HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 15, 2019.
- Organization as reported
- Blue Cross Blue Shield of Massachusetts, MA
- Entity type as reported
- Health Plan
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Feb. 15, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13531, row:4670)
- Archived copy
- Held in the private archive (provenance)
An employee of Health Equity, a business associate (BA) of the covered entity (CE), Blue Cross Blue Shield of Massachusetts, was the target of a social engineering attack on his personal computer where he had stored the username and password to his Health Equity webmail account. Using this login information, a third party sent a phishing email to 1,322 of the employee’s contacts. The incident potentially affected the demographic, financial, and clinical protected health information (PHI) of 1,262 individuals. The CE provided breach notification to HHS, affected individuals, and the media. OCR reviewed the BA agreement (BAA) between the CE and BA and stated it appears to comply with the requirements of the Rule. In response to this incident, the CE updated the BAA for remediation purposes. OCR opened a separate investigation of the BA related to this incident.