HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Jan. 9, 2019.
- Organization as reported
- Humana Inc, KY
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Other
- Submission date
- Jan. 9, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13576, row:4715)
- Archived copy
- Held in the private archive (provenance)
Humana, the covered entity (CE), discovered that on August 7, 2018, an unauthorized third party accessed credentials belonging to employees of a business associate (BA) and hacked the BA’s computer network which contained the protected health information (PHI) of 1,211 of the CE’s members. The types of PHI included individuals’ names, dates of birth, insurance policy numbers, and the last four digits of Social Security numbers. In response to the incident, Humana’s BA contacted the FBI and improved safeguards. Specifically, the BA forced password resets for its portal users, blocked a range of known internet addresses for the bad actor, and modified the procedure to reset its workforce members’ passwords. Humana provided notice to the HHS Secretary, all affected individuals, and the media. OCR obtained assurances that the CE/BA implemented the corrective actions noted above.