Feeds

Health Net's missing drive could cost it millions

Connecticut HIPAA lawsuit over lost records

Choosing a cloud hosting partner with confidence

US healthcare corporation Health Net kept quiet for 6 months about a lost disk drive, exposing 1.5 million of its members to identity theft. It is now being sued.

The law suit, filed by Connecticut's Attorney General, Richard Blumenthal, is in regard of 466,000 members in that state and refers to HIPAA regulations.

Health Net has annual revenues of $15.4bn and its "health plans and government contracts subsidiaries provide health benefits to more than 6 million individuals across the [States] through group, individual, Medicare, Medicaid and TRICARE and Veterans Affairs programs."

HIPAA is the Health Insurance Portability and Accountability Act of 1996. Part of it refers to national US standards for electronic health care transactions and individual's privacy for businesses such as Health Net. It defines many healthcare-related offences with civil and criminal penalties.

That's the background. In November 2009 Health Net reported to the authorities in four states that a portable disk drive had gone astray from its Shelton, Connecticut, office. It was an identity theft goldmine, containing fulsome information on 1.5m people. Unfortunately for the corporation, and in an example of an awesomely dumb thing to do, it had lost the drive in May - six months before - but had told no-one.

It gets worse. The data was not encrypted and there was lots of it. The disk contained 120 or more document types, such as medical records and claim forms, amounting to 27.7 million scanned pages in total.

The first thing Health Net did after the loss was to hire Kroll, a forensic computer firm, to look into it. Kroll subsequently revealed the lack of encryption. Health Net said the data could only be viewed with specific software, but unfortunately that software was commonly available.

After the November revelation, Connecticut authorities digested it and Blumenthal filed the law suit (pdf) last week. Blumenthal wants the court to tell Health Net to behave properly, according to HIPAA rules, encrypt all its health data on portable drives, pay damages to affected members and a fine to the state.

A released quote of his says: "The staggering scope of the data loss, and deliberate delay in disclosure, are legally actionable and ethically unacceptable... Protected private medical records and financial information on almost a half million Health Net enrollees in Connecticut were exposed for at least six months - most likely by thieves - before Health Net notified appropriate authorities and consumers."

Health Net issued a statement following the law suit's January 13th filing, saying: "Health Net's company policy states that data must be encrypted and secured."

This implies that an employee broke company rules and is effectively a guilty plea. There was no evidence that the data has been misused. Health Net is offering "two years of free credit monitoring services for all impacted members... This service also includes $1 million of identity theft insurance coverage and enrolment in fraud resolution services for two years, if needed. Additionally, if members experience any identity theft between May 2009 and the data of their enrolment, Health Net will provide services to restore the member's identity at no cost to the member."

That seems pretty good, albeit belated. Watching supposedly responsible corporations and government agencies deal with portable disk drives is like watching unsupervised children with fireworks and matches. They just go right ahead and blow themselves up and then try to hide the damage. Health Net 'fessed up and came up with its damage limitation scheme pretty promptly after the Connecticut filing, but only after that filing.

The three other affected states could now jump on the lawsuit bandwagon, and Health Net could still face tens of millions of dollars in penalties. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
Driving with an Apple Watch could land you with a £100 FINE
Bad news for tech-addicted fanbois behind the wheel
Phones 4u website DIES as wounded mobe retailer struggles to stay above water
Founder blames 'ruthless network partners' for implosion
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Special pleading against mass surveillance won't help anyone
Protecting journalists alone won't protect their sources
Big Content Australia just blew a big hole in its credibility
AHEDA's research on average content prices did not expose methodology, so appears less than rigourous
Vodafone to buy 140 Phones 4u stores from stricken retailer
887 jobs 'preserved' in the process, says administrator PwC
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.