Note: This website, sponsored by Steve Anderson, provides business leaders with the information they need to identify, prioritize, and mitigate their vulnerabilities in the event private client information is breached. Click the About link to the right to read more detailed information about Steve and this site. |
BCBS of Tennessee Client Data Breach
My health insurance is with BCBS of Tennessee. For a couple of months now I have been receiving updates because of a Client data breach they experiences last October. Following is a copy of the official information.
“In October 2009, 57 hard drives containing video and audio files related to coordination of care and eligibility telephone calls from providers and members were stolen from a leased facility in Chattanooga, Tenn. that formerly housed a BlueCross BlueShield of Tennessee call center. The video files were images from computer screens of BlueCross BlueShield of Tennessee customer service representatives and the audio files were recorded phone conversations from January 1, 2007 to October 2, 2009.
“Almost immediately, BlueCross BlueShield of Tennessee began communicating to brokers and employers of this incident and has been providing periodic updates as more information became available. Additionally, BlueCross BlueShield of Tennessee has been diligently reviewing and analyzing the backup files of the stolen hard drives. Since early December, nearly 200,000 active and former members have been identified on those files and notified that certain personal information was included on the stolen hard drives.
“As of January 4, 2010, we have completed the audit of the 1.3 million audio files and 300,000 video files and will now begin a broad communications effort to members, brokers and employers. Part of this comprehensive communications effort will include a progress report delivered via email every two weeks to brokers and group administrators. This report will include details of total affected members and our notification and remediation steps. We will continue to post regular updates to our Web site, bcbst.com – including a special Eastgate Hard Drive Theft page – along with a FAQ section to assist in providing answers to many questions we have received over the past few weeks.
“We will also be providing more detail on the steps BlueCross BlueShield of Tennessee has taken to identify and protect the personal data of affected members. Beginning with the member notification letters generated the week of January 11, 2010, information will be included regarding the discovery of the theft of the hard drives and BlueCross BlueShield of Tennessee’s response to that incident. Additionally, BlueCross BlueShield of Tennessee members that are classified as minors will be receiving a specific notification letter addressed to their parent or guardian and offering LifeLock Identity Alert™ services (see attached). Letters to current and former BlueCross BlueShield of Tennessee groups explaining these changes will be sent the week of January 11, 2010.
“BlueCross BlueShield of Tennessee is committed to delivering up-to-date and relevant communications to its clients – members, brokers and employers – as information becomes available.”
This organization had to pay for someone to review 1.3 million audio and 300,000 video files. They also have mailed letters to all the potentially affected members. All because some hard drivers were stolen. Another reason to make sure your physical security will protect client information from being compromised because of a burglary.
What is your organization doing to enhance your physical security?
Farmers Insurance Agent Hires Hacker
In a statement to the Channel 4 I-Team (local Nashville TV Station WSMV), Farmers Insurance Company said a former insurance agent of theirs may have accessed private client information, and it is in the process of notifying potentially affected customers.
Allegedly a local ISP provider was contracted by a former Farmers agent to exploit a flaw on the Farmers web site that allowed someone to extract all the information from its database, such as insurance policies, names, addresses and Social Security numbers. Because of this client information security breach, Farmers contacted the Secret Service which investigates cyber crime, which is investigating this incident.
Read the full story by clicking this link: http://www.wsmv.com/news/21715549/detail.html
There are at least two lessons to learn from this incident.
First, it is vitally important that every company perform an information security audit to make sure they identify (and correct) as many of the possible client information security problems and holes as possible. Having performed an audit will also help an organization defend itself against the consequences of a data breach.
Second, every company regardless of size needs to have a client security breach plan in place. It is alleged that Farmers Insurance was notified by the ISP provider that they had a potential client information breach, but did not take steps to determine the extent of the breach until Channel 4 started to investigate.
Anderson Issues Report Protecting Agencies from Data Breaches
Client Data Security
NASHVILLE, Tenn. (January 6, 2010)—“Information is the most radioactive element in today’s businesses,” says Steve Anderson of The Anderson Agency Report in his most recent business guide for independent insurance agencies, called Client Information Security.
Anderson’s report highlights that more than 88% of client data breach cases last year involved employee negligence and that 84% of cases involved organizations with more than one incident. The average, total, per-incident cost of a breach was nearly $6.7 million, including civil and regulatory penalties, administrative expenses and legal defense costs.
Insurance agencies of all sizes are treasure troves of personal client data, and they need to establish effective protective barriers and appropriate responses in case there is a breach. Client Information Security provides agency leaders with the information they need to identify and prioritize their vulnerabilities.
