HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Oct. 6, 2017.
- Organization as reported
- John Hancock Life Insurance Company (U.S.A.), MA
- Entity type as reported
- Health Plan
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Oct. 6, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14037, row:5176)
- Archived copy
- Held in the private archive (provenance)
An unknown third party used social engineering to obtain the identifying information of eleven employees from sources outside their employment and used that information to impersonate the employees online and over the phone to gain access to a database of the covered entity (CE). The database contained the protected health information (PHI) of 1,715 long-term care insurance policy holders and applicants. including names, dates of birth, Social Security numbers, telephone numbers, email addresses and certain long-term care insurance policy information. Following the breach, the CE took the database offline, created new identity verification policies and procedures, and retrained staff. The CE provided breach notification to HHS and affected individuals in accordance with the Breach Notification Rule. OCR provided the CE with technical assistance regarding its privacy and security program.