Anthem Pays a Record $16 Million to Settle Data Breach

Anthem, Inc. has agreed to pay $16 million to the U.S. Department of Health and Human Service (HHS), Office for Civil Rights and take substantial corrective action in a settlement over its 2015 data breach that affected nearly 79 million people.

Anthem is an independent licensee of the Blue Cross and Blue Shield Association and one of the nation’s largest health benefit companies. Anthem provides medical insurance coverage to one in eight Americans through its affiliated health plans.

On March 13, 2015, Anthem filed a breach report with the HHS Office for Civil Rights (OCR) explaining that it had discovered that cyber-attackers had gained access to its IT system for the apparent purpose of extracting data. Anthem discovered that the cyber-attackers had infiltrated their system through spear phishing emails sent to an Anthem subsidiary. At least one employee responded to the malicious email, which opened the door to cyberattacks.

The data breach affected electronic protected health information that Anthem maintained for its affiliated health plans and any other covered entity health plans. OCR’s investigation revealed that between December 2, 2014 and January 27, 2015, cyber-attackers stole the electronic protected health information of almost 79 million individuals. The stolen information included names, social security numbers, medical identification numbers, addresses, dates of birth, email addresses, and employment information.

OCR Director Roger Severino said, “The largest health data breach in U.S. history fully merits the largest HIPAA settlement in history … Unfortunately, Anthem failed to implement appropriate measures for detecting hackers who had gained access to their system to harvest passwords and steal people’s private information … We know that large health care entities are attractive targets for hackers, which is why they are expected to have strong password policies and to monitor and respond to security incidents in a timely fashion or risk enforcement by OCR.”

The $16 million settlement is the largest HIPAA settlement in OCR history and settles any potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules.