Humana Inc

Humana, the covered entity (CE), discovered that on August 7, 2018, an unauthorized third party accessed credentials belonging to employees of a business associate (BA) and hacked the BA’s computer network which contained the protected health information (PHI) of 1,211 of the CE’s members. The types of PHI included individuals’ names, dates of birth, insurance policy numbers, and the last four digits of Social Security numbers. In response to the incident, Humana’s BA contacted the FBI and improved safeguards. Specifically, the BA forced password resets for its portal users, blocked a range of known internet addresses for the bad actor, and modified the procedure to reset its workforce members’ passwords. Humana provided notice to the HHS Secretary, all affected individuals, and the media. OCR obtained assurances that the CE/BA implemented the corrective actions noted above.