In the wake of the largest U.S. health care data breach in
history, Anthem, Inc., has agreed to pay $16 million to the Office
for Civil Rights, which is a record settlement for alleged HIPAA
violations. According to the Department of Health and Human
Services ("HHS"), the previous high was a $5.55 million
settlement paid in 2016. In addition to the monetary payment,
Anthem has also agreed to take "substantial" corrective
action to help prevent a similar breach from occurring in the
future.
The settlement arose out of a 2014 breach involving the
electronic protected health information ("ePHI") of
nearly 79 million people. On January 29, 2015, Anthem discovered
that hackers had gained accessed to its IT system through a
persistent threat attack. Further investigation revealed that
hackers had sent spear phishing emails to one of Anthem's
subsidiaries and at least one employee took the bait. Through that
seemingly simple act, the hackers were then able to
