HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 12, 2018.
- Organization as reported
- HealthEquity, Inc., UT
- Entity type as reported
- Business Associate
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- June 12, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13788, row:4927)
- Archived copy
- Held in the private archive (provenance)
HealthEquity, Inc., the business associate (BA), reported two separate breach incidents involving several employees that were the victims of email phishing schemes that affected 165,800 and 16,000 individuals respectively. The protected health information (PHI) involved included names, Social Security numbers, claims information, insurance information, employer information, financial information, and treatment information. The BA notified HHS, affected individuals, and the media. The responsible employee was sanctioned. To mitigate future incidents of this nature, the BA implemented additional administrative, technical, and security safeguards and trained its staff on the proper methods for identifying fraudulent email communications. Following OCR’s investigation and provision of technical assistance, the BA reduced the amount of PHI vulnerable to attack. OCR obtained assurances that the BA implemented the aforementioned corrective actions.