Anthem Inc. — $16M HIPAA fine (2018)

Largest HIPAA settlement in history — 78.8M records breached

What happened

A spear-phishing email compromised an Anthem subsidiary, exposing names, DOBs, SSNs, medical IDs, addresses, employment info, and income data for 78.8M individuals. OCR settled with Anthem for $16M plus a corrective action plan — and a separate civil class action settled for ~$115M.

Root cause

• Phishing reached privileged account with no MFA
• Insufficient enterprise-wide risk analysis (45 CFR §164.308(a)(1)(ii)(A))
• Insufficient procedures to review information system activity (§164.308(a)(1)(ii)(D))
• Failed to identify and respond to suspected security incidents

What every team should do

1. Conduct + DOCUMENT a recurring, signed enterprise risk analysis — the #1 OCR audit finding
2. Enforce phishing-resistant MFA on every account with PHI access (FIDO2/WebAuthn)
3. Enable SIEM with playbooks for suspected incidents — Security Rule §164.308(a)(6)
4. Annual workforce phishing simulations + remediation training

Related enforcement actions