HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 19, 2014.
- Organization as reported
- Blue Cross Blue Shield of Michigan Blue Care Network, MI
- Entity type as reported
- Business Associate
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- May 19, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15081, row:6220)
- Archived copy
- Held in the private archive (provenance)
An external unauthorized party accessed a business associate (BA) employee’s corporate email account and used it to send emails with a malicious link to all individuals in the employee’s address book. The types of protected health information involved in the breach included the social security numbers, addresses, dates of birth, and phone numbers of 502 individuals in twelve states. Following the breach, the BA, Bloom Health, shut down the affected laptop computer, conducted forensic reviews, sent emails to employees and business partners about the suspicious email and instructed them not to click on the embedded link and to change email passwords. The BA determined that no other email accounts were accessed and the contents of the subject email were not downloaded or forwarded to another machine. In response to the breach, the BA implemented a new policy to require a forced password reset after an account has been locked, including two-factor authentication for all business emails. The BA provided breach notification to HHS, affected individuals and posted substitute notice on its website. The BA retrained its staff on its new policies and procedures. OCR obtained documented assurances that the BA implemented the voluntary compliance actions listed here.