Mailroom Error, Big Data Breach

Data breaches need not be launched maliciously in order to be very troublesome, as was the case involving about 3,700 Medicare Advantage members. Freedom Blue and Security Blue members received risk assessment results that actually belonged to other individuals. The addresses, birthdates, member ID numbers and medical information of some members ended up in the hands of other members.

And how? An innocent mistake committed by a mailroom employee. Though there was no evidence of malicious use of this personal information, it just goes to show you how easily a person’s private information can end up in a stranger’s hands. Imagine receiving a stranger’s medical information in your mailbox. It would make you think twice about trusting the company with your personal information in the future.

Members were notified of this error after the insurer spent a month exploring how it happened. Though the unintended recipients received information about other members’ scores on mood tests, medications and results of frailty tests, at least the Social Security numbers weren’t revealed.

If a breach affects more than 500 people, law requires that the health industry alert the Health and Human Services Department, which will then launch an investigation. The affected consumers, and local news outlets, are also required to be notified.

Highmark Inc., the health insurance company whose members were affected by the mailroom breach, changed the member ID numbers of the affected members or those who might have been affected. Sixty-three members received forms pertaining to other people, and 233 never received a mailing, suggesting that their forms possibly went to other members.

As for the bumbling employee, that person was fired. The other employees are being retrained, and Highmark will implement a bar code system on all mailings, which is one proper way to track breach notification letter mailings to ensure the right pieces of mail end up in the right hands and avoid over-stuffing or mis-stuffing of envelopes..

Robert Siciliano is an Identity Theft Expert to AllClearID. He is the author of 99 Things You Wish You Knew Before Your Identity Was Stolen See him knock’em dead in this identity theft prevention video. Disclosures.