"The Conduent incident is one of the largest reported health care data breaches in U.S. history and appears to have involved sensitive personal and protected health information. Even when a breach occurs at a third-party subcontractor, the employers' health plans may still have obligations under HIPAA. Because of the significant potential penalties for failure to report a breach, it is important to for employers with self-funded group health plans to take prompt steps to assess whether the plan's data has been affected and whether any obligations have been triggered for the plan."  MORE >>