UnitedHealth Group unitedhealthgroup.com UnitedHealth data breach 2018: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In a case HHS lists as added in March 2018, an employee of a UnitedHealth Group business associate mailed the health information of 896 people to the wrong recipients. HHS counts 1,755 affected in total. Names, dates of birth, medical and insurance details were involved.
View all 13,118 breaches- Breach date
- 15 Mar 2018
- Made public
- 15 Mar 2018
- Affected
- 1,755
- Data exposed
- Names, Dates of birth, Medical information, Financial information, Health insurance information
- Last updated
What happened
UnitedHealth Group reported to the U.S. Department of Health and Human Services that an employee of one of its business associates mistakenly mailed the protected health information of 896 individuals to the wrong recipients. HHS's public breach portal lists the case as affecting 1,755 people in total and shows it as added in March 2018. This was a mailing error, not a hack.
What was exposed
HHS's case description says the information included names, dates of birth, medical information, and financial and health insurance information.
What that lets criminals do
Health insurance details and dates of birth are enough to commit medical identity theft, where someone uses your coverage to get care or file claims. Financial details add the risk of fraud against your accounts. In this case the information went to the wrong recipients by mail, so the risk depends on who received it.
The response
According to HHS, UnitedHealth Group notified HHS and the affected individuals and offered complimentary credit monitoring. The business associate added technical safeguards and retrained its staff on protecting health information.
Sources checked: ocrportal.hhs.gov
Last verified against the official page:
What to do if you were in it
- 1
Check your explanation of benefits
Look for claims or services you don't recognize and report them to your insurer.
- 2
Use the free credit monitoring if you were offered it
The notice letter explains how to enroll.
- 3
Freeze your credit if financial details were involved
A free freeze at Equifax, Experian and TransUnion blocks new accounts in your name.
- 4
Be wary of calls about your coverage
Don't share insurance or bank details with anyone who contacts you first.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about it before a scammer uses it.
Official filings
- U.S. Department of Health and Human Services , filed 15 Mar 2018 : 1,755 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected?
Affected people were notified by UnitedHealth Group. HHS lists 1,755 individuals.
What was exposed?
Per HHS: names, dates of birth, medical information, and financial and health insurance information.
Was this a hack?
No. HHS describes a mailing error by an employee of a business associate.
Sources
- U.S. Department of Health & Human Services · ocrportal.hhs.gov
Something wrong or out of date? Tell us and we'll re-check it.
