HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Aug. 17, 2023.
- Organization as reported
- Blue Cross Blue Shield of Arizona, AZ
- Entity type as reported
- Health Plan
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Aug. 17, 2023
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 10511, row:1650)
- Archived copy
- Held in the private archive (provenance)
Blue Cross Blue Shield of Arizona, the covered entity (CE), reported that a vendor of its business associate (BA) was the subject of a cybersecurity incident that compromised the protected health information (PHI) of 47,485 individuals. The PHI involved included names, dates of birth, addresses, Social Security numbers, and financial information. The CE notified HHS; the BA notified affected individuals and the media. In its mitigation efforts, the BA and vendor implemented new technical safeguards, provided affected individuals with free credit monitoring, and revised its policies and procedures. The CE implemented new security measures to prevent similar attacks from occurring in the future.