In what he is calling a “historic” lawsuit, Connecticut’s attorney general has filed suit against Health Net of Connecticut for a data breach jeopardizing the personal information of 446,000 of its members.

Richard Blumenthal

The suit by Richard Blumenthal alleges that the insurer failed to effectively supervise and train its workforce on policies and procedures concerning the appropriate maintenance, use and disclosure of protected health information. It also names UnitedHealth Group and Oxford Health Plans, who were not responsible for the breach, Blumenthal noted, but recently acquired ownership of Health Net of Connecticut.

In November 2009, the insurer notified officials in three states about a missing disk drive at its Shelton, Conn., office that contained the personal information of 1.5 million members. A spokesman for the company told IFAwebnews.com that the drive contained personal information gathered over a seven-year period for 446,000 members in Connecticut, about 340,000 members in New Jersey and New York, and the remainder from Arizona.

The company said while the drive was discovered missing in May 2009, it took a “detailed forensic review” to discover what was on the drive and that the information cannot be accessed without special software.

In a statement to IFAwebnews.com, Health Net said it has received a copy of the lawsuit and “is in the process of reviewing it.

“We will continue to work cooperatively with the Connecticut Attorney General on this matter,” the company said.

Security issues

Following his notification three months ago, Blumenthal expressed his outrage in both the insurer’s security and failure to report the incident to his office sooner.

Blumenthal’s office said that the missing information includes 27.7 million scanned pages of more than 120 different types of documents, including insurance claim forms and medical records.

An investigative report by Kroll Inc., a computer forensic consulting firm hired by Health Net, indicated that the data was not encrypted or otherwise protected from access and viewing, but rather viewable with what Blumenthal deemed was “commonly available software.”

Blumenthal said the breach exposed Health Net members “to grave embarrassment and emotional distress, as well as financial harm and identity theft” and that both the data loss and the “deliberate delay in disclosure, are legally actionable and ethically unacceptable.”

Health Net told IFAwebnews.com that “protecting the privacy of our members is extremely important to us” and that company policy requires all data to be encrypted and secured.

“To date, Health Net has no evidence that there has been any misuse of the data,” the company, which is offering two years of free credit monitoring to all affected members, said.

In addition, if members experience any identity theft between May 2009 and the date of their enrollment, Health Net will provide services to restore the member’s identity at no cost.

HIPAA enforcement

In addition to the suit, Blumenthal said he is also seeking a court order blocking Health Net from continued violations of the Health Insurance Portability and Accountability Act (HIPAA), by requiring that any protected health information contained on a portable electronic device be encrypted.

Blumenthal’s office said the case marks the first action by a state attorney general regarding HIPAA violations since the Health Information Technology for Economic and Clinical Health Act authorized state attorneys general to enforce HIPAA.

“Sadly, this lawsuit is historic – involving an unparalleled health care privacy breach and an unprecedented state enforcement of HIPAA,” Blumenthal said in a statement. “Protected private medical records and financial information on almost a half million Health Net enrollees in Connecticut were exposed for at least six months – most likely by thieves – before Health Net notified appropriate authorities and consumers.”