On December 27, 2018, Equian, LLC, a business associate (BA), notified the covered entity (CE), Molina, that the BA’s subcontractor, Wolverine Solutions Group, experienced a ransomware security incident on or about September 23, 2018, affecting individuals across several CEs. The incident affected the electronic protected health information (ePHI) of 895 of Molina’s members in six states, including names, addresses, health plan names, dates of service, and names of some healthcare providers. The CE provided breach notification to HHS and to affected individuals starting on February 22, 2019, and provided affected individuals with free identity protection for 12 months. In response to the security incident and corresponding investigation, the CE provided the BA with additional training on the HIPAA requirements and required that the BA ensure that its subcontractor implements systems security enhancements. OCR reviewed the applicable BA contracts and obtained assurances that the CE implemented the corrective action steps listed above.
