MultiPlan

The business associate (BA), MultiPlan, reported that an employee was the victim of an email phishing attack affecting the protected health information (PHI) of 214,956 individuals. The PHI involved included names, addresses, email addresses, dates of birth, claims and health insurance information, and Social Security numbers. The BA notified HHS, affected individuals, the media, and provided substitute notice. In response to the breach, the BA sanctioned the responsible employee, revised its policies and procedures, and implemented additional technical safeguards. All staff were retrained on email security.