Feeds

Health Net's missing drive could cost it millions

Connecticut HIPAA lawsuit over lost records

The Essential Guide to IT Transformation

US healthcare corporation Health Net kept quiet for 6 months about a lost disk drive, exposing 1.5 million of its members to identity theft. It is now being sued.

The law suit, filed by Connecticut's Attorney General, Richard Blumenthal, is in regard of 466,000 members in that state and refers to HIPAA regulations.

Health Net has annual revenues of $15.4bn and its "health plans and government contracts subsidiaries provide health benefits to more than 6 million individuals across the [States] through group, individual, Medicare, Medicaid and TRICARE and Veterans Affairs programs."

HIPAA is the Health Insurance Portability and Accountability Act of 1996. Part of it refers to national US standards for electronic health care transactions and individual's privacy for businesses such as Health Net. It defines many healthcare-related offences with civil and criminal penalties.

That's the background. In November 2009 Health Net reported to the authorities in four states that a portable disk drive had gone astray from its Shelton, Connecticut, office. It was an identity theft goldmine, containing fulsome information on 1.5m people. Unfortunately for the corporation, and in an example of an awesomely dumb thing to do, it had lost the drive in May - six months before - but had told no-one.

It gets worse. The data was not encrypted and there was lots of it. The disk contained 120 or more document types, such as medical records and claim forms, amounting to 27.7 million scanned pages in total.

The first thing Health Net did after the loss was to hire Kroll, a forensic computer firm, to look into it. Kroll subsequently revealed the lack of encryption. Health Net said the data could only be viewed with specific software, but unfortunately that software was commonly available.

After the November revelation, Connecticut authorities digested it and Blumenthal filed the law suit (pdf) last week. Blumenthal wants the court to tell Health Net to behave properly, according to HIPAA rules, encrypt all its health data on portable drives, pay damages to affected members and a fine to the state.

A released quote of his says: "The staggering scope of the data loss, and deliberate delay in disclosure, are legally actionable and ethically unacceptable... Protected private medical records and financial information on almost a half million Health Net enrollees in Connecticut were exposed for at least six months - most likely by thieves - before Health Net notified appropriate authorities and consumers."

Health Net issued a statement following the law suit's January 13th filing, saying: "Health Net's company policy states that data must be encrypted and secured."

This implies that an employee broke company rules and is effectively a guilty plea. There was no evidence that the data has been misused. Health Net is offering "two years of free credit monitoring services for all impacted members... This service also includes $1 million of identity theft insurance coverage and enrolment in fraud resolution services for two years, if needed. Additionally, if members experience any identity theft between May 2009 and the data of their enrolment, Health Net will provide services to restore the member's identity at no cost to the member."

That seems pretty good, albeit belated. Watching supposedly responsible corporations and government agencies deal with portable disk drives is like watching unsupervised children with fireworks and matches. They just go right ahead and blow themselves up and then try to hide the damage. Health Net 'fessed up and came up with its damage limitation scheme pretty promptly after the Connecticut filing, but only after that filing.

The three other affected states could now jump on the lawsuit bandwagon, and Health Net could still face tens of millions of dollars in penalties. ®

Application security programs and practises

More from The Register

next story
Stick a 4K in them: Super high-res TVs are DONE
4,000 pixels is niche now... Don't say we didn't warn you
BBC goes offline in MASSIVE COCKUP: Stephen Fry partly muzzled
Auntie tight-lipped as major outage rolls on
Philip K Dick 'Nazi alternate reality' story to be made into TV series
Amazon Studios, Ridley Scott firm to produce The Man in the High Castle
iPad? More like iFAD: We reveal why Apple fell into IBM's arms
But never fear fanbois, you're still lapping up iPhones, Macs
Amazon Reveals One Weird Trick: A Loss On Almost $20bn In Sales
Investors really hate it: Share price plunge as growth SLOWS in key AWS division
Bose says today is F*** With Dre Day: Beats sued in patent battle
Music gear giant seeks some of that sweet, sweet Apple pie
There's NOTHING on TV in Europe – American video DOMINATES
Even France's mega subsidies don't stop US content onslaught
You! Pirate! Stop pirating, or we shall admonish you politely. Repeatedly, if necessary
And we shall go about telling people you smell. No, not really
Too many IT conferences to cover? MICROSOFT to the RESCUE!
Yet more word of cuts emerges from Redmond
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.