TRUEbenefits

An unauthorized person accessed an employee’s email account after it was compromised by a phishing incident and some of the emails accessible through the account contained electronic protected health information (ePHI). The breach affected approximately 17,309 individuals who were members of employer health plans administered by TRUEBenefits, LLC (TB). The PHI involved in the breach included demographic, financial, and clinical information. TB provided breach notification to HHS, covered entities, affected individuals, and the media in all 50 states and Puerto Rico, and also provided substitute notice. Upon discovery of the breach, TB immediately reset the employee’s password, disabled the loaner laptop the employee was using, and removed remote email access capabilities from the employee’s phone. In response to the breach, TB offered potentially affected individuals with two years of credit monitoring and made improvements to its ePHI systems’ data loss prevention and access rights management features. OCR obtained assurances that TB implemented the corrective actions noted above.