Blue Cross Blue Shield of Michigan Blue Care Network

An external unauthorized party accessed a business associate (BA) employee’s corporate email account and used it to send emails with a malicious link to all individuals in the employee’s address book. The types of protected health information involved in the breach included the social security numbers, addresses, dates of birth, and phone numbers of 502 individuals in twelve states. Following the breach, the BA, Bloom Health, shut down the affected laptop computer, conducted forensic reviews, sent emails to employees and business partners about the suspicious email and instructed them not to click on the embedded link and to change email passwords. The BA determined that no other email accounts were accessed and the contents of the subject email were not downloaded or forwarded to another machine. In response to the breach, the BA implemented a new policy to require a forced password reset after an account has been locked, including two-factor authentication for all business emails. The BA provided breach notification to HHS, affected individuals and posted substitute notice on its website. The BA retrained its staff on its new policies and procedures. OCR obtained documented assurances that the BA implemented the voluntary compliance actions listed here.