HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 11, 2018.
- Organization as reported
- Capitol Administrators, Inc, CA
- Entity type as reported
- Business Associate
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- May 11, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13819, row:4958)
- Archived copy
- Held in the private archive (provenance)
An external third party accessed employees’ email accounts via a suspected phishing incident. This incident affected the demographic and clinical protected health information (PHI) of 1,733 individuals. Capitol Administrators, Inc., which is a business associate (BA) for multiple health plans, notified its client health entities, provided breach notification to HHS, affected individuals, and the media, and provided free credit monitoring to individuals. Following the breach, the BA investigated the incident, changed passwords, created a risk management plan, implemented new safeguards and its revised policies and procedures. As a result of OCR’s investigation, the BA provided copies of its relevant policies and procedures, implemented enhanced email security protections, including multi-factor authentication, blocked internet addresses outside of the U.S. and, provided additional training to its employees on phishing and other types of cyber threats.