HIM 422 Module 2 Final Project Milestone One Example

Final Project Milestone One: 78.8 Million Records, the Anthem Breach and the People It Touched

[Student Name]

Southern New Hampshire University

HIM 422: Ethical and Legal Considerations in Health Information Management

Final Project Milestone One

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

Final Project Milestone One: 78.8 Million Records, the Anthem Breach and the People It Touched

In early 2015, Anthem, then the second-largest health insurer in the United States, announced that attackers had broken into its systems and stolen personal information on tens of millions of people. The final count reached 78.8 million individuals, making it the largest health data breach reported to that point. This milestone summarizes what happened, identifies the stakeholders affected and their interests and introduces the legal frameworks that the next milestones will apply. Facts come from Anthem's public statements, the federal settlement announcement and court records.

How the Attack Happened

The attack began about a year before anyone noticed it. In February 2014, at least one employee of an Anthem subsidiary opened a phishing email designed to look legitimate, which allowed the attackers to install malicious software and gain a foothold. Over the following months they moved through Anthem's network, obtained the credentials of employees with broad access and reached a data warehouse holding member information. No evidence showed that medical, claims or payment card data were taken, but the stolen records included names, birth dates, Social Security numbers, member identification numbers, addresses, email addresses and employment information, including income for some members.

Discovery and Response

In late January 2015, a database administrator noticed a query running under his own credentials that he had not started. Anthem's security team investigated, shut down the access and within days notified the FBI and hired an outside security firm. Anthem announced the attack publicly on February 4, 2015, set up a website and call center, mailed notices to affected individuals and offered two years of free identity protection and credit monitoring. Some affected people were not Anthem members at all but members of other Blue Cross Blue Shield plans whose data passed through Anthem's systems when they received care in Anthem's service areas. In 2019, a federal grand jury indicted members of a China-based hacking group in connection with the attack.

The Breach in Context

Anthem was a turning point in breach history. Liu et al. (2015) studied the breach reports filed with HHS in the four years starting in 2010 and showed that most involved the theft of physical items such as laptops and paper records, with hacking a small share. McCoy and Perlis (2018), extending the analysis through 2017, found that hacking and information technology incidents had become the leading source of breached records, and that a handful of very large incidents at health plans accounted for most exposed records. Anthem is the largest of those incidents.

The entry point was also typical. Gordon et al. (2019) ran simulated phishing campaigns at US hospitals and health systems, and staff clicked roughly one message in every seven. Kruse et al. (2017), in a systematic review of health care cybersecurity, concluded that the industry had lagged others in protective measures while holding data that are valuable to criminals. Anthem's breach shows how one click, combined with broad access and slow detection, can expose an entire membership.

What Remains Uncertain

Some questions cannot be answered from public records. Anthem did not publish its internal forensic report, so the exact path from the first compromised computer to the data warehouse is known only in outline. It is also unclear how much of the stolen information has been used for identity theft, because stolen data sold on criminal markets can surface years later and victims rarely learn where a fraudster obtained their details. This milestone therefore treats the confirmed facts, the entry through phishing, the months of undetected access, the types of data taken and the number of people affected, as the basis for the analysis, and it marks anything else as uncertain rather than filling gaps with assumptions.

Key Stakeholders

The breach reached far beyond Anthem's members. Table 1 lists the main stakeholder groups, how the breach affected each and what each needed from Anthem's response.

Table 1. Stakeholders in the Anthem Breach

Note. Prepared by the author from public reports on the breach.

Why Stakeholders Matter to the Analysis

The stakeholder map shows that the people most harmed, the members whose Social Security numbers were taken, had the least control over the events that harmed them. Unlike a password, a Social Security number cannot easily be changed, so the risk of identity theft does not end when monitoring services expire. Employer groups and other Blue plans also depended on Anthem's security without being able to inspect it. These relationships raise ethical questions about duty and trust that Milestone Three will address.

Laws in Play

As a health plan, Anthem is a covered entity under HIPAA. Three parts of the HIPAA rules apply. Under the Security Rule, a plan must protect electronic health data through a mix of management, facility and system controls, beginning with an honest assessment of where its risks lie. The Privacy Rule governs use and disclosure. The Breach Notification Rule sets deadlines for telling people: affected individuals must hear promptly, within 60 days at most once a breach is found, HHS must be told, and prominent media outlets must be informed whenever over 500 residents of one state are involved. State data breach laws and state attorneys general add a second layer, and private lawsuits a third. Milestone Two will examine how each layer produced financial and nonfinancial consequences.

Conclusion

The Anthem breach began with a phishing email, went undetected for months and exposed identifying information for 78.8 million people, including many who never chose Anthem as their insurer. Its stakeholders range from members and employers to regulators and shareholders, each with different interests. Understanding what happened and who was affected is the foundation for judging the breach's impact and for deciding what Anthem, and organizations like it, should have done differently.

References

Gordon, W. J., Wright, A., Aiyagari, R., Corbo, L., Glynn, R. J., Kadakia, J., Kufahl, J., Mazzone, C., Noga, J., Parkulo, M., Sanford, B., Scheib, P., & Landman, A. B. (2019). Assessment of employee susceptibility to phishing attacks at US health care institutions. JAMA Network Open, 2(3), Article e190393. https://doi.org/10.1001/jamanetworkopen.2019.0393

Kruse, C. S., Frederick, B., Jacobson, T., & Monticone, D. K. (2017). Cybersecurity in healthcare: A systematic review of modern threats and trends. Technology and Health Care, 25(1), 1-10. https://doi.org/10.3233/THC-161263

Liu, V., Musen, M. A., & Chou, T. (2015). Data breaches of protected health information in the United States. JAMA, 313(14), 1471-1473. https://doi.org/10.1001/jama.2015.2252

McCoy, T. H., Jr., & Perlis, R. H. (2018). Temporal trends and characteristics of reportable health data breaches, 2010-2017. JAMA, 320(12), 1282-1284. https://doi.org/10.1001/jama.2018.9222