Humana Inc [case # HU17001CC]

The covered entity (CE), Humana, Inc., reported that its servers were compromised due to a cyber-attack. The hackers had both foreign and domestic IP addresses. The breach affected approximately 3,831 individuals. The protected health information (PHI) involved included names, dates of birth, claims information, medications prescribed, other treatment information, and health diagnoses and conditions. As a result of the attack, the CE immediately blocked offending IP addresses, prompted password resets, temporarily closed its web-based self-service functions, and tested a challenge-response technology (CAPTCHA) to blunt the automated attacks. Humana implemented additional technical controls including user identification and validation controls, installed bot managers, and multifactor authentication technology. The CE provided notice to affected individuals, the media, and provided substitute notice on its website. OCR provided the CE with technical assistance regarding media notice, and obtained assurances that the CE has implemented the corrective actions noted above.