On October 11, 2018, a business associate (BA), BenefitMall, discovered a phishing attack which affected the protected health information (PHI) of 2,030 of the covered entity’s (CE) individual members, including demographic, financial, and health plan information. The BA notified the CE of the breach on December 11, 2018, and the CE provided breach notification to HHS, affected individuals, and the media. OCR reviewed the CE’s policies, procedures, and the executed BA agreement as it relates to this breach. The policies appear to be in compliance with the Privacy Rule. As a result of the breach, the BA implemented two-factor authentication and retrained employees.
2026-09-25 · records_basis: organization to hhs · backfill source
2026-09-25 · records: 2334 to 11887 · backfill source
2026-09-25 · disclosed: 2017-10-23 to 2017-08-29 · backfill source
2026-09-25 · disclosed: 2017-11-08 to 2017-10-23 · backfill source
2026-09-25 · disclosed: 2018-01-30 to 2017-11-08 · backfill source
2026-09-25 · attack: unknown to hacking · backfill source
2026-09-25 · data_types: [] to ["names","health"] · backfill source
2026-09-25 · summary: empty to On October 11, 2018, a business associate (BA), BenefitMall, discovered a phishing attack which affected the protected health information (PHI) of 2,030 of the covered entity’s (CE) individual members, including demographic, financial, and · backfill source
2026-09-25 · disclosed: 2019-01-30 to 2018-01-30 · backfill source
