HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Jan. 14, 2016.
- Organization as reported
- Blue Shield of California, CA
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Network Server
- Submission date
- Jan. 14, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14632, row:5771)
- Archived copy
- Held in the private archive (provenance)
On December 7, 2015, Blue Shield of California, the covered entity (CE), discovered that its servers were breached via social engineering at its call centers in Costa Rica. The breach affected 20,764 patients’ protected health information (PHI). The types of PHI involved included patients’ names, addresses, dates of births, and social security numbers. The CE provided breach notification to HHS, affected individuals, the media. In response to the breach, the CE disabled all existing login credentials and manually distributed new passwords. It trained all call center workforce members about the risks of social engineering and implemented two-factor authentication for external access to its network via its virtual private network (VPN). The CE also provided OCR with additional documentation as relevant to the breach investigation, including its HIPAA Notice of Privacy Practices Policy. OCR obtained assurances that the CE implemented the corrective actions listed above.