HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 18, 2017.
- Organization as reported
- Humana Inc [case # HU17001CC], KY
- Entity type as reported
- Health Plan
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- April 18, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14214, row:5353)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Humana, Inc., reported that its servers were compromised due to a cyber-attack. The hackers had both foreign and domestic IP addresses. The breach affected approximately 3,831 individuals. The protected health information (PHI) involved included names, dates of birth, claims information, medications prescribed, other treatment information, and health diagnoses and conditions. As a result of the attack, the CE immediately blocked offending IP addresses, prompted password resets, temporarily closed its web-based self-service functions, and tested a challenge-response technology (CAPTCHA) to blunt the automated attacks. Humana implemented additional technical controls including user identification and validation controls, installed bot managers, and multifactor authentication technology. The CE provided notice to affected individuals, the media, and provided substitute notice on its website. OCR provided the CE with technical assistance regarding media notice, and obtained assurances that the CE has implemented the corrective actions noted above.