Health Net's missing drive could cost it millions
Connecticut HIPAA lawsuit over lost records
Posted in Management, 19th January 2010 10:11 GMT
Watch Now : Virtual Machine Movement with Hyper-V
US healthcare corporation Health Net kept quiet for 6 months about a lost disk drive, exposing 1.5 million of its members to identity theft. It is now being sued.
The law suit, filed by Connecticut's Attorney General, Richard Blumenthal, is in regard of 466,000 members in that state and refers to HIPAA regulations.
Health Net has annual revenues of $15.4bn and its "health plans and government contracts subsidiaries provide health benefits to more than 6 million individuals across the [States] through group, individual, Medicare, Medicaid and TRICARE and Veterans Affairs programs."
HIPAA is the Health Insurance Portability and Accountability Act of 1996. Part of it refers to national US standards for electronic health care transactions and individual's privacy for businesses such as Health Net. It defines many healthcare-related offences with civil and criminal penalties.
That's the background. In November 2009 Health Net reported to the authorities in four states that a portable disk drive had gone astray from its Shelton, Connecticut, office. It was an identity theft goldmine, containing fulsome information on 1.5m people. Unfortunately for the corporation, and in an example of an awesomely dumb thing to do, it had lost the drive in May - six months before - but had told no-one.
It gets worse. The data was not encrypted and there was lots of it. The disk contained 120 or more document types, such as medical records and claim forms, amounting to 27.7 million scanned pages in total.
The first thing Health Net did after the loss was to hire Kroll, a forensic computer firm, to look into it. Kroll subsequently revealed the lack of encryption. Health Net said the data could only be viewed with specific software, but unfortunately that software was commonly available.
After the November revelation, Connecticut authorities digested it and Blumenthal filed the law suit (pdf) last week. Blumenthal wants the court to tell Health Net to behave properly, according to HIPAA rules, encrypt all its health data on portable drives, pay damages to affected members and a fine to the state.
A released quote of his says: "The staggering scope of the data loss, and deliberate delay in disclosure, are legally actionable and ethically unacceptable... Protected private medical records and financial information on almost a half million Health Net enrollees in Connecticut were exposed for at least six months - most likely by thieves - before Health Net notified appropriate authorities and consumers."
Health Net issued a statement following the law suit's January 13th filing, saying: "Health Net's company policy states that data must be encrypted and secured."
This implies that an employee broke company rules and is effectively a guilty plea. There was no evidence that the data has been misused. Health Net is offering "two years of free credit monitoring services for all impacted members... This service also includes $1 million of identity theft insurance coverage and enrolment in fraud resolution services for two years, if needed. Additionally, if members experience any identity theft between May 2009 and the data of their enrolment, Health Net will provide services to restore the member's identity at no cost to the member."
That seems pretty good, albeit belated. Watching supposedly responsible corporations and government agencies deal with portable disk drives is like watching unsupervised children with fireworks and matches. They just go right ahead and blow themselves up and then try to hide the damage. Health Net 'fessed up and came up with its damage limitation scheme pretty promptly after the Connecticut filing, but only after that filing.
The three other affected states could now jump on the lawsuit bandwagon, and Health Net could still face tens of millions of dollars in penalties. ®
Watch Now : Virtual Machine Movement with Hyper-V
COMMENTS
Software
Health Net said the data could only be viewed with specific software, but unfortunately that software was commonly available.
so that's Adobe Reader then.
They went further
The data was only viewable in specific software..............
So would that be Excel or Access?
The Damages today are violation of HIPPA REGs
Frankly, the loss of so much data ought to bring the corporate death prnalty. The loss was entirely preventable and this type of gross negligence is all too common.
Gut and fillet a few of these entities that are so cavalier with our private information and the rest will get in line for secure data standards.
It is a shame that there is no legal remedy that permits the dissolution of the corporation and a lifetime bar for the corporate officers and directors working in the same field, Regulatory frameworks aren't working: only Draconian measures will get the attention of the IT industry.
Your data is not secure
I can still log into any server at my old employer (a hospital). The NT account had permissions on all the servers (over 150), Citrix remote gateway access and admin rights on all servers. The user name and password are most certainly not complex, single words out of the dictionary with no caps or special characters. The password also never expires and was never changed in the four years I worked there. It would commonly be viewed as a weak password. And this was not some Podunk rural hospital, we were the only level one trauma center in the area and served thousands of patients a day. Your data is most certainly NOT secure and anyone who believes it is fooling themselves. I hate to be the chicken little type but this is just one real world example. When companies only view IT as an expense and don't invest properly in their infrastructure stuff like this happens.
Fail
The need for encrypting data before it leaves the location is common knowledge to any IT jocky (note, I did not use "pro") in the industry. What all is explicitly stated in HIPAA may be unknown to a fair portion, but the general sense is quite obvious: use secure passwords, use encrypted channels of communications, encrypt portable data, etc, etc. This company obviously did not follow such common guidelines, let alone a HIPAA mandate. Also, the only user in an organization that would have need for 1.5mil records is either an IT person, or someone who needed an IT person to get it... (think upper-management or research/development)
Just plain fail.
IT infrastructure monitoring strategies
The new Office Garage series:
Top 10 SIEM implementer’s checklist
