Feeds

Health Net's missing drive could cost it millions

Connecticut HIPAA lawsuit over lost records

Security for virtualized datacentres

US healthcare corporation Health Net kept quiet for 6 months about a lost disk drive, exposing 1.5 million of its members to identity theft. It is now being sued.

The law suit, filed by Connecticut's Attorney General, Richard Blumenthal, is in regard of 466,000 members in that state and refers to HIPAA regulations.

Health Net has annual revenues of $15.4bn and its "health plans and government contracts subsidiaries provide health benefits to more than 6 million individuals across the [States] through group, individual, Medicare, Medicaid and TRICARE and Veterans Affairs programs."

HIPAA is the Health Insurance Portability and Accountability Act of 1996. Part of it refers to national US standards for electronic health care transactions and individual's privacy for businesses such as Health Net. It defines many healthcare-related offences with civil and criminal penalties.

That's the background. In November 2009 Health Net reported to the authorities in four states that a portable disk drive had gone astray from its Shelton, Connecticut, office. It was an identity theft goldmine, containing fulsome information on 1.5m people. Unfortunately for the corporation, and in an example of an awesomely dumb thing to do, it had lost the drive in May - six months before - but had told no-one.

It gets worse. The data was not encrypted and there was lots of it. The disk contained 120 or more document types, such as medical records and claim forms, amounting to 27.7 million scanned pages in total.

The first thing Health Net did after the loss was to hire Kroll, a forensic computer firm, to look into it. Kroll subsequently revealed the lack of encryption. Health Net said the data could only be viewed with specific software, but unfortunately that software was commonly available.

After the November revelation, Connecticut authorities digested it and Blumenthal filed the law suit (pdf) last week. Blumenthal wants the court to tell Health Net to behave properly, according to HIPAA rules, encrypt all its health data on portable drives, pay damages to affected members and a fine to the state.

A released quote of his says: "The staggering scope of the data loss, and deliberate delay in disclosure, are legally actionable and ethically unacceptable... Protected private medical records and financial information on almost a half million Health Net enrollees in Connecticut were exposed for at least six months - most likely by thieves - before Health Net notified appropriate authorities and consumers."

Health Net issued a statement following the law suit's January 13th filing, saying: "Health Net's company policy states that data must be encrypted and secured."

This implies that an employee broke company rules and is effectively a guilty plea. There was no evidence that the data has been misused. Health Net is offering "two years of free credit monitoring services for all impacted members... This service also includes $1 million of identity theft insurance coverage and enrolment in fraud resolution services for two years, if needed. Additionally, if members experience any identity theft between May 2009 and the data of their enrolment, Health Net will provide services to restore the member's identity at no cost to the member."

That seems pretty good, albeit belated. Watching supposedly responsible corporations and government agencies deal with portable disk drives is like watching unsupervised children with fireworks and matches. They just go right ahead and blow themselves up and then try to hide the damage. Health Net 'fessed up and came up with its damage limitation scheme pretty promptly after the Connecticut filing, but only after that filing.

The three other affected states could now jump on the lawsuit bandwagon, and Health Net could still face tens of millions of dollars in penalties. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
Apple CEO Tim Cook: TV is TERRIBLE and stuck in the 1970s
The iKing thinks telly is far too fiddly and ugly – basically, iTunes
Huawei ditches new Windows Phone mobe plans, blames poor sales
Giganto mobe firm slams door shut on Microsoft. OH DEAR
Phones 4u website DIES as wounded mobe retailer struggles to stay above water
Founder blames 'ruthless network partners' for implosion
Found inside ISIS terror chap's laptop: CELINE DION tunes
REPORT: Stash of terrorist material found in Syria Dell box
Show us your Five-Eyes SECRETS says Privacy International
Refusal to disclose GCHQ canteen menus and prices triggers Euro Human Rights Court action
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.