Contra Costa Health Plan

Contra Costa Health Plan reported to HHS on 2018-12-13 an incident of unauthorized access affecting 862 individuals. The breach occurred when a business associate, who had provided services under a false identity, accessed health plan enrollees’ protected health information (PHI), including demographic and clinical data. The breached information was located on the entity's Electronic Medical Record and Email systems. The incident was discovered on May 22, 2018.

Contra Costa Health Plan notified members that a contractor, who falsified her identity to obtain a contract for utilization management services starting Dec 1, 2014, had access to electronic health records. CCHP discovered the false identity on May 22, 2018, and immediately terminated the contract and access. Forensic audits found no evidence of improper access or disclosure. Affected data included names, addresses, SSNs, and medical information. One year of credit monitoring was offered.