HIM 422 Module 4 Final Project Milestone Two Example

Final Project Milestone Two: What the Anthem Breach Cost, and What Money Could Not Repair

[Student Name]

Southern New Hampshire University

HIM 422: Ethical and Legal Considerations in Health Information Management

Final Project Milestone Two

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

Final Project Milestone Two: What the Anthem Breach Cost, and What Money Could Not Repair

Milestone One described how attackers entered Anthem's network through a phishing email and left with identifying information on 78.8 million people. This milestone asks what followed. It separates financial impacts, which public records allow us to count at least in part, from nonfinancial impacts, which fall on people and relationships and are harder to measure but often last longer. Figures come from federal enforcement announcements, court records and press releases from state attorneys general.

Regulatory Penalties

Federal enforcement came first. In October 2018, Anthem agreed with the Office for Civil Rights at HHS to pay $16 million and adopt a corrective action plan to settle potential HIPAA violations, then the largest HIPAA settlement in the agency's history. The agency's findings described failures that went to the heart of the Security Rule: no enterprise-wide risk analysis, inadequate review of information system activity, failure to identify and respond to the intrusion in time and insufficient controls to prevent unauthorized access. In 2020, a coalition of more than 40 state attorneys general reached a separate $39.5 million settlement with Anthem, which also required security commitments.

Litigation

Consumers sued as well. Cases filed across the country were consolidated in federal court in California, and in 2018 the court approved a $115 million class settlement, at the time the largest ever for a data breach. The fund paid for additional credit monitoring, reimbursement of out-of-pocket losses and alternative cash payments for people who already had monitoring, and Anthem agreed to maintain specified security practices for several years.

Research helps explain why this case produced such a large settlement. Romanosky et al. (2014) examined data breach lawsuits and found that suits were more likely when breaches exposed more records and when individuals suffered financial harm, and less likely when the company offered free credit monitoring. Anthem did offer monitoring, but the scale of the breach and the exposure of Social Security numbers made litigation almost certain.

Response and Security Costs

Beyond penalties and settlements, Anthem paid for forensic investigation, legal counsel, notification letters to tens of millions of people, a dedicated call center, two years of identity protection services for everyone affected and later security improvements. Anthem did not publish a complete accounting of these costs, so this milestone does not estimate them. Table 1 summarizes the public figures that can be verified.

Table 1. Publicly Reported Financial Consequences of the Anthem Breach

Note. Compiled by the author from public announcements and court records.

Impacts on Members

For members, the most serious impact is lasting exposure. Jiang and Bai (2020) analyzed the types of information compromised in health data breaches and found that many exposed Social Security numbers and other details that enable financial identity theft, not only medical information. A credit card number can be canceled; a Social Security number and birth date remain valid for life. Two years of monitoring, however well intended, ended long before the stolen data lost their value. Members also bore the time and worry of freezing credit, watching accounts and responding to phishing attempts that used their real details to seem legitimate.

Impacts on Employers, Staff and Trust

Employer groups that bought Anthem coverage had to answer their employees' questions and decide whether to stay with the insurer, a decision that rests on trust in an organization they cannot inspect. Anthem's own staff faced months of crisis work, and employees whose credentials were used in the attack faced scrutiny for actions that attackers had engineered. Choi et al. (2019) found that after hospitals experienced breaches, the security changes that followed were associated with slower delivery of time-sensitive cardiac care, a reminder that remediation carries operational costs of its own. For an insurer, similar friction appears in stricter access controls and new verification steps that members, providers and employees must navigate.

Impacts on Other Blue Plans

The breach also reached people who had never chosen Anthem. Anthem's notices went also to people insured by independent Blue plans elsewhere, because their claims had been routed through Anthem when they were treated in its territory. Their own insurers had to field calls, explain why a company they had no contract with had held their data and decide whether to offer additional protection. For those plans, the impact was a loss of control: their members' trust depended on another company's security, and the shared processing arrangement that made nationwide coverage convenient also made one company's failure everyone's problem.

Reputation and Oversight

The breach attached Anthem's name to the largest health data breach then on record, a fact repeated in news coverage and in every later discussion of health care cybersecurity. The corrective action plan and settlement commitments placed Anthem's security practices under outside monitoring for years. In 2022 the company changed its corporate name to Elevance Health, although the Anthem brand remains on its health plans, so the breach's association with the name has not disappeared.

What the Impacts Mean for Hospitals

Although Anthem is an insurer, its experience matters to hospital health information departments like the one where I work. The regulatory findings behind the $16 million settlement, especially the absence of an enterprise-wide risk analysis and weak monitoring of system activity, are the same findings that appear in enforcement actions against hospitals. The litigation research suggests that the size of a breach and the type of data exposed drive legal exposure more than the organization's intentions. And the remediation research shows that security changes made in a hurry after a breach can slow care. A hospital that invests before a breach avoids both the penalties and the rushed fixes.

Weighing the Impacts

The public settlements total $170.5 million, a large sum that is nonetheless a small share of the company's annual revenue, and the full cost of response and remediation is larger but unknown. The nonfinancial impacts are more lasting. The people harmed most, members whose permanent identifiers were taken, received the least lasting protection. This imbalance between who pays and who is harmed is the ethical center of the case and the starting point for Milestone Three.

References

Choi, S. J., Johnson, M. E., & Lehmann, C. U. (2019). Data breach remediation efforts and their implications for hospital quality. Health Services Research, 54(5), 971-980. https://doi.org/10.1111/1475-6773.13203

Jiang, J. X., & Bai, G. (2020). Types of information compromised in breaches of protected health information. Annals of Internal Medicine, 172(2), 159-160. https://doi.org/10.7326/M19-1759

Romanosky, S., Hoffman, D. A., & Acquisti, A. (2014). Empirical analysis of data breach litigation. Journal of Empirical Legal Studies, 11(1), 74-104. https://doi.org/10.1111/jels.12035