Feeds

Health Net's missing drive could cost it millions

Connecticut HIPAA lawsuit over lost records

Internet Security Threat Report 2014

US healthcare corporation Health Net kept quiet for 6 months about a lost disk drive, exposing 1.5 million of its members to identity theft. It is now being sued.

The law suit, filed by Connecticut's Attorney General, Richard Blumenthal, is in regard of 466,000 members in that state and refers to HIPAA regulations.

Health Net has annual revenues of $15.4bn and its "health plans and government contracts subsidiaries provide health benefits to more than 6 million individuals across the [States] through group, individual, Medicare, Medicaid and TRICARE and Veterans Affairs programs."

HIPAA is the Health Insurance Portability and Accountability Act of 1996. Part of it refers to national US standards for electronic health care transactions and individual's privacy for businesses such as Health Net. It defines many healthcare-related offences with civil and criminal penalties.

That's the background. In November 2009 Health Net reported to the authorities in four states that a portable disk drive had gone astray from its Shelton, Connecticut, office. It was an identity theft goldmine, containing fulsome information on 1.5m people. Unfortunately for the corporation, and in an example of an awesomely dumb thing to do, it had lost the drive in May - six months before - but had told no-one.

It gets worse. The data was not encrypted and there was lots of it. The disk contained 120 or more document types, such as medical records and claim forms, amounting to 27.7 million scanned pages in total.

The first thing Health Net did after the loss was to hire Kroll, a forensic computer firm, to look into it. Kroll subsequently revealed the lack of encryption. Health Net said the data could only be viewed with specific software, but unfortunately that software was commonly available.

After the November revelation, Connecticut authorities digested it and Blumenthal filed the law suit (pdf) last week. Blumenthal wants the court to tell Health Net to behave properly, according to HIPAA rules, encrypt all its health data on portable drives, pay damages to affected members and a fine to the state.

A released quote of his says: "The staggering scope of the data loss, and deliberate delay in disclosure, are legally actionable and ethically unacceptable... Protected private medical records and financial information on almost a half million Health Net enrollees in Connecticut were exposed for at least six months - most likely by thieves - before Health Net notified appropriate authorities and consumers."

Health Net issued a statement following the law suit's January 13th filing, saying: "Health Net's company policy states that data must be encrypted and secured."

This implies that an employee broke company rules and is effectively a guilty plea. There was no evidence that the data has been misused. Health Net is offering "two years of free credit monitoring services for all impacted members... This service also includes $1 million of identity theft insurance coverage and enrolment in fraud resolution services for two years, if needed. Additionally, if members experience any identity theft between May 2009 and the data of their enrolment, Health Net will provide services to restore the member's identity at no cost to the member."

That seems pretty good, albeit belated. Watching supposedly responsible corporations and government agencies deal with portable disk drives is like watching unsupervised children with fireworks and matches. They just go right ahead and blow themselves up and then try to hide the damage. Health Net 'fessed up and came up with its damage limitation scheme pretty promptly after the Connecticut filing, but only after that filing.

The three other affected states could now jump on the lawsuit bandwagon, and Health Net could still face tens of millions of dollars in penalties. ®

Beginner's guide to SSL certificates

More from The Register

next story
Bono apologises for iTunes album dump
Megalomania, generosity and FEAR of irrelevance drove group to Apple deal
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
Doctor Who's Flatline: Cool monsters, yes, but utterly limp subplots
We know what the Doctor does, stop going on about it already
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
Arab States make play for greater government control of the internet
Nerds told to get lost in last-minute power grab bid at UN meeting
'Cowardly, venomous trolls' threatened with TWO-YEAR sentences for menacing posts
UK government: 'Taking a stand against a baying cyber-mob'
Apple SILENCES Bose, YANKS headphones from stores
The, er, Beats go on after noise-cancelling spat
Zippy one-liners, broken promises: Doctor Who on the Orient Express
Series finally hits stride, but Clara's U-turn is baffling
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.