http://www.wired.com/threatlevel/2009/11/healthnet

Health Insurer Loses 1.5 Mil­lion Patient Records By Kim Zetter Novem­ber 19, 2009

A health insurer lost 1.5 mil­lion patient records last May but waited six months to dis­close the inci­dent. The data, which was stored on a portable disk drive that dis­ap­peared from the insurer’s office, was unen­crypted and included patient Social Secu­rity num­bers, bank account num­bers and health data, accord­ing to the Hart­ford Courant. The disk also con­tained per­sonal infor­ma­tion on at least 5,000 physi­cians. Health Net dis­cov­ered the loss in May but never informed patients, law enforce­ment or gov­ern­ment enti­ties, despite data breach laws in some states that require data spillers to notify vic­tims and state offi­cials when res­i­dents are affected by a breach. The insurer finally sent a let­ter to Connecticut’s attor­ney gen­eral and the state’s Depart­ment of Insur­ance this week.

Health Net claimed it took six months to deter­mine what data was on the miss­ing disk. It said that data on the disk was com­pressed and stored in an image for­mat that required spe­cial soft­ware to view, which was avail­able only to Health­Net. “Another day, another data breach,” said Con­necti­cut Attor­ney Gen­eral Richard Blu­men­thal in a state­ment. “But com­pa­nies still don’t get it: Per­sonal infor­ma­tion is like cash and should be guarded with equal care.” Blu­men­thal vowed to pur­sue an inves­ti­ga­tion and legal action against the insurer. About 450,000 of the patients affected by the data loss are res­i­dents of Con­necti­cut, which has a breach noti­fi­ca­tion law. Patients in Ari­zona, New Jer­sey and New York were also affected.

“My inves­ti­ga­tion will seek to estab­lish what hap­pened and why the com­pany kept its cus­tomers and the state in the dark for so long,” Blu­men­thal told the Hart­ford Busi­ness Jour­nal. “The company’s fail­ure to safe­guard such sen­si­tive infor­ma­tion and inform con­sumers of its loss — leav­ing them naked to iden­tity theft — may have vio­lated state and fed­eral laws. I will vig­or­ously and aggres­sively seek dam­ages, penal­ties and other appro­pri­ate reme­dies, if war­ranted.” On a sep­a­rate note, a sec­ond health insurer mailed 80,000 post­cards to Medicare recip­i­ents last week that listed the patient’s Social Secu­rity num­ber on the front of the card beneath the patient’s name. Uni­ver­sal Amer­i­can Action Net­work, a sub­sidiary of Uni­ver­sal Amer­i­can Insur­ance, blamed the com­pany that printed the cards for the error but didn’t explain why the com­pany had the patient Social Secu­rity num­bers in the first place. The data leak affected patients enrolled in the Med­icate Advan­tage plan, which uses a patient’s Social Secu­rity num­ber as his Medicare account number.

Com­pli­ments of File­Man Research To Sub­scribe to the File­Man Blog click here … http://www.carymcgovern.com/feed/

Best Per­sonal Regards,

Cary