Blue Shield of California

On December 7, 2015, Blue Shield of California, the covered entity (CE), discovered that its servers were breached via social engineering at its call centers in Costa Rica. The breach affected 20,764 patients’ protected health information (PHI). The types of PHI involved included patients’ names, addresses, dates of births, and social security numbers. The CE provided breach notification to HHS, affected individuals, the media. In response to the breach, the CE disabled all existing login credentials and manually distributed new passwords. It trained all call center workforce members about the risks of social engineering and implemented two-factor authentication for external access to its network via its virtual private network (VPN). The CE also provided OCR with additional documentation as relevant to the breach investigation, including its HIPAA Notice of Privacy Practices Policy. OCR obtained assurances that the CE implemented the corrective actions listed above.