Flexible Benefit Service

Flexible Benefit Service Corporation, the covered entity (CE), reported that an employee was the victim of an email phishing attack. This breach affected 5,232 individuals. The protected health information (PHI) involved included names, dates of birth, addresses, Social Security numbers, drivers’ license information, claims information, diagnoses/conditions, and financial information. The CE notified HHS, affected individuals, and the media. The CE also offered theft protection and credit monitoring services to all affected individuals. As a result of this breach, the CE implemented additional technical safeguards to better protect its PHI and retrained its employees on how to detect email phishing schemes. OCR obtained assurances that the CE implemented the corrective actions noted above.