MHA FPX 5014 Assessment 2 Risk Financing

Risk Financing

To: Leadership at Mercy Medical Center

From: Risk Manager

Date: September 2025

To outline the financial risks incurred since 2015 as a result of Anthem Blue Cross Blue Shield’s breach of its HIPAA obligations, we are including the memo in question. Anthem Blue Cross Blue Shield suffered a breach that resulted in the exposure of the health and employment records of 79 million people (Rodrigues et al., 2024). The breach resulted from a combination of insufficient risk assessment and inadequate cybersecurity. The Civil Rights Office settlement amounts to $ 16 million (Moro et al., 2022). This memo outlines the impact of breaches of regulations, ethics, and finances. It identifies risks, remedies, and the restoration of trust to the affected parties.

The Anthem Blue Cross Blue Shield group is the largest provider of private health insurance in the United States (Brennan, 2022). With more than 40 million members in the United States, its headquarters is based in Indianapolis, Indiana, and offers Commercial, Medicaid, and Medicare insurance programs. The primary stakeholders are customers, the supply chain, the Office for Civil Rights (OCR), and the general public. As a result of the 2015 attack, Anthem suffered a breach of 78.8 million people (Duggan et al., 2024) and the loss of a majority of private data. Anthem did not conduct a systematic assessment of risk at the enterprise level. Data protection that complies with HIPAA was also absent. As a result, Anthem suffered significant long-term reputational damage, sustained a loss that diminished its resources, a federal settlement of $16 million, and other financial losses (Velez, 2021).

As a participant in the Accountable Care Organization, Anthem Blue Cross Blue Shield (Anthem) recognizes the needs of patients and clients first. Blue Cross needs to implement measures that adhere to the requirements of HIPAA and HITECH to ensure and safeguard patients’ information. They also need to ensure that they report on any violations that may occur. In 2015, the Office of Civil Rights (OCR) had to step in and oversee and monitor the activities of Anthem, and they also had to make them take corrective action. Patient privacy and patient trust are the pillars of ethical and accountable practices, and they should be the foundation on which all the activities and operations of Anthem are based. There is a growing concern for the organization regarding the increasing number of cyber-attacks, the passing of new privacy laws, such as the California Consumer Privacy Act (CCPA), and the growing number of demands for greater transparency from the organization by the public, as well as regulatory bodies.

The Anthem Data breach is one of the most notable examples of a breach of cybersecurity, which left 78.8 million records compromised due to insufficient safeguards and a contravention of the HIPAA Security Rule. The breach has had adverse effects, including damage to the once spotless reputation of Anthem and a multi-million dollar settlement to be paid by Anthem. The breach resulted from an unmitigated failure of the company to conduct a thorough enterprise risk assessment, identify on-the-spot threats, design an adequate cyber protection framework, coupled with an unacceptable lack of accountability by the ringmasters of the company for the executive failures with respect to the company’s cyber protection.

To progress towards effective threat detection, Anthem must adopt the use of AI in topological applications, provide HIPAA training to all employees, appoint a Chief Information Security Officer (CISO), and strengthen the access control mechanisms (Conduah et al, 2023). Desired effects will occur from more penetration testing, more than once-a-quarter audits, and control assessments. The constraints on all that are the cost of the tools, the anxiety and resistance of employees to new methods, and the balance between risk and processing (Djenna et al, 2023). Nevertheless, it is prudent to adopt them and incur a loss in effect and reputation from the breach.

The first recommendation is the introduction of AI building blocks to provide the first control and to give focus and direction to governance in the concept of the ‘Cao’ (Djenna et al, 2023). The second recommendation is the appointment of a Chief Information Security Officer (CISO), who will provide a ‘hands-on’ control for a longer period. The AI tools potentially provide quick identification and focus on the types of control that governance uses to protect patients’ information. The appointment of a CISO provides long-term control and focus for the types of concerns that governance requires. The recommendations will address the concerns of the 2015 breach and will also be in compliance with the legal and ethical requirements to protect patients’ information (Shaikh & Siponen, 2023). These recommendations will span the technical and leadership gaps for the industry in the long term.

The main objective of the given 12-month timeframe is to accomplish a 60% reduction in reportable data breaches. To achieve this goal, AI tools with real-time monitoring and data breach detection capabilities will be utilized. These tools will be employed to identify potential risks and obstacles to ensure that breaches of the HIPAA Security Rule do not occur. For tracking progress, audit dashboards will be reviewed on a quarterly basis. Research, including that of Shaikh and Siponen (2022), suggests that the use of AI is likely to significantly enhance the detection of data breaches, thereby improving the efficiency of breach response.

Anthem mandates completion of HIPAA and cybersecurity training courses by all its employees. This employee training engagement prerequisite will be enforced through the Learning Management System (LMS), which monitors employee training. The first training module will be launched in six months and will be updated every six months. As training will be designed with interactive elements such as case examples, Kuan et al. (2021) cite that training tailored to the specifics of the position rather than the goal of the organization showed a 40% reduction in violations compared to training that was not as targeted.

The goal is to improve Anthem’s HIPAA compliance audit score by 25% in a year. This improvement will be benchmarked with Anthem’s internal audit tools and OCR reports. The target of this KPI is to increase the effectiveness of the Anthem Risk Management Policy within this timeframe by first synchronizing auditing to the most recent OCR standards and industry standards. Bunting and Klerk (2022) find this situation quite promising and hope that this goal will be reachable since, in the past year, one of the plans to improve auditing has resulted in an increase of 27% in compliance scores.

Anthem has experienced HIPAA violations that have shown some of the worst regulatory compliance and operational control breakdowns, and have significantly affected the company’s financial, legal, and reputational standing. The recommendations that follow, including the appointment of a Chief Information Security Officer (CISO) and the adoption of an AI-based security system, are essential to reduce the impact of these situations. These will enable Anthem to meet its legal and ethical obligations while providing the assurance and confidence needed to further establish the organization as a leader in healthcare risk management.