Connecticut A.G. Investigating Anthem Blue Cross Data Breach

Copyright 2009 A.M. Best Company, Inc.All Rights Reserved BestWire

November 10, 2009 Tuesday 02:01 PM EST

547 words

Connecticut A.G. Investigating Anthem Blue Cross Data Breach

Fran Lysiak

HARTFORD, Conn.

Anthem Blue Cross and Blue Shield is facing a data breach investigation by Connecticut's attorney general, who alleges the health insurer waited two months to tell 18,817 health care providers in the state that a laptop computer containing their personal information was stolen.

State Attorney General Richard Blumenthal's office said the company and its affiliates may have violated Connecticut law by losing providers' confidential information, including tax identification and some Social Security numbers, and failing to promptly notify them of the security breach.

The information was lost when the laptop, which held information on the companies' providers nationwide, was stolen Aug. 25. However, Blue Cross and Blue Shield and its related companies, including Empire, didn't tell the doctors, therapists and other professionals until last month, the attorney general's office said.

"As appalling as the data loss, equally alarming and potentially illegal is the delay in disclosing it," Blumenthal said in a statement. "We are vigorously investigating this appalling data loss, needlessly exposing more than 18,000 Connecticut doctors and professionals to devastating identity theft."

The companies are offering professionals one year of identity theft protection but the attorney general called that "unacceptable" and said he would "fight for at least two years."

Sarah Yeager, a spokeswoman for Anthem Blue Cross and Blue Shield in Connecticut, said the company takes "very seriously our obligation to protect the personal information of our members and providers. It's very important."

The company already has notified the attorney general that it will increase the credit monitoring services to the affected Connecticut providers for two years instead of one, she said.

In a statement, Anthem Blue Cross and Blue Shield, a unit of WellPoint Inc. (NYSE: WLP), said that it believes that it "acted with all due diligence in order to minimize unnecessary delay of our notice to providers."

"Letters were mailed only after we determined who may have been impacted so as to minimize unnecessary confusion and alarm," Anthem said.

The health insurer also said credit monitoring arrangements were made for about 18,000 providers, credit monitoring subscription codes were entered into each provider notice letter and customer service and provider representatives were trained so that provider calls could be handled accurately.

Nevertheless, Blumenthal said his office wants a "full accounting" from Blue Cross on the providers affected, details of the loss, protections for professionals and policies and procedures for data loss.

No medical information or protected health information was contained in the data, Anthem said. For some providers, their Social Security number was listed in the tax identification number data field of the data file, but it was not identified as the provider's SSN, the company said.

"All indications are that this was a random theft," Anthem said. Two other vehicles in the same vicinity were broken into that night as well and the theft was reported to the Chicago Police Department.

Anthem Health Plans currently has a Best's Financial Strength Rating of A (Excellent).

(By Fran Matso Lysiak, senior associate editor, BestWeek: [email protected])

November 11, 2009