Blue Shield of California

Blue Shield of California, the covered entity (CE), reported that its business associate (BA) experienced a ransomware attack that compromised the protected health information (PHI) of 1,519 individuals. The PHI involved included names, dates of birth, and Social Security numbers. The CE notified HHS, affected individuals, the media, and provided substitute notice on its website. To mitigate the incident and prevent reoccurrence of a similar incident, the CE provided complimentary credit monitoring services and implemented additional administrative and technical safeguards to better protect sensitive data. OCR provided the CE with technical assistance regarding the importance of training and retraining after a security incident.