Connecticut AG uses HITECH to sue over patient data breach
Published: 2010-01-24 06:32:41
Author: Health Imaging | January 14, 2010
Connecticut Attorney General (AG) Richard Blumenthal announced Wednesday that he is suing Health Net of Connecticut for failing to secure private patient medical records and financial information involving 446,000 Connecticut enrollees and promptly notify consumers exposed by the security breach.
Blumenthal also is seeking a court order blocking Health Net from continued violations of the Health Insurance Portability and Accountability Act (HIPAA) by requiring that any protected health information contained on a portable electronic device be encrypted.
This case marks the first action by a state attorney general involving violations of HIPAA since the Health Information Technology for Economic and Clinical Health (HITECH) Act, which authorized state attorneys general to enforce HIPAA.
"Protected private medical records and financial information on almost a half million Health Net enrollees in Connecticut were exposed for at least six months—most likely by thieves—before Health Net notified appropriate authorities and consumers,” said Blumenthal. "The staggering scope of the data loss, and deliberate delay in disclosure, are legally actionable and ethically unacceptable. Even more alarming than the breach, Health Net downplayed and dismissed the danger to patients and consumers.”
On or about May 14, 2009, Health Net learned that a portable computer disk drive disappeared from the company's office in Shelton, Conn. The disk contained protected health information, social security numbers and bank account numbers for approximately 446,000 past and present Connecticut enrollees.
Blumenthal alleges that Health Net failed to promptly notify his office or other Connecticut authorities of this missing protected health and other personal and private information.
The missing information included 27.7 million scanned pages of over 120 different types of documents, including insurance claim forms, membership forms, appeals and grievances, correspondence and medical records.
Full story
Published: 2010-01-24 06:32:41
Author: Health Imaging | January 14, 2010
Connecticut Attorney General (AG) Richard Blumenthal announced Wednesday that he is suing Health Net of Connecticut for failing to secure private patient medical records and financial information involving 446,000 Connecticut enrollees and promptly notify consumers exposed by the security breach.
Blumenthal also is seeking a court order blocking Health Net from continued violations of the Health Insurance Portability and Accountability Act (HIPAA) by requiring that any protected health information contained on a portable electronic device be encrypted.
This case marks the first action by a state attorney general involving violations of HIPAA since the Health Information Technology for Economic and Clinical Health (HITECH) Act, which authorized state attorneys general to enforce HIPAA.
"Protected private medical records and financial information on almost a half million Health Net enrollees in Connecticut were exposed for at least six months—most likely by thieves—before Health Net notified appropriate authorities and consumers,” said Blumenthal. "The staggering scope of the data loss, and deliberate delay in disclosure, are legally actionable and ethically unacceptable. Even more alarming than the breach, Health Net downplayed and dismissed the danger to patients and consumers.”
On or about May 14, 2009, Health Net learned that a portable computer disk drive disappeared from the company's office in Shelton, Conn. The disk contained protected health information, social security numbers and bank account numbers for approximately 446,000 past and present Connecticut enrollees.
Blumenthal alleges that Health Net failed to promptly notify his office or other Connecticut authorities of this missing protected health and other personal and private information.
The missing information included 27.7 million scanned pages of over 120 different types of documents, including insurance claim forms, membership forms, appeals and grievances, correspondence and medical records.
Full story