Bosselman Energy, Inc. Employee Health Benefits Plan Data Breach

On December 29, 2022, Bosselman Energy, Inc. reported a data breach affecting its Employee Health Benefits Plan to the U.S. Department of Health and Human Services Office for Civil Rights. The breach resulted from unauthorized access to the organization's network server, compromising protected health information (PHI) belonging to 735 individuals enrolled in the company's health benefits program. This incident represents a significant cybersecurity event for the Nebraska-based energy company and highlights the ongoing vulnerability of employer-sponsored health benefit systems to network-based attacks.

Company Response

Upon discovery of the unauthorized access to their network server, Bosselman Energy, Inc. initiated an investigation to determine the scope and nature of the breach. The organization worked to identify which individuals were affected and what specific data elements had been compromised. Following standard HIPAA breach notification requirements, the company notified affected individuals of the incident. The formal submission to HHS OCR on December 29, 2022, indicates that the organization completed its investigation and notification process within a reasonable timeframe, though the specific discovery date and initial notification timeline are not detailed in the available breach data.

Specific Details

Network server breaches typically occur through one or more common attack vectors, including exploitation of unpatched software vulnerabilities, weak authentication credentials, phishing attacks targeting employee credentials, or direct network intrusion attempts. When a network server is compromised, threat actors gain access to centralized data repositories that may contain extensive employee health information. The fact that this breach affected a health benefits plan specifically suggests that the compromised server likely housed enrollment data, claims information, and related administrative records. Network-based attacks of this nature often go undetected for extended periods, meaning the actual exposure window may have been longer than the organization initially realized. The investigation phase would have involved forensic analysis to determine entry points, the extent of data access, and whether any data was exfiltrated or merely accessed.

Organizational Context

Bosselman Energy, Inc. is a Nebraska-based energy company that provides employee health benefits to its workforce. As an employer-sponsored health plan administrator, the organization maintains sensitive health information as part of its ordinary business operations. The company's health benefits plan serves as a self-insured or fully-insured arrangement for employees, requiring the maintenance of comprehensive health records, claims data, and enrollment information. Employer health plans are increasingly targeted by cybercriminals because they represent centralized repositories of valuable personal health information combined with financial data. The breach of an employer health plan affects not only current employees but potentially retirees and dependents covered under the plan.

Number of People Affected

The breach impacted 735 individuals who were enrolled in or covered by Bosselman Energy, Inc.'s Employee Health Benefits Plan. This population likely includes active employees, retirees, spouses, and dependent children covered under the plan. The notification requirement under HIPAA's Breach Notification Rule mandated that each affected individual receive written notice of the breach, the types of information compromised, steps the organization was taking to investigate and remediate the incident, and recommended actions for protecting themselves against potential misuse of their information.

Personal Information Involved

While the specific data elements exposed are not detailed in the breach submission, health benefits plan breaches typically compromise multiple categories of protected health information, including:

• Names and contact information (addresses, phone numbers, email addresses)
• Social Security numbers (commonly used as health plan identifiers)
• Health insurance policy numbers and group numbers
• Medical history and diagnosis information (from claims records)
• Prescription medication information (from pharmacy claims)
• Provider names and treatment details (from claims submissions)
• Financial information (copayments, deductibles, out-of-pocket costs)
• Dates of service and healthcare provider information
• Dependent information (names and relationships of covered family members)

The combination of health information with Social Security numbers and financial data creates significant risk for identity theft and medical fraud.

Likely Risks to Patients

Individuals affected by this breach face several categories of risk:

Identity Theft Risk: The likely exposure of Social Security numbers combined with names, addresses, and dates of birth provides threat actors with the core information needed to commit identity theft. Criminals could open fraudulent accounts, apply for credit, or file false tax returns using this information.

Medical Identity Theft: With access to health insurance policy numbers, medical history, and provider information, threat actors could seek medical services under the victim's identity, potentially resulting in fraudulent claims, incorrect medical records, and financial liability for the victim.

Financial Fraud: Exposure of financial information related to health insurance, combined with other personal identifiers, increases the risk of credit card fraud, bank account compromise, and unauthorized financial transactions.

Privacy Violations: The unauthorized access to sensitive health information represents a violation of privacy expectations. Individuals may experience anxiety regarding the exposure of confidential medical information.

Phishing and Social Engineering: Threat actors with access to health plan information may use this data to craft convincing phishing emails or social engineering attacks targeting victims, potentially leading to further compromise of personal accounts and systems.

Long-term Monitoring Burden: Affected individuals must remain vigilant for years following the breach, as stolen health information can be used for fraudulent purposes long after the initial incident.

Recommended Actions for Patients

1. Monitor Credit Reports and Place Fraud Alerts: Obtain free credit reports from all three major credit bureaus (Equifax, Experian, TransUnion) through AnnualCreditReport.com. Review reports carefully for unauthorized accounts or inquiries. Consider placing a fraud alert with each bureau and monitoring credit for at least 12-24 months following the breach notification.

2. Monitor Health Insurance Accounts and Medical Records: Regularly review explanation of benefits (EOB) statements from your health insurance plan for unauthorized claims or services you did not receive. Request copies of your medical records from healthcare providers to verify accuracy and identify any fraudulent entries. Contact your insurance company immediately if you identify suspicious activity.

3. Implement Strong Password Security and Enable Multi-Factor Authentication: Change passwords for health insurance accounts, email accounts, and financial accounts. Use unique, complex passwords for each account. Enable multi-factor authentication (MFA) wherever available, particularly for email and financial accounts, as these are common targets for account takeover following data breaches.

4. Consider Identity Theft Protection Services: Evaluate enrollment in identity theft protection or credit monitoring services, which may be offered by Bosselman Energy at no cost as part of breach remediation. These services can provide early warning of suspicious activity and assist with recovery if identity theft occurs. Additionally, consider placing a credit freeze with the three major credit bureaus to prevent unauthorized account opening.

Industry Context and HIPAA Implications

This breach represents one of thousands of healthcare data breaches reported annually to HHS OCR. According to HHS data, hacking and IT incidents have become the leading cause of healthcare data breaches in recent years, surpassing theft and loss as breach mechanisms. Network server compromises are particularly concerning because they often affect large numbers of individuals simultaneously and may go undetected for extended periods.

Under the HIPAA Breach Notification Rule, covered entities and business associates must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach. Bosselman Energy's December 29, 2022 submission date indicates compliance with this requirement. The organization was also required to notify prominent media outlets if the breach affected more than 500 residents of a state or jurisdiction, and to notify HHS OCR, which it did through this submission.

Employer-sponsored health plans occupy a unique position in the healthcare ecosystem. While they maintain extensive health information, they may not always implement the same level of cybersecurity controls as traditional HIPAA-covered entities such as hospitals or health insurance companies. This can create vulnerabilities that threat actors actively exploit. The incident highlights the importance of strong network security, regular security assessments, employee security training, and incident response planning for all organizations handling health information, regardless of their primary business function.