John Hancock Life Insurance Company (U.S.A.)

An unknown third party used social engineering to obtain the identifying information of eleven employees from sources outside their employment and used that information to impersonate the employees online and over the phone to gain access to a database of the covered entity (CE). The database contained the protected health information (PHI) of 1,715 long-term care insurance policy holders and applicants. including names, dates of birth, Social Security numbers, telephone numbers, email addresses and certain long-term care insurance policy information. Following the breach, the CE took the database offline, created new identity verification policies and procedures, and retrained staff. The CE provided breach notification to HHS and affected individuals in accordance with the Breach Notification Rule. OCR provided the CE with technical assistance regarding its privacy and security program.