There was a time when if an entity offered two years of free credit monitoring/credit restoration services to breach victims, that was considered unusual and commendable. And when the University of Maryland offered five years of credit monitoring services following a breach there, that was really surprising.
But as consumers have often noted, if your SSN and identity information are out there, you’re at risk for life. Criminals can just sit on the data until after the free credit monitoring expires and then begin using it with less risk. While your credit card number can expire or be replaced, your SSN is generally forever.
Could the Anthem breach may become a game-changer on remediation offered to breach victims? A number of state attorneys general are looking into the breach, and according to James Boffetti, Senior Assistant Attorney General of New Hampshire and Chief of the Consumer Protection and Antitrust Bureau, one issue they’re looking at is “the appropriateness of the remedies that Anthem is offering to people,” he said.
The Union Leader reports that Boffetti
said company officials have been “very responsive” to investigators. And Anthem has a dedicated website to provide information to affected customers about protecting themselves from identity theft (anthemfacts.com).
But Boffetti said there is “a legitimate concern” about the length of protection Anthem is offering its customers. “I think that’s something that’s going to be discussed quite vigorously as this investigation goes on,” he said.
Although state attorneys general may pursue this aspect of the breach, I do not expect HHS/OCR to really do anything about the mitigation issue. HITECH provides a standard for mitigation, but no specifics when it comes to things like credit monitoring services. And, to date, I don’t think any of OCR’s less than two dozen resolution agreements involved mitigation. Last year, HHS/OCR was sent a complaint about alleged HIPAA and HITECH violations that does include a complaint about failure to adequately mitigate harm and the risk of harm. Whether OCR has done anything with that complaint is unknown to this complainant.