State of Alaska Department of Health and Social Services

The State of Alaska Department of Health and Human Services (Alaska), the covered entity (CE), reported that it was the victim of a cyber-attack that affected the electronic protected health information (ePHI) of 942,528 individuals. The ePHI involved included names, addresses, Social Security numbers, drivers’ license information, health insurance information, claims information, clinical information, and financial information. Upon discovering the breach, Alaska requested and received assistance from the FBI to conduct its investigation of the breach incident to determine the accurate number of individuals affected and how the virus and unauthorized software was placed on its computer system. Alaska notified HHS, affected individuals, the media, and provided substitute notice. During OCR’s investigation, we provided technical assistance to Alaska on risk analysis, risk management, and security policies and procedures to ensure adequate safeguards of Alaska’s ePHI. As a result, Alaska updated its security policies and procedures, and sanctioned the responsible employee.