California Physicians' Services

On December 7, 2015, Blue Shield of California discovered that its network servers were breached via social engineering at its call centers in Costa Rica. The breach, submitted to HHS on January 14, 2016, affected 20,764 individuals. PHI exposed included names, addresses, dates of birth, and Social Security numbers. Remediation included disabling compromised credentials, redistributing new passwords, two-factor authentication for VPN access, and social engineering training for call center staff. OCR obtained assurances of corrective action.

Affected (this filing):

Blue Shield of California notified California regulators and affected individuals of a breach involving a third-party vendor. Between September 15 and December 17, 2015, unauthorized users accessed vendor systems using misused customer service representative credentials. Affected data included names, addresses, dates of birth, and Social Security numbers. Blue Shield offered one year of Experian ProtectMyID identity protection services.