On October 11, 2018, a business associate (BA), BenefitMall, discovered a phishing attack which affected the protected health information (PHI) of 2,030 of the covered entity’s (CE) individual members, including demographic, financial, and health plan information. The BA notified the CE of the breach on December 11, 2018, and the CE provided breach notification to HHS, affected individuals, and the media. OCR reviewed the CE’s policies, procedures, and the executed BA agreement as it relates to this breach. The policies appear to be in compliance with the Privacy Rule. As a result of the breach, the BA implemented two-factor authentication and retrained employees.
empty to On October 11, 2018, a business associate (BA), BenefitMall, discovered a phishing attack which affected the protected health information (PHI) of 2,030 of the covered entity’s (CE) individual members, including demographic, financial, and by backfillSource
Breachesby Glyph