HUMANA INC.

Humana Inc. (KY) reported to HHS on 2024-02-06 an Unauthorized Access/Disclosure affecting 6,440 individuals. An employee inadvertently mailed PHI — including names, addresses, medications, and diagnoses — to the wrong recipients. Breached information was on Paper/Films. No business associate was involved. Humana notified HHS, affected individuals, and the media, and implemented additional administrative, technical, and security safeguards.

Affected (this filing): 6,440

Humana Inc. (KY, Health Plan) reported to HHS OCR on 2024-02-08 an Unauthorized Access/Disclosure affecting 12,339 individuals. An unauthorized external individual accessed PHI stored on a Network Server using credentials or data obtained from an outside source. PHI affected included names, addresses, dates of birth, diagnoses, and other treatment information. Humana notified HHS and affected individuals, and implemented additional administrative and technical safeguards.

Affected (this filing): 12,339

Humana's FY2023 Form 10-K Item 1C cybersecurity disclosure describes its risk management program, board oversight via Audit and Technology Committees, and CISO/CIO governance structure. The filing acknowledges the company has been subject to past breaches of its own and third-party service providers' IT systems but states the impact has not been material through December 31, 2023. No specific incident, date, count, or data type is disclosed.