Anthem Data Breach: The $16 Million HIPAA Settlement

The U.S. health regulator called it the largest health data breach in history.

By Siddharth ShankarUpdated October 23, 2026

Health insurers hold some of the most sensitive records there are. When one of them is attacked, the consequences can last longer than those of a stolen card number. This guide explains what the U.S. government said about the Anthem case.

What HHS announced

The U.S. Department of Health and Human Services, through its Office for Civil Rights (OCR), published a page titled “Anthem pays OCR $16 Million in record HIPAA settlement following largest health data breach in history”, dated October 15, 2018. The settlement amount was $16 million. HHS said the breach affected almost 79 million people.

What the settlement was about

HHS states that the settlement addressed potential violations of the HIPAA Privacy and Security Rules following a series of cyberattacks on Anthem. It describes the exposed information as electronic protected health information, usually shortened to ePHI. Anthem also agreed to take substantial corrective action. The page links to a resolution agreement for the detail, but the summary itself does not list the measures.

What we can and cannot say

The HHS summary does not describe how the attack began, and it does not list which data fields were taken. We therefore do not guess. If you were an Anthem member, the notice you received at the time is the best record of what applied to you.

Why health data is different

Health records link your name to your insurer, member number and care history. Criminals can use that kind of information to claim treatment or benefits in your name, which is called medical identity theft. Unlike a card, a medical history cannot be cancelled and reissued. Read our guide on medical identity theft signs and what to do.

What HIPAA does and does not do

HIPAA sets rules for how covered health plans and providers protect health information and gives you rights over your records. The Office for Civil Rights enforces those rules, and this settlement is an example of that enforcement. A settlement does not return your data. It changes what the company must do afterwards. You can still use your own rights, and our guide to the HIPAA right of access explains how to get a copy of your records.

What to do after a health data breach

1. Read the notice carefully. Check what types of information were involved for you, and keep the letter.
2. Review your insurer statements. Look at every explanation of benefits for services you did not receive.
3. Ask for your records. If you suspect misuse, request a copy of your records from your provider and insurer and check them for entries that are not yours.
4. Watch your credit. Get your reports and look for accounts you do not recognise. See credit freeze vs fraud alert.
5. Be wary of follow-up scams. Criminals know that breach notices create worry. Learn how to tell a real breach notice from phishing.
6. If your identity is misused, follow the steps in what to do if your identity is stolen.

How this compares with other health breaches

Large health incidents are not unique to one country. Compare this case with the Change Healthcare breach and the LifeLabs findings in Canada. For wider context see our data breach statistics.

A note on old breaches

This incident was announced in 2018, and a record can stay useful to criminals for years. If you were affected, treat monitoring as a long habit rather than a one-off task.