Capitol Administrators

An external third party accessed employees’ email accounts via a suspected phishing incident. This incident affected the demographic and clinical protected health information (PHI) of 1,733 individuals. Capitol Administrators, Inc., which is a business associate (BA) for multiple health plans, notified its client health entities, provided breach notification to HHS, affected individuals, and the media, and provided free credit monitoring to individuals. Following the breach, the BA investigated the incident, changed passwords, created a risk management plan, implemented new safeguards and its revised policies and procedures. As a result of OCR’s investigation, the BA provided copies of its relevant policies and procedures, implemented enhanced email security protections, including multi-factor authentication, blocked internet addresses outside of the U.S. and, provided additional training to its employees on phishing and other types of cyber threats.