CT AG's Office Suing Health Net for Member Data Breach

The AG's office alleges that an investigative report by Kroll Inc., a computer forensic consulting firm hired by Health Net, found that that data was not encrypted or protected from access by unauthorized people, which Blumenthal said is against the insurer's own policies and requirements of federal law. Blumenthal is seeking a court order to block Health Net from continued HIPAA violations by requiring that any protected health information contained on a portable electronic device be encrypted.

"These missing medical records included some of the most personal, intimate patient information—exposing individuals to grave embarrassment and emotional distress, as well as financial harm and identity theft," he said. "The staggering scope of the data loss, and deliberate delay in disclosure, are legally actionable and ethically unacceptable. Even more alarming than the breach, Health Net downplayed and dismissed the danger to patients and consumers," he said.

"Failing to protect patient privacy blatantly violates federal law and Health Net's public trust. We are seeking a preliminary order to protect patients and consumers, and will fight for civil penalties."

The lawsuit also names UnitedHealth Group and Oxford Health Plans, which have acquired ownership of Health Net of Connecticut, said Blumenthal.

In response to the missing information, Health Net said it is offering two years of "free credit monitoring services for all impacted members who elect this service. This service also includes $1 million of identity theft insurance coverage and enrollment in fraud resolution services for two years, if needed. Additionally, if members experience any identity theft between May 2009 and the date of their enrollment, Health Net will provide services to restore the member's identity at no cost to the member."

Follow Les Masterson on Twitter.