Sharp Health Plan Data Breach Report

Incident Overview

Sharp Health Plan, a California-based health insurance organization, experienced an unauthorized access and disclosure incident involving paper and film records on or before January 8, 2024, when the breach was reported to the California Attorney General's office. The breach resulted in the potential exposure of protected health information (PHI) belonging to approximately 8,200 individuals. The unauthorized access occurred through physical compromise of paper-based and film-based medical records, representing a significant departure from digital breach incidents but equally concerning under HIPAA regulations. Sharp Health Plan's discovery and subsequent notification of this incident demonstrates the organization's compliance with breach notification requirements, though the nature of paper-based records suggests potential lapses in physical security controls.

Discovery and Response Timeline

Sharp Health Plan identified the unauthorized access to paper and film records and initiated an investigation into the scope and nature of the breach. Upon determining that the incident met the threshold for HIPAA breach notification—affecting more than 500 California residents—the organization submitted notification to the California Attorney General on January 8, 2024. The organization's response included a comprehensive review of affected records, notification preparation, and coordination with relevant regulatory authorities. While specific details regarding the discovery method and exact date of the unauthorized access were not disclosed in the breach submission, the January 8, 2024 submission date indicates the organization moved to notify affected individuals and authorities within a reasonable timeframe following discovery. The involvement of a business associate in this breach suggests that Sharp Health Plan may have contracted with a third party for records management, storage, or related services, potentially indicating that the unauthorized access occurred at a vendor facility or through a vendor's negligence.

Specific Details of the Breach

The breach involved unauthorized access to and potential disclosure of information contained in paper documents and film records maintained by or on behalf of Sharp Health Plan. Paper and film-based records represent a distinct category of healthcare data storage that requires physical security controls such as locked storage facilities, restricted access protocols, and environmental protections. The unauthorized access may have resulted from several common vectors in paper-based breaches: inadequate physical security measures, improper disposal or storage procedures, theft by an employee or contractor, unauthorized access to storage areas, or failure to implement proper chain-of-custody procedures. The involvement of a business associate suggests the records may have been stored, processed, or managed at a location outside of Sharp Health Plan's direct control, potentially at a records management company, imaging service provider, or other healthcare vendor. Paper and film records are particularly vulnerable to unauthorized access because they lack the audit trails and access controls inherent in electronic health record (EHR) systems, making detection of unauthorized access more difficult and potentially delayed.

Organizational Context

Sharp Health Plan operates as a health insurance organization serving California residents. As a health plan entity, Sharp Health Plan is a covered entity under HIPAA and bears direct responsibility for the protection of all PHI in its possession or control, regardless of whether that information is stored electronically or in physical form. The organization's operations likely include enrollment management, claims processing, utilization review, and member services—all functions that generate and require access to sensitive health information. The fact that the organization maintains paper and film records suggests either legacy systems still in use, specific regulatory requirements for certain record types, or business processes that have not been fully digitized. The involvement of a business associate indicates that Sharp Health Plan has outsourced certain functions, which is common in the health insurance industry but requires thorough business associate agreements (BAAs) and oversight mechanisms to ensure compliance with HIPAA security and privacy requirements.

Patient Impact and Notification

Approximately 8,200 individuals were affected by this breach and notified of the unauthorized access to their health information. These individuals represent Sharp Health Plan members or individuals whose health information was maintained in the compromised paper and film records. The affected population likely includes current and former health plan members whose records were retained for operational, legal, or regulatory purposes. Notification to affected individuals was required under California's breach notification law (California Civil Code § 1798.82) and HIPAA's Breach Notification Rule, which mandate notification without unreasonable delay and no later than 60 calendar days after discovery of a breach affecting more than 500 California residents. Sharp Health Plan's January 8, 2024 submission to the California Attorney General indicates compliance with these notification requirements. Affected individuals received notification describing the nature of the breach, the types of information potentially exposed, and recommended steps to protect themselves from potential misuse of their information.

Types of Information Potentially Exposed

Given the nature of health plan records, the paper and film documents likely contained multiple categories of protected health information, potentially including: member names and contact information; health insurance policy numbers and member identification numbers; dates of birth and Social Security numbers; medical history and diagnoses; treatment information and clinical notes; prescription information; healthcare provider names and facility information; claims information and payment records; and potentially financial information related to insurance coverage or billing. The specific combination of exposed data elements depends on which records were compromised and what information those particular documents contained. The exposure of Social Security numbers in combination with health information creates elevated risk for identity theft and medical identity fraud, as these data elements together provide sufficient information for fraudulent account creation or unauthorized access to other services.

HIPAA Compliance and Industry Context

This breach highlights the ongoing vulnerability of paper-based health records in an increasingly digital healthcare environment. While many healthcare organizations have transitioned to electronic health records, paper records remain common in health insurance operations, particularly for historical records, certain regulatory filings, and specific business processes. HIPAA's Security Rule requires covered entities to implement administrative, physical, and technical safeguards to protect ePHI, and the Privacy Rule extends these protections to all PHI regardless of format. Physical safeguards for paper records must include facility access controls, workstation use policies, workstation security, and device and media controls. The involvement of a business associate in this breach underscores the importance of thorough business associate agreements and oversight, as covered entities remain liable for breaches caused by their business associates' failure to implement adequate safeguards. According to HHS breach notification data, unauthorized access incidents involving paper records, while less common than digital breaches, continue to occur and often result in larger numbers of affected individuals due to the volume of records typically stored in centralized paper repositories. This incident serves as a reminder that healthcare organizations must maintain equivalent security standards for all formats of PHI, not merely electronic records.