Theft of Member Personal Data Costs Tennessee Blues Nearly $10 Million

BlueCross BlueShield of Tennessee faces $10 million in costs associated with members' personal data that was stolen last fall from a facility the health insurer had leased that previously housed a call center.

Nearly 1 million members were impacted by the theft -- 239,103 of whom had their Social Security numbers on the stolen hard drives, said Mary Thompson, a spokeswoman for the Tennessee Blues.

The personal information of about 500,000 of its members was at risk following the theft of 57 computer hard drives (BestWire, Jan. 14, 2010).

The $10 million includes working with the vendor, hiring temporary workers to field a special telephone line and mailings to impacted members, she said.

When the theft was discovered, BlueCross hired Kroll to conduct an assessment of its security, identify members whose personal information was at risk and take actions to improve security (BestWire, Jan. 14, 2010). There's no indication any of the data has been used for fraudulent purposes, the Blues said. Those members whose Social Security numbers were on the stolen hard drives will receive free Equifax credit monitoring for one year and a free identity theft protection service from Kroll, Thompson said. An investigation continues.

"We have done our best to reinforce security measures that were already in place and to add additional security measures to ensure that a situation like this never occurs again," Thompson said.

Earlier this month, Health Net and its affiliates agreed to pay $250,000 for failing to secure the private patient medical records and financial information of some 500,000 Connecticut enrollees (BestWire, July 7, 2010).

In June, Anthem Blue Cross, the California-based unit of WellPoint Inc. (NYSE: WLP), alerted an estimated 230,000 applicants for coverage that their personal medical records and Social Security numbers may have been wrongfully accessed (BestWire, June 28, 2010).

(By Fran Matso Lysiak, senior associate editor, BestWeek: fran.lysiak@ambest.com)