The U.S. Department of Health and Human Services’ Office for Civil Rights (HHS OCR) on Jan. 15 fined Excellus Health Plan $5.1 million and ordered it to implement a corrective action plan for failures relating to a 2015 data breach that exposed the personal information of 9.3 million individuals.
In September 2015, Excellus filed a breach report notifying HHS that cyber-attackers had gained unauthorized access to its IT systems beginning around December 2013 and ending in May 2015. The hackers installed malware that resulted in the disclosure of protected health information, including individuals’ names, addresses, dates of birth, e-mail addresses, Social Security numbers, bank account information, health plan claims, and clinical treatment information.
