Humboldt Independent Practice Association (Humboldt IPA) has disclosed a data security incident that resulted in unauthorized access to protected health information (PHI). The organization, which administers health plans and healthcare services on behalf of providers, issued a public notice after being unable to contact all affected individuals directly.
While there is no confirmed evidence of data misuse, Humboldt IPA is notifying affected individuals and taking proactive steps to minimize potential risks. Impacted individuals are urged to remain vigilant by monitoring financial statements, updating passwords, and staying alert to phishing attempts. For more information, visit our guide on how to protect your information after a data breach and minimize potential harm.
Humboldt IPA Data Breach Details
According to Humboldt IPA, the breach was traced to a phishing attack that occurred between June 26, 2024, and July 1, 2024. The organization became aware of the cyber threat on June 28, 2024, when an unauthorized actor gained access to a single email account. Following an investigation conducted with external cybersecurity experts, it was determined that sensitive health data was accessed.
Humboldt IPA initially reported the breach to the U.S. Department of Health and Human Services (HHS) on November 11, 2024, using a placeholder figure of 500 for the number of affected patients. However, the only publicly available information from HHS at the time described the incident as a hacking or IT event involving protected health information stored in email.
Confusion Over Reporting Details
In their submission to HHS, Humboldt IPA categorized the incident as one involving a healthcare provider, rather than as a business associate. However, in the substitute notice published on their website on February 7, 2025, they described themselves as a third-party administrator responsible for managing health plans and services on behalf of providers.
According to Humboldt IPA: “Humboldt IPA is a third-party that administers health plans and healthcare services on behalf of providers. As a result, we are issuing this public notice to inform all potentially impacted individuals”. The discrepancy has raised questions about whether the entity’s classification in the breach report accurately reflects their role.