Skip to main content
 HHS.gov
 Search
 U.S. Department of Health & Human Services
  Search Close
 A-Z Index
 About HHS
Programs & Services
Grants & Contracts
Laws & Regulations
 Home > About > News > Health Insurer Pays $6.85 Million to Settle Data Breach Affecting Over 10.4 Million People
 Text Resize  
                                A
                                A
                                A
                            Print
                            Share
 Search News Releases
View 2016 - 1991 archive
 FOR IMMEDIATE RELEASESeptember 25, 2020Contact: HHS Press Office202-690-6343[email protected]Health Insurer Pays $6.85 Million to Settle Data Breach Affecting Over 10.4 Million PeoplePremera Blue Cross (PBC) has agreed to pay $6.85 million to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) and to implement a corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules related to a breach affecting over 10.4 million people. This resolution represents the second-largest payment to resolve a HIPAA investigation in OCR history. PBC operates in Washington and Alaska, and is the largest health plan in the Pacific Northwest, serving more than two million people.
On March 17, 2015, PBC filed a breach report on behalf of itself and its network of affiliates stating that cyber-attackers had gained unauthorized access to its information technology (IT) system.  The hackers used a phishing email to install malware that gave them access to PBC’s IT system in May 2014, which went undetected for nearly nine months until January 2015.  This undetected cyberattack, otherwise known as an advanced persistent threat, resulted in the disclosure of more than 10.4 million individuals’ protected health information including their names, addresses, dates of birth, email addresses, Social Security numbers, bank account information, and health plan clinical information.
OCR’s investigation found systemic noncompliance with the HIPAA Rules including failure to conduct an enterprise-wide risk analysis, and failures to implement risk management, and audit controls.
“If large health insurance entities don’t invest the time and effort to identify their security vulnerabilities, be they technical or human, hackers surely will. This case vividly demonstrates the damage that results when hackers are allowed to roam undetected in a computer system for nearly nine months,” said Roger Severino, OCR Director.
In addition to the monetary settlement, PBC has agreed to a robust corrective action plan that includes two years of monitoring.  The resolution agreement and corrective action plan may be found at: https://www.hhs.gov/sites/default/files/premera-ra-cap.pdf.###Note: All HHS press releases, fact sheets and other news materials are available at https://www.hhs.gov/news.Like HHS on Facebook, follow HHS on Twitter @HHSgov, and sign up for HHS Email Updates.Last revised: September 25, 2020 Sign Up for News Release UpdatesEnter your email:
Email Subscribe to RSSReceive latest updates Related News ReleasesOCR Settles Thirteenth Investigation in HIPAA Right of Access Initiative
  OCR Issues Guidance on HIPAA, Health Information Exchanges, and Disclosures of Protected Health Information for Public Health Purposes
  OCR Issues Audit Report on Health Care Industry Compliance with the HIPAA Rules Related Blog PostsHHS Blog thumbnail  
  Spotlight on Naloxone Co-Prescribing
          HHS Blog thumbnail  
  Now is the time: Catch-up to Get Ahead on Childhood Immunizations
          HHS Blog thumbnail  
  Health Providers: Join the Telehealth Revolution
 Public Affairs Contacts
HHS Media InformationASPA Press ContactsHHS Agency Press Contacts
**View all**
 Connect With Us
 Sign Up for Email Updates To sign up for updates or to access your subscriber preferences, please enter your contact information below. Email
 HHS Headquarters U.S. Department of Health & Human Services
						200 Independence Avenue, S.W.
						Washington, D.C. 20201
						Toll Free Call Center: 1-877-696-6775​
 Contact HHS
                        Careers
                        HHS FAQs
                        Nondiscrimination Notice
 HHS Archive
                        Accessibility
                        Privacy Policy
                        Viewers & Players
 Budget/Performance
                        Guidance Portal 
                        Inspector General
                        EEO/No Fear Act
 FOIA
                        The White House
                        USA.gov


Back to *T*op