The report provides a walk through the agency’s “weak links,” including employee malpractices and negligence, theft of equipment, and external attacks, such as hacking. It aids the agency in categorizing what data to protect and gives more than 20 detailed steps on how to get a data-breach security plan up and running. Anderson provides a convenient, at-a-glance method for classifying risks and incidents in a graphic depiction that can be used to track, analyze and document compliance with a security plan.
Anderson gives insights into surprising areas of vulnerability, such as the problem of “reverse shredding” of documents, and how to foil hardcopy data thieves. He also goes into substantial detail on dealing with an incident from original, internal discovery to notification of authorities, gathering of evidence, damage control and corrective action.
Client Information Security goes beyond treatment of personal data, addressing corporate data held at agencies as well. It not only helps the agency with its data but makes agency members smarter about risk management and insurance resources for their own clients. Security breach laws are covered in their own section, and a state-by-state summary and “further resources” section round out the comprehensive report. To find out more or order a copy, visit http://www.ClientInformationSecurity.com/.
The report can be purchased at www.ClientDataSecurity.com.
About Anderson: Based in Nashville, Tenn., Steve Anderson (www.SteveAnderson.com) is one of the insurance industry’s top consultants and speakers. He delivers keynote addresses, lectures, seminars and conference programs, in addition to individual agency consultations, helping clients maximize productivity and profits by smart use of technology. He is executive editor of The Anderson Agency Report (TAAR), a monthly newsletter dedicated to providing independent agents with the technology information they need to more effectively manage and grow their agencies. In addition to being a licensed independent agent for more than 30 years, Steve has a master’s in Insurance Law.
Settlement for Countrywide Financial ID Theft Victims Advanced
A federal judge in Kentucky has given preliminary approval to a settlement between Countrywide Financial Corp., and millions of customers whose detailed financial information was exposed in a security breach.
See the full story at InsuranceJournal.com
http://www.insurancejournal.com/news/national/2009/12/28/106227.htm
Countrywide (and Bank of America, its new owner) are finding out how expensive a client data security breach can be.
Does your organization have a client information security plan in place?
The Number-One Way Criminals Steal Your Identity
Identity fraud increased substantially in 2008, reversing a four-year trend of decreasing incidents. Researchers say identity fraud increased by 22% last year and they anticipate another 22% jump in 2009, attributing the increases to crimes of opportunity driven by the economic downturn. What’s more, despite recent headlines and growing fears about online security and data breaches, old-fashioned theft is the most popular way thieves steal identities and perpetrate identity fraud.
According to 2008 claim data compiled by Travelers, burglary and theft of wallets, purses, and personal computers provide thieves the best opportunity to gain access to personal information. In instances where the victim knew their identity had been stolen, it was the result of personal property being stolen nearly 78% of the time. Travelers identifies the following as the top known causes of identity fraud:
- 78%—burglary and theft of wallet/purse/personal identification/computer
- 14%—online or data breach
- >5%—change of address/postal fraud
- 3%—lost credit card and other miscellaneous causes
More than 75% of the time, criminals use stolen information to open new credit card accounts or use the existing credit cards to make charges. Twenty percent of identity thieves will withdraw money from existing checking, savings, and online accounts and 16% open utility accounts in the victim’s name.
Steps you can take to protect your identity include guarding Social Security numbers and financial information and shredding documents such as receipts, credit/insurance applications, and bank statements.
Travelers Identity Fraud Expense Coverage is available as an endorsement on their homeowner’s policy for $25 annually and offers protection up to $25,000 with no deductible. Check with the companies you represent to see what coverage is available. This coverage is a great opportunity to educate your clients and offer them broader coverage for a small premium.
Protect Client Information
On September 1, 2009, Portland insurance agent Robert Spruill of Brooke Auto Insurance consented to a Cease and Desist order from the Oregon Department of Insurance. Spruill had not properly disposed of business records that contained sensitive client information.
According to the order, “On or before April 28, 2009, Spruill discarded over 1,000 insurance business records and/or other documents related to insurance transactions of Brooke Auto and Brooke Corporation into an unlocked garbage dumpster.”
“At the time he discarded the documents, Spruill had not developed reasonable safeguards to protect the security, confidentiality, and integrity of the personal information or data collected or acquired in the course of conducting his business, including disposal of that data.”
In his defense Spruill said that when he inquired of local police and the state of Oregon insurance division back in the fall of 2008, no one told him that discarding these records was wrong. Spruill was hit with an $11,000 fine. Fortunately for Spruill, $8,500 of that fine was suspended as long as he complied with the requirement of creating and implementing a client security policy for his agency.
It may seem obvious that you should never discard unshredded documents into an open and unlocked dumpster at the back of your office. Still, don’t be too smug. Do your producers have unencrypted laptops that are left in locked cars that could be stolen? Could employees take home files with sensitive client information in them even though doing so is against company policy?
