An employee of Health Equity, a business associate (BA) of the covered entity (CE), Blue Cross Blue Shield of Massachusetts, was the target of a social engineering attack on his personal computer where he had stored the username and password to his Health Equity webmail account. Using this login information, a third party sent a phishing email to 1,322 of the employee’s contacts. The incident potentially affected the demographic, financial, and clinical protected health information (PHI) of 1,262 individuals. The CE provided breach notification to HHS, affected individuals, and the media. OCR reviewed the BA agreement (BAA) between the CE and BA and stated it appears to comply with the requirements of the Rule. In response to this incident, the CE updated the BAA for remediation purposes. OCR opened a separate investigation of the BA related to this incident.
