[ISN] Blue Cross physicians warned of data breach

http://www.boston.com/news/local/massachusetts/articles/2009/10/03/blue_cross_physicians_warned_of_data_breach/

By Kay Lazar
Boston Globe Staff 
October 3, 2009 

The largest health insurer in Massachusetts is warning roughly 39,000 
physicians and other health care providers in the state that personal 
information, including Social Security numbers, may have been 
compromised after a laptop containing the data was stolen in August from 
an employee of the Blue Cross and Blue Shield Association's national 
headquarters in Chicago.

The breach involves "tens of thousands" of physicians nationwide, 
although the precise number is unclear, according to a national Blue 
Cross-Blue Shield spokesman. Thirty-nine affiliates feed information 
about providers into a database maintained by the association's national 
headquarters.

Massachusetts doctors were not notified by letter until yesterday, 
because state Blue Cross-Blue Shield officials said they did not at 
first know what kind of data were on the stolen laptop. They said the 
data did not contain any information about patients or personal health 
records.

"It took some time to figure out what type of data was on the laptop," 
said Tara Murray, Blue Cross and Blue Shield of Massachusetts 
spokeswoman. "There is no reason to be believe the data has been used to 
steal people's identity, but we are just being cautious . . . to notify 
them and offering free credit monitoring."

Jeff Smokler, national Blue Cross-Blue Shield spokesman, said the 
insurance giant - roughly 90 percent of physicians nationwide are in its 
network - encrypts all of its information on company computers, but an 
employee who was authorized to have the information violated company 
rules by downloading an unencrypted version onto a personal laptop. The 
laptop was stolen after the employee left headquarters with it.

[...]


________________________________________ 
Did a friend send you this? From now on, be the 
first to find out! Subscribe to InfoSec News 
http://www.infosecnews.org