Sensitive client information is the most radioactive element in today’s agencies. If leaked, it can cause serious repercussions to an agency’s reputation and brand, loss of revenues, loss of customers, regulatory or legal action, and damage to employee relationships. In the last 10 years, the need for client information security to be integrated into the overall risk management of every organization across the globe has increased tremendously.
The insurance industry deals with sensitive and personal client information. Client records contain data that include financial information, medical histories, birth dates, driver’s license numbers, and Social Security numbers. Such confidential data has to be protected at all times—during storage, access, transmission, and destruction—or the organization risks serious losses.
More than 88% of all data breach cases involve employee negligence. In 2008, data breach and information breach incidents cost U.S. companies $202 per compromised customer record. These costs include civil and regulatory penalties, administrative expenses, legal liability, defense costs, and cost of future business due to loss of customer confidence. Not only that, according to Factiva, a Dow Jones company, media coverage of companies that suffered an information security breach accounted for more than half the stories written about those companies.
Seventy percent of customers state they would consider moving their business if they became victims of a data breach. Clients today expect strong security practices from all companies they do business with. The way a business copes with these expectations decides whether the company survives or not.
Client information security should be a concern for every agency, regardless of size. Check out The Anderson Report on Client Data Security for some tools to help you start or enhance your security process.
Protect Your Organization from the Consequences of a Data Security Breach
Trust me: you don't want your agency to be the victim of a hacker, or a thief that steals your private client information. The consequences of not properly protecting your client's private information are difficult at best and at worst could be catastrophic to your organization.
Here's just one example, in one state. On September 22, 2009, an insurance agency in Oregon was fined $11,000 by the State of Oregon Insurance Division for not properly disposing of private client data.
In How to Protect Your Agency from the Consequences of a Client Information Security Breach, I share the foundational information and specific steps you need to know in order to protect your agency. I show you exactly what it takes — step by step — to make sure you properly protect your client information.
Specifically, I reveal how to:
- Understand exactly what will happen if client data is compromised in your agency. Determine what data needs protection.
- Use the C-I-A criteria to classify information based on its confidentiality value.
- Create a data security plan.
- Take the 7 simple but essential steps to protect client data.
- Create scaled-down information storage so you only keep what you really need.
- Complete an information risk assessment to find out where your agency stands.
- Formulate policies and procedures that can be relied upon immediately if a breach should occur.
- Take the appropriate but often overlooked steps to physically secure your premises.
- Properly dispose of sensitive data after your need to use it expires.
- Conform to the reporting requirements mandated by state law if a data breach occurs.
- Evaluate the responsibility of third-party providers who use private client information.
- Examine insurance policies to determine what is covered and what is not covered in the event of a data security breach (in this case, not knowing could be your greatest nightmare).
In addition, How to Protect Your Agency from the Consequences of a Client Information Security Breach contains an executive summary of the 45 state laws along with a link to the actual state statute. A separate section contains application and sample policy information from many of the insurance companies that currently provide an insurance policy that provides coverage for a client data security breach. These two sections alone will save you hours of time spent researching these details.
Some colleagues suggested that I should charge $400-500 for How to Protect Your Agency from the Consequences of a Client Information Security Breach — not based on the page count (even though it is over 80 pages long) — but on the specialized information it contains and how much time and money it will save your agency in setting up an effective Client Data Security Program. "It's a minuscule investment," they argued, "compared to the results it produces."
However, I decided to offer this one of a kind special report for just $199. I may raise the price later, but for right now, I would rather make this timely and critical information available to as many agencies as possible at an affordable price.
My Money-Back Guarantee: If you don't find How to Protect Your Agency from the Consequences of a Data Security Breach helpful and worth every penny you paid for it, I will promptly refund your money. No questions asked.
Could you find similar information for free on the Internet? Yes, possibly. You could likely distill it from multiple sources on the topic after spending innumerable hours researching for trustworthy information. But why wade through all of that? What's your time worth? I have already done the heavy lifting for you. Your time is better spent doing those things that only you can provide for your agency.
I have done the research and come up with solutions that you can implement immediately. If my experience is worth $199 to you, then Click on the button below and let's get started!
Data Backup & Recovery
Pages
Latest Release
Categories
- Client Data Breach
- Client Information Security
- Insurance
- Insurance Agent Breach
- Live Interviews
- Products
Blogroll
- Chris Christian's Professional Liability Tidbits
- Office of Inadequate Security
- Privacy Rights Clearinghouse
- Steve Anderson – Insurance technology Authority
- Womble Carlyle – Privacy and Data Protection
