CareFirst Administrators

The covered entity (CE), CareFirst Administrators, reported that multiple employees of its business associate (BA) were the victims of an email phishing attack that affected the protected health information (PHI) of 14,538 individuals. The PHI involved included names, dates of births, addresses, Social Security numbers, diagnoses, medications, other treatment information, and claims information. The BA notified the affected individuals; the CE notified HHS, the media, and posted substitute notice on its website. In response to the breach the CE provided complimentary credit monitoring services to affected individuals while the BA implemented additional administrative and technical safeguards.