Premera Blue Cross — $6.85M HIPAA fine (2020)

11M-record breach + risk-analysis + access-controls failures

What happened

An undetected APT compromise from May 2014 to March 2015 exposed ePHI of 11M individuals. OCR's investigation found systemic Security Rule failures: insufficient risk analysis, insufficient risk management, and failures around access controls and audit reviews.

Root cause

• No comprehensive risk analysis covering the breached systems
• Inadequate audit log review — intrusion went undetected ~9 months
• Weak access controls let lateral movement reach ePHI

What every team should do

1. Risk analysis must cover ALL systems that create/receive/maintain/transmit ePHI
2. Centralise + actively review audit logs (Security Rule §164.312(b))
3. Implement least-privilege + Just-In-Time access for production ePHI systems

Related enforcement actions