Healthplex healthplex.com Healthplex data breach: what happened and what to do
Healthplex, a New York dental benefits company, reported in April 2022 that a phishing attack on an employee affected 89,955 people. Names, contact details, dates of birth, Social Security numbers, diagnoses, prescription, claims and health insurance information were involved.
View all 13,177 breaches- Breach date
- Nov 2021
- Affected
- 89,955
- Data exposed
- Names, Physical addresses, Phone numbers, Email addresses, Dates of birth, Social security numbers, Diagnoses, Prescription information, Claims information, Health insurance information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Healthplex, Inc. reported to the U.S. Department of Health and Human Services that an employee was the target of an email phishing attack involving the health information of 89,955 people. News coverage says the employee gave away account credentials in November 2021, which let an attacker into their email account, and that notice letters went out in April 2022.
New York Attorney General Letitia James later investigated. In December 2023 Healthplex agreed to pay $400,000 to resolve it, without admitting wrongdoing. Reporting on the settlement says the company hadn't turned on multi-factor authentication for a newly deployed Office 365 web interface.
Sources checked: ocrportal.hhs.gov, hipaajournal.com, healthitsecurity.com
Last verified against the official page:
What was exposed
HHS lists names, gender, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, diagnoses, prescription information, claims information, and health insurance and other treatment information.
That mix of contact details with a Social Security number and date of birth supports identity theft and convincing phishing that mentions a real plan or claim.
The company's response
Healthplex notified HHS, the affected people and the media, and posted a notice on its website. It sanctioned the employee and added administrative and technical safeguards. HHS's Office for Civil Rights provided technical assistance on the HIPAA Rules.
What to do if you were in it
- 1
Read the notice letter
If you were affected you should get a letter from the organization. It says which of your details were involved and whether it offers free credit monitoring. The FTC recommends taking that offer.
- 2
Freeze your credit
Because Social Security numbers were involved, place a free credit freeze at Equifax, Experian and TransUnion. The FTC explains how. Check your reports at annualcreditreport.com.
- 3
Read your health insurance statements
Look at explanation of benefits statements for treatment or claims you don't recognize, and tell your insurer if something is wrong.
- 4
Treat messages about the breach as suspect
Expect calls, texts and emails that use real details. Don't click links or give details to someone who contacts you first; contact the organization using a number from its own website.
- 5
Report misuse
If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus alerts you when they show up in a new leak.
Official filings
- U.S. Department of Health and Human Services , filed 20 Apr 2022 : 89,955 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Healthplex data breach?
The organization sent letters to the people whose details were involved. If you were a patient and got no letter, contact it directly using the contact details on its own website.
What was exposed?
Names, gender, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, diagnoses, prescription and claims information, and health insurance information, according to HHS.
Should I freeze my credit?
If your Social Security number was exposed, a freeze is a sensible step. It's free, you set it up at each of the three bureaus, and you can lift it when you need to apply for credit.
Was there a settlement?
The New York Attorney General reached a $400,000 settlement with Healthplex in December 2023, according to news reports. Those reports don't describe a payout to affected people.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- hipaajournal.com/healthplex-data-breach-settlement-new-york/
- healthitsecurity.com/news/ny-ag-reaches-400k-settlement-with-healthplex-over-data-breach
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
