A Clover Health July data breach affected 138,677 people, according to a notice filed with HHS’ Office for Civil Rights.
Clover flagged the incident to the Securities and Exchange Commission on July 17 after first learning of unauthorized activity on July 4. The Office for Civil Rights listed the Clover incident as a HIPAA case under investigation. As of June 30, Clover’s Medicare Advantage membership was 157,309.
Clover told Becker’s that from July 3-4, an unauthorized party gained access to three employee accounts and the data those accounts could reach. The company said it immediately launched incident response procedures, raised an investigation and terminated that activity within hours of learning about the situation.
Clover’s investigation found the unauthorized party may have accessed or obtained files with some personal information, which varied by individual. This information usually included patient names, birth dates, account identification numbers and insurance identifiers, such as subscriber numbers. The information for a smaller subset of people included other data, such as service dates, provider names and other healthcare-related details. The data in fewer than 70 cases included government identifiers, such as Social Security numbers.
Clover said it suspended and secured affected accounts and worked with a forensic cybersecurity firm to verify systems security. The company also alerted law enforcement.
“We are reviewing our information security policies and evaluating additional training and controls to help reduce the risk of a similar incident occurring in the future,” Clover said in a statement shared with Becker’s on Oct. 1.
The insurer also encouraged individuals to watch for signs of fraud or identity theft.
Clover has faced litigation in the wake of the breach. Lawsuits filed in a Tennessee federal court have since been consolidated. The insurer said it does not comment on ongoing litigation.
At the Becker's 5th Annual Fall Payer Issues Roundtable, taking place November 2–3 in Chicago, payer executives and healthcare leaders will come together to discuss value-based care, regulatory changes, cost management strategies and innovations shaping the future of payer-provider collaboration. Apply for complimentary registration now.
