Data Privacy,
Data Security,
Healthcare
Healthplex, a UnitedHealth Group Subsidiary, Fined for Lacking MFA on Compromised Email Account
The New York State government has imposed a $2 million penalty on Healthplex, a dental plan administrator under UnitedHealth Group. This fine is a result of failures to implement multifactor authentication (MFA) and address a series of cybersecurity lapses linked to a phishing breach affecting approximately 90,000 individuals. Notably, this marks the second fine against Healthplex related to this breach.
The New York State Department of Financial Services announced the latest enforcement action, indicating that Healthplex failed to adhere to state cybersecurity regulations, specifically by not implementing MFA for Office 365 email access via external browsers.
The recent legal settlement between the state and Healthplex is part of ongoing scrutiny following a December 2023 investigation, during which the New York attorney general previously fined Healthplex $400,000 for similar violations stemming from the same phishing incident.
The breach reportedly began when a Healthplex customer service employee clicked a malicious link in a phishing email, granting cybercriminals access to sensitive consumer data stored in the employee’s email account. The compromised information included non-public details such as names, addresses, birth dates, Social Security numbers, and financial records.
According to state representatives, while Healthplex had MFA in place in its previous email system, the transition to Office 365 earlier in 2021 was not accompanied by full operational compliance for MFA on external web browser access, constituting a violation of state cybersecurity mandates.
The investigation also revealed that Healthplex did not have an adequate data retention policy to manage the storage of emails within Microsoft Outlook, further demonstrating deficiencies in its data management practices.
Adrienne Harris, superintendent of New York’s Department of Financial Services, emphasized that insurance providers are entrusted with highly sensitive personal information. The department’s regulations require such organizations to maintain stringent cybersecurity protocols to protect consumers’ private data.
MFA Shortcomings and Regulatory Action
UnitedHealth Group acquired Healthplex in December 2020, prior to the occurrence of this phishing incident. Similarly, UHG acquired Change Healthcare in 2023, which later experienced a significant ransomware attack in February 2024, highlighting ongoing vulnerabilities in legacy systems lacking MFA.
In response to the scrutiny, a spokesperson for UHG stated that safeguarding member privacy is a priority for Healthplex and acknowledged the resolution reached with state officials. However, UHG has not provided details regarding its approach to transitioning security practices for newly acquired entities.
Apart from the financial penalty, the settlement requires Healthplex to bolster its cybersecurity measures and undergo an audit to ensure compliance with New York cyber regulations regarding MFA. The audit will focus on assessing MFA utilization across Healthplex’s integrated business infrastructure, including Office 365, Azure cloud services, and claims processing systems.
