Humana uses the medical records request company Cotiviti, which is partnered with a subcontractor that reviews collected medical records for reporting to CMS. An employee of the subcontractor company, who was authorized to access and use patient data for Humana, inappropriately disclosed data to unapproved individuals for unauthorized training purposes between Oct. 12, 2020, and Dec. 16, 2020.
Patient information exposed included names, dates of birth, Social Security numbers, addresses, phone numbers, medical record numbers and treatment details.
Humana was notified of the breach Dec. 22, and the subcontractor disabled the records access of the now-former employee, according to the report. Cotiviti and its subcontractor implemented a new strategy to prevent unauthorized medical records access, and Humana also worked with Cotiviti to increase security protections.
As a result of the incident, Humana is offering two years of free credit monitoring and identity protection services to individuals affected by the breach.
More articles on cybersecurity:
Email hacking incident exposes patients’ info at 2 Trinity Health hospitals
Hackers demand $1.75M from North Carolina clinic during 6-day ransomware attack
9 must-read takeaways from recent cybersecurity reports
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.