Health Net agreed to pay $250,000 to Connecticut to settle a case involving the May 2009 loss of a computer disk drive containing personal health information of up to 2 million health plan members.

Richard Blumenthal

Connecticut Attorney General Richard Blumenthal said the settlement was the first in the nation applying provisions of the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), which gives state attorneys general the power to enforce the law.

“More than the money, this settlement sends a strong message to Health Net and all guardians of private health and financial information about their profound responsibilities to protect medical and financial records,” Blumenthal said. “These missing medical records included some of the most personal, intimate patient information — exposing individuals to grave embarrassment and emotional distress, as well as financial harm and identity theft. This settlement provides powerful systemic protections for consumers and payment to taxpayers.”

Health Net’s settlement resolves allegations that Health Net violated HIPAA, as well as state privacy protections regarding personal data such as Social Security Numbers and financial information.

Health Net officials notified authorities in November 2009 of the loss of the disk drive and two laptops from a company office in Connecticut. An inquiry by Blumenthal uncovered the company delayed notification of authorities and consumers for at least six month and that an investigation by a Health Net consultant concluded the disk drive was likely stolen. About 500,000 of the members whose information was compromised live in Connecticut, Blumenthal said.

Health Net must provide two years of credit monitoring, $1 million of identity theft insurance and reimbursement for the costs of security freezes, according to the settlement.

If officials discovered that the information on the lost disk drive is accessed and personal information is used illegally, then Health Net agreed to pay an additional $500,000.

The settlement involves Health Net of the Northeast, Health Net of Connecticut, and parent companies UnitedHealth Group and Oxford Health Plans.