Client Information Security Helping Organizations Protect Private Client Data

A New Era in HIPAA Enforcement Has Begun

Connecticut AG files First HITECH Act Law Suit

In the first lawsuit to invoke the new provisions of the HITECH Act, Connecticut Attorney General Richard Blumenthal filed a lawsuit against Health Net for violating HIPAA requirements. Here is the actual complaint: CT Complaint Against HealthNet

The lawsuit was filed on January 13, 2010 and was described in a statement “Sadly . . . historic.” The suit alleges that Health Net failed to secure private patient medical records and financial information involving hundreds of thousands of Connecticut enrollees and promptly notify consumers endangered by the security breach.  This case is the first action by a state attorney general under the Health Information Technology for Economic and Clinical Health (“HITECH”) Act to enforce provisions of the Health Insurance Portability and Accountability Act (“HIPAA”).  The suit also alleges a violation of Connecticut’s breach notification statute.

On or about May 14, 2009 Health Net learned that a portable disk drive had disappeared from one of its offices.  The disk contained unencrypted protected health information, social security numbers and bank account numbers for approximately 1.5 million past and present enrollees, including 446,000 Connecticut residents.  Health Net did not begin notifying affected individuals until November 2009.

Is this the first sign of the fines/lawsuits organizations will face in the future?

• Have you implemented new policies and procedures to ensure compliance with the HITECH requirements?
• Have you trained all employees on new requirements?
• Do you have tracking and documentation of employee acknowledgements and understanding?
• Have you implemented ongoing awareness training as risks, threats and best practices are constantly changing?

What have you done to inform your clients of the risks they also face and offered them data breach insurance coverage?

Blue Cross Eastgate Hard Drive Theft Update

During the past two weeks, significant progress has been made in BlueCross BlueShield of Tennessee’s continuing auditing, identifying and notification efforts of members affected by the Eastgate hard drive theft.

As of January 19, 2010, 220,000 current and former members have been identified and 211,253 notifications have been sent to members indicating that their personal information was included on the stolen hard drives and have been offered remediation services, including credit monitoring and identity theft protection.  These members, which fall in the Tier 3 category, have been confirmed as having their name, address, BlueCross member ID number, diagnosis, Social Security number and/or date of birth included in the stolen hard drives.  Additionally, minors whose personal information has been identified in the Tier 3 category have begun to receive letters offering LifeLock® identity services.

BlueCross has confirmed that 20,940 members have contacted Equifax to initiate the free 3-in-1 credit monitoring service offered to those members in the Tier 3 category.  Also, two members have contacted Kroll regarding activation of its Enhanced Identity Theft Consultation and Restoration services.  However, as of January 19, 2010, there has been no documented incident of identity theft or credit fraud of BlueCross members as a result of this incident. 

Beginning in early February, members falling in the Tier 2 category of personal information (name, address, BlueCross member ID number and diagnosis) will begin to receive their notifications with details of the hard drive theft and remediation services offered to them. 

Below is a graphical representation of total members identified and notifications sent as of January 19, 2010.  If you are unable to view this image, you can go to the Eastgate Hard Drive Theft page of bcbst.com to view this statistic and other information related to our identification and notification efforts.

While this theft has received significant coverage in many Tennessee news and media outlets, our auditing and notification process has received favorable reviews from IT-related online publications and blogs.  BlueCross has been lauded for its open and frequent communications, as well as engaging a leader in data security, Kroll, in assisting with its file audit and remediation efforts.

BlueCross BlueShield of Tennessee is committed to delivering up-to-date and relevant communications to its clients – members, brokers and employers – as information becomes available.  As always, you can direct questions specific to this incident to the BlueCross BlueShield of Tennessee Privacy Office by calling 1-888-422-2786 or through email at Privacy_Questions_GM@bcbst.com. Or, you can visit our Web site at bcbst.com.

BCBS of Tennessee Client Data Breach

My health insurance is with BCBS of Tennessee. For a couple of months now I have been receiving updates because of a Client data breach they experiences last October. Following is a copy of the official information.

“In October 2009, 57 hard drives containing video and audio files related to coordination of care and eligibility telephone calls from providers and members were stolen from a leased facility in Chattanooga, Tenn. that formerly housed a BlueCross BlueShield of Tennessee call center. The video files were images from computer screens of BlueCross BlueShield of Tennessee customer service representatives and the audio files were recorded phone conversations from January 1, 2007 to October 2, 2009.

“Almost immediately, BlueCross BlueShield of Tennessee began communicating to brokers and employers of this incident and has been providing periodic updates as more information became available.  Additionally, BlueCross BlueShield of Tennessee has been diligently reviewing and analyzing the backup files of the stolen hard drives.  Since early December, nearly 200,000 active and former members have been identified on those files and notified that certain personal information was included on the stolen hard drives.

“As of January 4, 2010, we have completed the audit of the 1.3 million audio files and 300,000 video files and will now begin a broad communications effort to members, brokers and employers.  Part of this comprehensive communications effort will include a progress report delivered via email every two weeks to brokers and group administrators.  This report will include details of total affected members and our notification and remediation steps.  We will continue to post regular updates to our Web site, bcbst.com – including a special Eastgate Hard Drive Theft page – along with a FAQ section to assist in providing answers to many questions we have received over the past few weeks.

“We will also be providing more detail on the steps BlueCross BlueShield of Tennessee has taken to identify and protect the personal data of affected members. Beginning with the member notification letters generated the week of January 11, 2010, information will be included regarding the discovery of the theft of the hard drives and BlueCross BlueShield of Tennessee’s response to that incident.  Additionally, BlueCross BlueShield of Tennessee members that are classified as minors will be receiving a specific notification letter addressed to their parent or guardian and offering LifeLock Identity Alert™ services (see attached).  Letters to current and former BlueCross BlueShield of Tennessee groups explaining these changes will be sent the week of January 11, 2010.

“BlueCross BlueShield of Tennessee is committed to delivering up-to-date and relevant communications to its clients – members, brokers and employers – as information becomes available.”

This organization had to pay for someone to review 1.3 million audio and 300,000 video files. They also have mailed letters to all the potentially affected members. All because some hard drivers were stolen. Another reason to make sure your physical security will protect client information from being compromised because of a burglary.

What is your organization doing to enhance your physical security?