Metropolitan Life Insurance Company

Metropolitan Life Insurance Company (MetLife), the covered entity (CE) reported that an unauthorized individual gained access to 4,420 online customer accounts through an email phishing scheme. The protected health information (PHI) involved included names, addresses, health policy numbers, and account information. MetLife provided breach notification to HHS, individuals affected by the breach, and posted a warning notice on its website educating its customers of the risk of phishing attacks and provided customers with free credit monitoring. During OCR’s investigation, OCR determined that the incident did not constitute a breach, as the incident reported by MetLife did not involve a compromise to its own computer system. Specifically a phishing email was sent externally to MetLife customers and non-customers, which some MetLife and non-MetLife customers responded to providing their account authentication information which gave the unauthorized individual access to their accounts.