Anthem Pays OCR $16 Million in Record Breaking HIPAA Settlement Following Largest U.S. Health Data Breach in History
HIPAA Privacy & Security Updates—From Dorothy Cociu, COIN Editor and HIPAA Privacy & Security Consultant & Trainer, November 2018
On October 15, 2018, HHS announced that Anthem, Inc. has agreed to pay $16 million to the U.S. Department of Health and Human Services, Office for Civil Rights (OCR) and take substantial corrective action to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules after a series of cyberattacks led to the largest U.S. health data breach in history, which occurred between December 2, 2014 and January 27, 2015, and exposed the electronic protected health information of almost 79 million people.
According to HHS and OCR, The $16 million settlement eclipses the previous high of $5.55 million paid to OCR in 2016.
Anthem is an independent licensee of the Blue Cross and Blue Shield Association operating throughout the United States and is one of the nation’s largest health benefits companies, providing medical care coverage to one in eight Americans through its affiliated health plans. This breach affected electronic protected health information (ePHI) that Anthem, Inc. maintained for its affiliated health plans and any other covered entity health plans.
The announcement and press release states that on March 13, 2015, Anthem filed a breach report with the HHS Office for Civil Rights detailing that, on January 29, 2015, they discovered cyber-attackers had gained access to their IT system via an undetected continuous and targeted cyber attack for the apparent purpose of extracting data, otherwise known as an advanced persistent threat attack. After filing their breach report, Anthem discovered cyber-attackers had infiltrated their system through spear phishing emails sent to an Anthem subsidiary after at least one employee responded to the malicious email and opened the door to further attacks. OCR’s investigation revealed that between December 2, 2014 and January 27, 2015, the cyber-attackers stole the ePHI of almost 79 million individuals, including names, social security numbers, medical identification numbers, addresses, dates of birth, email addresses, and employment information.
“The largest health data breach in U.S. history fully merits the largest HIPAA settlement in history,” said OCR Director Roger Severino. “Unfortunately, Anthem failed to implement appropriate measures for detecting hackers who had gained access to their system to harvest passwords and steal people’s private information.” Director Severino continued, “We know that large health care entities are attractive targets for hackers, which is why they are expected to have strong password policies and to monitor and respond to security incidents in a timely fashion or risk enforcement by OCR.”
HHS’s Office of Civil Rights stated in their listserve and press release announcement on October 15 that in addition to the impermissible disclosure of ePHI, OCR’s investigation revealed that Anthem failed to conduct an enterprise-wide risk analysis, had insufficient procedures to regularly review information system activity, failed to identify and respond to suspected or known security incidents, and failed to implement adequate minimum access controls to prevent the cyber-attackers from accessing sensitive ePHI, beginning as early as February 18, 2014.
In addition to the $16 million settlement, Anthem will undertake a robust corrective action plan to comply with the HIPAA Rules. The resolution agreement and corrective action plan may be found on the OCR website at http://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/anthem/index.html.
The Corrective Action Plan (CAP) includes several corrective action obligations, including but not limited to:
- Security Management Process
- Anthem must conduct an accurate and thorough Risk Analysis of the potential vulnerabilities to the confidentiality, integrity, and availability of ePHI held by Anthem
- Within 30 days of receipt of the Risk Analysis Statement of Work (SOW), if HHS identifies deficiencies in the Risk Analysis SOW, HHS will provide Anthem with written technical assistance, as necessary, and later meet to confer in good faith
- · Anthem shall review and revise, as necessary, the written policies and procedures addressing the compliance of security of ePHI
- Anthem shall distribute the written P&Ps to its workforce within 30 days of the adoption of the P&Ps
- Anthem will submit a written report with the documentation required by the agreement, and retain all documents · and records for at least 6 years
- Anthem is expected to fully and timely comply with all provisions contained in the CAP.
This huge settlement should be a reminder to all that HIPAA Privacy & Security rules and compliance is serious business… If Anthem can have a serious breach, what about your agency? Are you training your staff properly to comply with the Privacy laws? Are you protecting yourself from cyber attacks? Do your employees know how to avoid the somewhat (sadly) common types of spear phishing emails that can result in this? If not, I highly recommend you train yourself and your staff appropriately!
Stay tuned for more HIPAA Privacy & Security Updates in the next issue! ##
