Health Plan of San Mateo

Health Plan of San Mateo (CA) reported to HHS OCR on 2023-03-17 a Hacking/IT Incident (email phishing) affecting 11,894 individuals. An employee was the subject of an email phishing scheme that exposed PHI including names, dates of birth, diagnoses/conditions, medications, and other treatment information. Breached information located in Email. No business associate was involved. The CE notified HHS, affected individuals, the media, and posted a substitute notice. Additional administrative, technical, and security safeguards were implemented.

Health Plan of San Mateo disclosed an email phishing incident on January 17, 2023, where an unauthorized person accessed one employee email account. The attacker attempted to fraudulently change direct deposit information. A spreadsheet containing member names, dates of birth, member IDs, and limited nurse advice line call information was potentially exposed. No SSNs or financial data were involved. The company engaged a cybersecurity firm, reviewed the mailbox, enhanced security measures, and provided employee training.

Health Plan of San Mateo reported to HHS on 2023-01-18 a Hacking/IT Incident affecting 4,032 individuals. A subcontractor of its business associate experienced a ransomware incident. Breached information located on Network Server. PHI included names, DOB, insurance info, diagnoses, and health assessments.

Health Plan of San Mateo reported to HHS on 2011-06-29 a Unauthorized Access/Disclosure affecting 694 individuals. Breached information located on Paper/Films.