United Healthcare Services, Inc. Single Affiliated Covered Entity

The covered entity (CE), United Healthcare Services, reported that it impermissibly disclosed the protected health information (PHI) of 4,264 individuals to a business associate (BA). An employee of the BA was then subjected to an email phishing scheme that compromised this PHI. The PHI involved included names, addresses, birthdates, Social Security numbers, and health insurance and other treatment information. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE offered free credit monitoring services. Staff were also retrained in its requirements to protect and secure PHI.