HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 19, 2017.
- Organization as reported
- Metropolitan Life Insurance Company, NY
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Other
- Submission date
- July 19, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14121, row:5260)
- Archived copy
- Held in the private archive (provenance)
Metropolitan Life Insurance Company (MetLife), the covered entity (CE) reported that an unauthorized individual gained access to 4,420 online customer accounts through an email phishing scheme. The protected health information (PHI) involved included names, addresses, health policy numbers, and account information. MetLife provided breach notification to HHS, individuals affected by the breach, and posted a warning notice on its website educating its customers of the risk of phishing attacks and provided customers with free credit monitoring. During OCR’s investigation, OCR determined that the incident did not constitute a breach, as the incident reported by MetLife did not involve a compromise to its own computer system. Specifically a phishing email was sent externally to MetLife customers and non-customers, which some MetLife and non-MetLife customers responded to providing their account authentication information which gave the unauthorized individual access to their accounts.