Academic HealthPlans

United Healthcare Student Resources (UHSR), also operating under the aliases Academic HealthPlans (AHP) and UnitedHealthcare Student Resources, specializes in managing student health insurance programs for educational institutions. The organization functions as a broker, administering health plans on behalf of UnitedHealthcare, with its headquarters based in the United States. Its core services involve handling sensitive personal and health information, including names, contact details, identification numbers, and health claims data, as part of its insurance management operations. The entity’s operational scope includes processing extensive medical claims and coordinating coverage for student populations, positioning it as a intermediary between insurers and academic communities.

The organization has faced significant cybersecurity challenges highlighting its role in managing sensitive data. In May 2023, UHSR experienced a data breach involving the exploitation of a zero-day vulnerability in the MOVEit Transfer software, which allowed unauthorized access to personal and health information, including Social Security numbers for some individuals. A separate phishing attack in August 2020 compromised employee email accounts at Academic HealthPlans, exposing student health data for 2,330 individuals after remaining undetected for nearly a year. Both incidents underscore the organization’s handling of protected health information and its susceptibility to third-party software vulnerabilities and social engineering tactics. Following these breaches, UHSR implemented notification protocols for affected individuals and offered complimentary credit monitoring services, reflecting its incident response measures. The repeated security events demonstrate the entity’s role as a frequent target due to its management of large volumes of sensitive student health records across academic institutions.