A Stolen Health Insurer's Laptop With PII Is Not Necessarily A HIPAA Violation
While scanning the news blurb summaries today, the statement, "This is a violation of HIPAA." caught my eye. Hmm...let's see what this is about...
This statement was actually within the reader comments to the story, "Blue Cross reports theft of computer."
New Jersey's "largest health insurance company," Blue Cross/Blue Shield, reported a laptop computer containing the personally identifiable information (PII) of over 300,000 of its members (insureds) was stolen from an employee "while it was being taken home" on January 5.
"Horizon Blue Cross/Blue Shield says the risk of identity theft is small because the data was protected by password. Also, the computer was programmed to automatically destroy the information on Jan. 23.The laptop contained names, Social Security numbers and other personal information for about 10 percent of the insurer's 3.3 million customers in New Jersey. Medical information was not included."
The statement that the New Jersey BC/BS made about the password protection is very troubling; a password is just a speedbump on a criminal's path to the PII and subsequently using PII for fraud and other crimes. Hopefully this was not a statement from the Privacy or Information Security office!
An independent audit of the situation would reveal whether or not this was truly a violation of HIPAA; the report does not give enough details to determine this. However, names and SSNs are defined as protected health information (PHI) under HIPAA.
The comments for the report are very revealing and should demonstrate to business leaders that the public...their customers...expect organizations, to whom customers entrust their PII, to unequivocally and effectively safeguard their PII.
* Do not allow databases of PII to be stored on mobile computers and storage devices.
* If PII must be stored on mobile computers or storage devices, then strongly encrypt it.
* Provide training and ongoing awareness communications to all personnel with access to PII.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
Comments
Hi -- I just wanted to ask the question, why was the lap top being brought home by an employee in the first place? If this lap top truly had 10% of of the personal information for 3.3 million customers in New Jersey, how could Blue Cross feel fine letting it travel back and forth? I am not an expert on HIPAA security/privacy violations, but if the lap top was being put at a significant level of risk, perhaps that would come out during an audit?
Posted by: David Lubetsky | February 1, 2008 9:45 AM
Thanks for your note, David.
Yes, there are many unanswered questions from the report of this incident. If BC/BS did not have policies regarding the storage of PHI/PII on mobile devices, or did not provide training, or did not enforce policies, or...so many more possibilities, then they could be in violation of HIPAA.
However, if they had all the necessary safeguards in place, and the person with the laptop had authorized access to the PHI/PII, then perhaps not. The insider threat often leads to incidents.
It seems it would be good for the HHS to launch an audit immediately following incidents of this type within covered entities.
Posted by: Rebecca | February 1, 2008 4:44 PM