Health Plan of San Mateo

Health Plan of San Mateo (CA) reported to HHS OCR on 2023-03-17 a Hacking/IT Incident (email phishing) affecting 11,894 individuals. An employee was the subject of an email phishing scheme that exposed PHI including names, dates of birth, diagnoses/conditions, medications, and other treatment information. Breached information located in Email. No business associate was involved. The CE notified HHS, affected individuals, the media, and posted a substitute notice. Additional administrative, technical, and security safeguards were implemented.

Affected (this filing): 11,894

Health Plan of San Mateo disclosed an email phishing incident on January 17, 2023, where an unauthorized person accessed one employee email account. The attacker attempted to fraudulently change direct deposit information. A spreadsheet containing member names, dates of birth, member IDs, and limited nurse advice line call information was potentially exposed. No SSNs or financial data were involved. The company engaged a cybersecurity firm, reviewed the mailbox, enhanced security measures, and provided employee training.