Nov
5
2007
Stolen Insurance Records Highlight Outsourcing Issue
Author: Valeria WeberComputer records containing medical claim information, health data and Social Security numbers of over 28,000 health insurance customers of Nationwide Mutual Insurance Co. were stolen from the office of a vendor in Massachusetts last October. Also stolen were records on 130,000 Aetna health insurance customers.
This was not a hacker at work; the information was on computer “backup tapes” that were taken from a lockbox which was either left open or had its lock picked. The tapes were stored at a “third party administrator,” a firm that audits hospital stay charges and other customer claims.
Nationwide waited a couple of weeks to see if the tapes would turn up, and then notified their customer base. Aetna announced the theft in December. According to the insurance companies, they were waiting to see if any instances of identity theft turned up, which they believed to be unlikely. Apparently, none have.
Identity theft is a highly publicized issue and one that firms who deal in personal information as a business ought to be concerned with also – perhaps an investment in a device more sophisticated than a lock box might be in order.
What has not been discussed in the news coverage of this story is the potential use of medical histories contained in those tapes. Medical histories can ruin employment chances, wreck careers – and, for that matter, impact health insurance rates as well. That is why Congress passed the HIPAA law which put stringent controls on the dissemination of personal health information.
When highly personal records pass from doctor to hospital to insurance carrier to outsourced auditor, the spirit – if not the letter – of the protection written into HIPAA fade into the distant background. Once those records leave your doctor’s office, expect them to be treated as just another file that will be scrutinized by any number of individuals along the ‘managed health care’ production line.