The state attorney general is demanding Anthem Blue Cross Blue Shield of Connecticut provide more answers and identity-theft protection for nearly 19,000 health professionals whose confidential data was on a stolen laptop computer.
Attorney General Richard Blumenthal, at a press conference today, said Anthem and one of its Blue Cross Blue Shield affiliates may have broken the law after they failed to immediately notify the affected doctors, therapists and other professionals whose information was in the laptop when it disappeared last August outside Chicago.
Anthem waited until late October to notify the victims, the attorney general said.
He said Anthem may have violated Connecticut laws requiring that companies fully secure sensitive data and that, once lost or stolen, they immediately notify owners of the data about the breach.
Read more in the Hartford Business Journal.
How times have changed! Now notifying within two months or so of discovery may be too long? And if Connecticut does fine Anthem for the data being unencrypted, perhaps more companies will get serious in a hurry to ensure that data are encrypted.
Update: The AG’s press release:
Attorney General Richard Blumenthal is investigating Blue Cross Blue Shield’s loss of confidential information, including tax identification and some Social Security numbers, for all 18,817 of its individual Connecticut health care providers, as well as seeking additional identity theft protection for affected doctors, therapists and other professionals.
Blumenthal said that the company and its affiliates may have violated state law by losing the information and failing to notify providers in a timely manner. The companies are offering professionals one year of identity theft protection, but Blumenthal called these measures “inadequate and unacceptable, and said, “I will fight for at least two years.”
Blumenthal said the information was lost when a laptop was stolen on August 25. The laptop held information on the companies’ providers nationwide, including names, addresses, tax identification and provider numbers and some Social Security numbers.
Although the computer was stolen in late August, Blue Cross Blue Shield and its related companies Anthem and Empire failed to inform health care providers until late last month.
“As appalling as the data loss, equally alarming and potentially illegal is the delay in disclosing it,” Blumenthal said. “We are vigorously investigating this appalling data loss, needlessly exposing more than 18,000 Connecticut doctors and professionals to devastating identity theft.
“Failing to promptly notify providers of the breach is inexcusable — and a possible violation of state law. Waiting two months left providers severely at risk — needlessly and irresponsibly exposing them to financial mayhem.
“My office demands a full accounting from Blue Cross Blue Shield — healthcare providers affected, details of the loss, protections for professionals, policies and procedures for data loss and other information. State laws mandate that companies fully secure sensitive personal information and quickly disclose breaches — laws the companies may have broken.
“Anthem’s one year of identity theft protection is inadequate and unacceptable. Connecticut doctors and health care professionals expect and deserve a stronger shield against identity loss. I will fight for greater safeguards, including longer identity theft protection, as I have done in other data breaches.
“For identity thieves, private personal data is as good as gold — and should be secured with equal vigor and vigilance. Companies must closely protect Social Security numbers and other sensitive data.”
In addition to protections provided by the companies, Blumenthal said that health care providers can protect themselves by asking the three major credit rating agencies to place a free “Fraud Alert” on their credit reports. The companies are: Equifax – 1-800-525-6285; Experian – 1-888-397-3742; TransUnion – 1-800-680-7289.
Health care providers can also have the major credit rating agencies “freeze” their credit, meaning no new credit can be taken out in their names without their express authorization. A credit freeze request must be made in writing by certified mail to one of the three major credit rating agencies, Equifax, Experian and Transunion.
Credit bureaus charge $10 to freeze and $12 to temporarily un-freeze credit. Blumenthal will seek reimbursement to health care providers for credit freezes and un-freezes.