Humana

Disclosed Aug 19, 202064,654 affectedConfirmed

The covered entity (CE), Humana, reported that an employee of its business associate (BA) impermissibly provided the electronic protected health information (ePHI) of 64,654 individuals to others during a training program. The ePHI involved included names, addresses, dates of birth, Social Security numbers, claims and health insurance information, diagnoses, and other treatment information. The CE notified HHS, affected individuals, and the media. The BA strengthened its administrative safeguards to better protect sensitive data. OCR provided technical assistance to the CE regarding the HIPAA Breach Notification Rule.

What is known

People affected	64,654 (as reported to HHS)
Disclosed	Aug 19, 2020
Discovered	Dec 22, 2020
Happened	Oct 12, 2020
Attack	Lost or stolen device
Data exposed	NamesHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Humana

Official noticeatg.wa.gov

Washington Attorney General breach notice: Humana

Official noticein.gov

Indiana Attorney General 2021 data breach report: Humana

Official noticemaine.gov

Maine Attorney General breach notice archive: Humana

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): Humana (Health Plan, KY)

Notices filed

Residents of MEAug 19, 2020

Maine AG2 people

TotalAug 19, 2020

HHS archive564 people

Residents of INJan 20, 2021

Indiana AG2 people

TotalFeb 22, 2021

HHS archive64,654 people

Residents of WAFeb 23, 2021

Washington AG675 people

Residents of INFeb 25, 2021

Indiana AG1,582 people

Residents of CAMar 8, 2021

California AGCount not stated

Other breaches at Humana

Breach, details not statedBreach notice filed with the Indiana AG, details not stated.10 affectedFinanceUSOct 22 Breach, details not statedExposed Social Security numbers, health records, insurance details, dates of birth, addresses and names. Reported to the Indiana AG.16K affectedInsuranceUSApr 29, 2025 Hacking breachHacking exposed names and health records. Reported to the California AG.13K affectedFinanceUSJun 15, 2023 Hacking breachHacking exposed names and health records. Reported to the California AG.23K affectedHealthcareUSSep 9, 2021 Insider breachInsider exposed names and health records. Reported to the HHS archive.5,569 affectedHealthcareUSDec 31, 2018 Insider breachInsider exposed names, health records, biometric data and Social Security numbers. Reported to the California AG.6,836 affectedFinanceUSNov 21, 2017 Breach, details not statedBreach notice filed with the Indiana AG, details not stated.FinanceUSMay 23, 2014

History of this record

data_types2026-09-25

["names"] to ["names","health"]by backfillSource

records_basis2026-09-25

organization to hhsby backfillSource

records2026-09-25

63307 to 64654by backfillSource

summary2026-09-25

empty to The covered entity (CE), Humana, reported that an employee of its business associate (BA) impermissibly provided the electronic protected health information (ePHI) of 64,654 individuals to others during a training program. The ePHI involvedby backfillSource

data_types2026-09-25

[] to ["names"]by backfillSource

disclosed2026-09-25

2021-01-20 to 2020-08-19by backfillSource

disclosed2026-09-25

2021-02-23 to 2021-01-20by backfillSource

records_basis2026-09-25

empty to organizationby backfillSource

records2026-09-25

empty to 63307by backfillSource

sector2026-09-25

other to healthby backfillSource

attack2026-09-25

unknown to lost-deviceby backfillSource

disclosed2026-09-25

2021-03-08 to 2021-02-23by backfillSource

discovered2026-09-25

empty to 2020-12-22by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Humana