more than 500 California residents. Sharp Health Plan's January 8, 2024 submission to the California Attorney General indicates compliance with these notification requirements. Affected individuals received notification describing the nature of the breach, the types of information potentially exposed, and recommended steps to protect themselves from potential misuse of their information. ## Types of Information Potentially Exposed Given the nature of health plan records, the paper and film documents likely contained multiple categories of protected health information, potentially including: member names and contact information; health insurance policy numbers and member identification numbers; dates of birth and Social Security numbers; medical history and diagnoses; treatment information and clinical notes; prescription information; healthcare provider names and facility information; claims information and payment records; and potentially financial information related to insurance coverage or billing. The specific combination of exposed data elements depends on which records were compromised and what information those particular documents contained. The exposure of Social Security numbers in combination with health information creates elevated risk for identity theft and medical identity fraud, as these data elements together provide sufficient information for fraudulent account creation or unauthorized access to other services. ## HIPAA Compliance and Industry Context This breach highlights the ongoing vulnerability of paper-based health records in an increasingly digital healthcare environment. While many healthcare organizations have transitioned to electronic health records, paper records remain common in health insurance operations, particularly for historical records, certain regulatory filings, and specific business processes. HIPAA's Security Rule requires covered entities to implement administrative, physical, and technical safeguards to protect ePHI, and the Privacy Rule extends these protections to all PHI regardless of format. Physical safeguards for paper records must include facility access controls, workstation use policies, workstation security, and device and media controls. The involvement of a business associate in this breach underscores the importance of thorough business associate agreements and oversight, as covered entities remain liable for breaches caused by their business associates' failure to implement adequate safeguards. According to HHS breach notification data, unauthorized access incidents involving paper records, while less common than digital breaches, continue to occur and often result in larger numbers of affected individuals due to the volume of records typically stored in centralized paper repositories. This incident serves as a reminder that healthcare organizations must maintain equivalent security standards for all formats of PHI, not merely electronic records.

On January 8, 2024, Sharp Health Plan, a California-based health insurance provider, reported a significant data breach involving unauthorized access to its network server infrastructure. The breach, classified as a hacking or IT incident, compromised the personal health information and related data of approximately 9,255 individuals. This incident represents a serious breach of the health plan's information security systems and has triggered mandatory notification requirements under the Health Insurance Portability and Accountability Act (HIPAA) and California state privacy laws. ### Company Response Upon discovery of the unauthorized access to its network server, Sharp Health Plan initiated a comprehensive investigation to determine the scope and nature of the breach. The organization worked to identify all affected individuals and the specific data elements that may have been accessed or compromised. As required by HIPAA Breach Notification Rule, Sharp Health Plan began the process of notifying affected individuals without unreasonable delay. The submission date of January 8, 2024, indicates when the breach was formally reported to regulatory authorities, though the actual discovery and investigation timeline may have extended over preceding weeks or months. ### Specific Details Network server breaches typically occur through various attack vectors including exploitation of unpatched software vulnerabilities, weak authentication credentials, phishing attacks targeting employee access credentials, or direct network intrusion attempts. The fact that a business associate was involved in this incident suggests that the compromised network infrastructure may have included systems shared with or accessed by third-party vendors, contractors, or service providers who handle health plan data on behalf of Sharp Health Plan. This multi-party involvement complicates the breach response, as notifications and remediation efforts must coordinate across multiple organizations. Network server locations represent centralized data repositories that typically contain large volumes of sensitive information, making them high-value targets for threat actors seeking to access protected health information at scale. ### Organizational Context Sharp Health Plan operates as a health insurance provider serving California residents. As a health plan entity, Sharp Health Plan is a covered entity under HIPAA and bears direct responsibility for protecting the privacy and security of member health information. The organization manages enrollment data, claims information, medical histories, and other sensitive health-related records for its members. The involvement of a business associate indicates that Sharp Health Plan utilizes third-party vendors for functions such as claims processing, data storage, IT infrastructure management, or other administrative services. The breach's impact on approximately 9,255 individuals suggests a mid-sized health plan operation or a significant subset of a larger organization's membership base. ### Personal Information Involved While the specific data elements exposed in this breach have not been detailed in the available information, network server breaches at health insurance companies typically result in exposure of multiple categories of protected health information. Likely compromised data may include: member names and contact information (addresses, phone numbers, email addresses); Social Security numbers or other government-issued identification numbers; health insurance member ID numbers and policy information; dates of birth and demographic information; medical history and diagnosis codes; prescription information and medication records; healthcare provider information and claims history; financial information including banking details or payment card numbers; and potentially employment information. The breadth of data typically stored on centralized network servers means that multiple sensitive data categories were likely accessible to the unauthorized parties. ### Number of People Affected Approximately 9,255 individuals were affected by this breach. This number places the incident in the medium-to-high impact category in terms of affected population size. All affected individuals are California residents who held membership or had records with Sharp Health Plan at the time of the breach. The notification process required Sharp Health Plan to identify each affected individual and provide them with detailed breach notification letters explaining what information was compromised, what steps the organization is taking in response, and what actions individuals should take to protect themselves. ### Patient Impact and Risks Individuals affected by this breach face several significant risks related to the potential exposure of their health information and personal identifiers. The compromise of Social Security numbers combined with health insurance information creates substantial identity theft risk, as threat actors could potentially use this information to open fraudulent accounts, apply for credit, or commit medical identity theft. Exposure of medical history and diagnosis information raises privacy concerns and could potentially be used for discriminatory purposes or sold to third parties for marketing or other purposes. The breach of financial information, if included in the compromised data, creates direct risk of fraudulent transactions or unauthorized access to bank accounts. Additionally, individuals may face increased risk of phishing attacks or social engineering attempts, as threat actors with access to health plan data may use this information to craft convincing fraudulent communications. The psychological impact of knowing one's sensitive health information has been compromised should not be underestimated, particularly for individuals with sensitive diagnoses or conditions.