Health Net Fined $55K for Data Breach

"Consumers expect—and the law requires—that personal information be treated with the utmost care," Sorrell said in a statement. "Identity theft remains one of the fastest growing crimes in America. Companies must be careful to prevent Vermonters' sensitive information, especially their medical records, from falling into the wrong hands."

Health Net told HealthLeaders Media in a statement that "protecting the privacy of our members is extremely important to us."

"Health Net has worked closely and cooperatively with the Vermont Attorney General," according to the statement, "and we have agreed to the terms contained in the agreement filed with the court to resolve this matter, which occurred in 2009."

To date, Health Net has no evidence that there has been any attempt to access or misuse the data, the company said in the statement.

The lawsuit is Vermont's first enforcement action under the Security Breach Notice Act. Included in the portable hard drive were PHI, social security numbers and financial information.