HealthEquity Data Breach Exposes Protected Health Information of Customers

HealthEquity Data Breach Exposes Protected Health Information of Customers
Image credit: Health Equity 

On Tuesday, health tech services provider HealthEquity revealed a data breach in a federal filing, indicating hackers stole some customers' "protected health information." The company detected the breach on March 25 and took immediate action, resolving the issue and beginning an extensive forensic investigation that concluded on June 10.

In an 8-K filing with the SEC, HealthEquity explained that the breach occurred due to "anomalous behavior" from a personal use device belonging to a business partner, whose compromised account was used to access members' information. HealthEquity assembled a team of outside and internal experts to investigate and prepare for a response.

On Wednesday, HealthEquity provided more details to TechCrunch, with spokesperson Amy Cerny describing the incident as "isolated" and unrelated to other recent breaches, such as the Change Healthcare breach reported by UnitedHealth CEO Andrew Witty in May, which affected "maybe a third" of Americans. 

The investigation revealed that the compromised third-party vendor account had access to some of HealthEquity’s SharePoint data, a set of Microsoft tools for creating websites and sharing internal information. However, Cerny noted that transactional systems were not impacted. The company has been notifying partners, clients, and members and working with law enforcement and experts to prevent future incidents.

TechCrunch inquired about the specific nature of the stolen information, the number of affected individuals, and the involved partner, but Cerny declined to provide those details. Earlier this year, HealthEquity reported that it administers HSAs and other CDBs for over 15 million accounts in collaboration with employers, benefits advisers, and health and retirement plan providers.