On April 26, 2018, CareFirst BlueCross BlueShield submitted a HIPAA Email Breach to the U.S. Department of Health and Human Services (HHS). Based in Baltimore, Maryland, CareFirst's email breach affected 6,800 individuals’ protected health information. CareFirst BlueCross BlueShield is classified as a Health Plan.
According to CareFirst's statement:
On March 12, CareFirst determined that an employee was the victim of a phishing email which compromised the employee’s email account. The compromised email account was used to send spam messages to an email list of individuals not associated with CareFirst. However, because the email account was compromised, the attackers gained access to the employee’s email and could have potentially accessed personal information of 6,800 CareFirst members, including names, member identification numbers, date of birth, and in limited cases (8 individuals) social security numbers. No medical or financial information was compromised.
The original phishing message and the resulting spam messages have been forensically examined by CareFirst’s information security team as well as by a 3rd party information security firm. CareFirst’s systems in general were also forensically analyzed. There was no evidence of malware in the phishing email or spam and no other suspicious activity was detected within CareFirst’s systems. The individual email account was reset. Though the information accessible in the email account would be of limited use to an attacker and there is no evidence that CareFirst member information has been improperly used, CareFirst will offer free credit monitoring and identity theft protection for those affected for two years. Potentially affected members will be contacted directly by CareFirst with information on enrolling in the protections being offered. CareFirst has a comprehensive information security program and employees must annually complete mandatory information security training. CareFirst conducts an ongoing security awareness program for employees through which employees are educated about cyberattack tactics about which they must remain vigilant.
The HHS Wall of Shame is a website under the jurisdiction of HHS that lists all HIPAA breaches reported within the last 24 months. The Wall of Shame displays breaches that are currently under investigation by the Office for Civil Rights. As part of section 13402(e)(4) of the HITECH Act, the HHS Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals.
The Paubox HIPAA Breach Report analyzes breaches that affected 500 or more individuals as reported in the HHS Wall of Shame.