Blue Cross Blue Shield of Arizona

Blue Cross Blue Shield of Arizona, the covered entity (CE), reported that a vendor of its business associate (BA) was the subject of a cybersecurity incident that compromised the protected health information (PHI) of 47,485 individuals. The PHI involved included names, dates of birth, addresses, Social Security numbers, and financial information. The CE notified HHS; the BA notified affected individuals and the media. In its mitigation efforts, the BA and vendor implemented new technical safeguards, provided affected individuals with free credit monitoring, and revised its policies and procedures. The CE implemented new security measures to prevent similar attacks from occurring in the future.