HealthEquity, Inc.

HealthEquity, Inc., the business associate (BA), reported two separate breach incidents involving several employees that were the victims of email phishing schemes that affected 165,800 and 16,000 individuals respectively. The protected health information (PHI) involved included names, Social Security numbers, claims information, insurance information, employer information, financial information, and treatment information. The BA notified HHS, affected individuals, and the media. The responsible employee was sanctioned. To mitigate future incidents of this nature, the BA implemented additional administrative, technical, and security safeguards and trained its staff on the proper methods for identifying fraudulent email communications. Following OCR’s investigation and provision of technical assistance, the BA reduced the amount of PHI vulnerable to attack. OCR obtained assurances that the BA implemented the aforementioned corrective actions.