MOLINA HEALTHCARE, INC.

Molina Healthcare reported to HHS on 2023-07-11 a Hacking/IT Incident affecting 7702 individuals. Breached information located on Network Server. A business associate experienced the attack, compromising PHI including names, DOBs, and insurance info.

Molina Healthcare reported to HHS on 2022-09-26 a Hacking/IT Incident affecting 1068 individuals. Breached information located on Network Server. A business associate experienced a cyber-attack compromising PHI including names, identifiers, claims, and treatment info. CE provided credit monitoring and implemented technical safeguards.

Molina Healthcare (CA, Health Plan) reported to HHS OCR on 2022-09-09 an Unauthorized Access/Disclosure affecting 8,283 individuals. The covered entity's business associate mailed PHI — including names, member identification numbers, and treatment information — to the wrong recipients (Paper/Films). The CE notified HHS, affected individuals, and the media, and provided credit monitoring and HIPAA training to its BA. OCR provided technical assistance on the HIPAA Security Rule.

Molina Healthcare (CA, Health Plan) reported to HHS on 2019-02-22 a Hacking/IT Incident (ransomware) affecting 895 individuals. On Sept. 23, 2018, Wolverine Solutions Group — a subcontractor of business associate Equian, LLC — suffered a ransomware attack. Molina was notified on Dec. 27, 2018. Affected ePHI included names, addresses, health plan names, dates of service, and provider names across six states. Breached information located on Network Server. Remediation included HIPAA training for the BA and mandatory security enhancements at the subcontractor.

Molina Healthcare, Inc. reported to HHS on 2017-12-21 a Unauthorized Access/Disclosure affecting 1380 individuals. Breached information located on Other. Error in preparing mailing lists for business associate Merrill Communications resulted in letters with PHI (names, member IDs, dates of service, physician names) being delivered to incorrect beneficiaries.

Molina Healthcare reported to HHS on 2015-09-18 a theft affecting 54203 individuals, caused by a former employee of its business associate, CVS Health. The employee impermissibly exfiltrated member information, including names and health plan details, to a personal computer. The breached information was located on a Desktop Computer.

Molina Healthcare of Washington reported that a former CVS employee, a third-party vendor administering OTC benefits, impermissibly transferred PHI of 7,767 Washington Medicare members to a personal computer around March 26, 2015. Molina was notified on July 20, 2015. Data included names, IDs, and plan details. CVS replaced cards and offered identity theft protection.

HHS OCR breach report for Molina Healthcare of Virginia (Business Associate) regarding an unauthorized disclosure of PHI involving 1,499 individuals. A subcontractor (HBS) uploaded a pharmacy claims report containing PHI to a non-secured FTP site during troubleshooting. The file was encrypted and password-protected. Remediation included employee retraining, software updates, and offering identity theft protection.