A Message from Blue Cross Blue Shield of Massachusetts
We're providing this notice about a privacy incident at a vendor company as a courtesy. The protected health information ("PHI") of some Blue Cross Blue Shield of Massachusetts fully insured members who receive health care coverage due to their relationship with you may have been affected.
Command Digital (Command) is a Blue Cross business associate providing printing and communications services. Command uses a subcontractor, Cierant Corporation (Cierant), to manage the creation and distribution of required documents to our members.
On December 10, 2024, Cierant became aware of an unauthorized activity in their secure file transfer tool. Cierant says they took steps to stop the activity and launched an investigation with the assistance of third-party forensic experts. The investigation determined that the unauthorized actor gained limited access to their system. Cierant notified us of this incident on January 20, 2025.
On May 5, 2025, we confirmed our members were affected by this event. Once we received the files from Cierant, we needed to ensure they posed no further risk to our environment. We then analyzed these files, which included a complex data set, to identify the scope of the impact. We've now determined that the following information may have been exposed:
- First and last name
- Address
- Premium cost
No financial information, diagnoses, dates of birth, or Social Security numbers were at risk in this incident.
As the Covered Entity for fully insured plans, we're working with Command and Cierant to ensure all required notifications pursuant to HIPAA and state breach laws are issued to affected individuals and regulators. Additionally, Cierant will offer 12-month credit monitoring services to impacted members. Cierant is also establishing a toll-free call center to answer member questions about the incident and address related concerns.
We sincerely regret this incident. We appreciate your patience and your business as we work to address this incident. |
|