HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Aug. 31, 2018.
- Organization as reported
- Carpenters Benefit Funds of Philadelphia, PA
- Entity type as reported
- Health Plan
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Aug. 31, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13704, row:4843)
- Archived copy
- Held in the private archive (provenance)
An unauthorized user gained access to multiple employees’ email accounts after a phishing attack. The breach included the protected health information (PHI) of 20,015 individuals and included names, social security numbers, driver’s license numbers, bank account information, health insurance information, and medical treatment information. The covered entity (CE) provided breach notification to HHS, affected individuals, and the media; however, it did so more than 60 days after discovery of the incident on May 2, 2018. Following the breach, the CE implemented new procedures for employees to open encrypted emails and retrained employees on its security policies and procedures. OCR reviewed the CE’s newly revised risk analysis to ensure compliance with the Security Rule and provided technical assistance to the CE regarding timely breach notification.