• BlueCross BlueShield of Tennessee ("BlueCross") provided a notification letter to the Attorney General of Maryland detailing a data breach it experienced.

Relevance to Business Activities:

• security - physical and technical safeguards considerations:
• unknown persons:
• entered a data closet located at a leased facility and removed 57 hard drives containing encoded but not encrypted information:
• the information consisted of:
  • recorded telephone calls between providers and members to BlueCross' customer service representatives; and
  • video "screen shots" of BlueCross customer service representative's computer screen while on the customer service call.
• 3 sets of audio were affected:
  • the first two sets contained approximately 550,000 audio files and over 300,000 video files;
  • approximately 600,000 audio files are estimated to exist in the third set;
  • the audio files:
    • typically contained:
      • a BlueCross subscriber ID;
      • name and date of birth; and
      • a diagnosis or diagnosis code in some cases.
    • did not usually contain a Social Security number ("SSN"), however:
      • the HIC number was mentioned in some calls, which combines an SSN and letters.
  • the video files showed SSNs with greater frequency.
• BlueCross' computer monitoring system generated a notice on Friday evening that there was an issue with the servers in the data closet:
  • indicating only that servers were not functioning properly, not that there had been a theft.
• BlueCross did not dispatch an employee on the weekend since the servers were not critical to operations during the weekend:
  • on Monday morning, an information systems employee:
    • was dispatched to physically service the equipment; and
    • discovered that the disk drives had been stolen.
• additional physical security measures that have been added include:
  • additional video camera surveillance;
  • reviewing biometric and key card access readers; and
  • increasing security personnel.

• breach response considerations:
• BlueCross:
• immediately reported the theft to law enforcement:
  • two full-time employees are assigned to investigate the theft and work with local police and the FBI.
• began the process of restoring back-up tapes of the hard drives at issue;
• is in the process of reviewing the audio and video files affected:
• an electronic solution for the review process could not be found and a manual review of all the files was necessary.
• dedicated 500 internal employees and hired approximately 300 temporary employees to aid in the review:
  • the full-time employees worked on two different shifts, six days a week.
• is conducting a complete audit and assessment of its physical security at the rental space it was leasing;
• hired a:
• data recovery and computer forensics vendor:
  • to aid in data restoration, compilation and review.
• computer expert to perform penetration testing of BlueCross' network and website:
• to help strengthen security and prevent future breaches; and
• even though the theft did not involve a penetration into the computer network.
• vendor to:
  • send out notification letters;
  • staff a telephone call center; and
  • provide access to licensed investigators:
    • for any member who:
      • has questions regarding identity theft; or
      • thinks they may be a victim of identity theft.
    • who will have access to a proprietary database in order to determine if there has been suspicious or fraudulent activity related to the member's identity.
  • provide investigation and restoration services to any minor:
    • whose personal information may be at risk; and
    • for whom typical credit monitoring may be insufficient as minors do not have credit files.
• notified:
  • the Secretary of the Department of Health and Human Services ("HHS"):
    • BlueCross informed HHS that it would not meet the mandatory 60-day HITECH deadline for notification to members:
      • due to the sheer volume of data being reviewed.
    • periodic status updates are being provided to the Office of Civil Rights of HHS.
  • the Attorney General of Tennessee;
  • the Attorney General of Maryland, indicating:
    • the nature of the breach;
    • that an estimated 259 members whose information was lost reside in Maryland;
    • that notice will be provided to applicable state residents as soon as they are identified, on a rolling basis; and
    • what services BlueCross will be offering members to help detect and prevent identity theft.
  • all three major credit bureaus:
    • additional notices will be sent once the final distribution of member notices is known.
  • group administrators:
    • informing employer groups of how BlueCross is handling notification of impacted members.
• has begun the notification process for members identified as at issue:
  • all potentially impacted members were assigned to one of three risk tiers:
    • lowest tier:
      • members whose name, subscriber ID, date of birth and/or address was present.
    • second tier:
      • all information from the lowest tier, plus diagnosis or diagnosis code.
    • third and highest risk tier:
      • members whose SSN may be at risk.
  • notification is prioritized based on risk tier:
    • first priority is to notify members whose SSNs may be at risk:
      • they will receive a "tier 3" notification letter, which:
        • explains the nature of the breach;
        • advises members to monitor their claim activities by reviewing their explanation of benefits statements from BlueCross; and 
        • offers free credit monitoring and identity theft insurance.
  • contact information (phone and email) is being provided in the member notices;
  • U.S. state notification requirements are met through additional sections:
    • Hawaii, Iowa, Maryland, Michigan, Missouri, North Carolina, Oregon, Vermont, Virginia, West Virginia, and Wyoming:
      • that it is required by state law to inform individuals that they may obtain a copy of their credit report for free; and
      • providing the contact information for the three major consumer reporting agencies.
    • Iowa:
      • that state law advises individuals to report any suspected identity theft to:
        • law enforcement; or
        • the Attorney General.
    • Oregon:
      • that state law advises individuals to report any suspected identity theft to:
        • law enforcement; or
        • the Federal Trade Commission ("FTC").
    • Maryland and North Carolina:
      • that information about steps that can be taken to avoid identity theft can be obtained from:
        • the office of the Attorney General; and
        • the FTC.
      • contact information for the attorneys general and the FTC is provided.
    • Massachusetts and West Virginia:
      • explaining how individuals can obtain:
        • a police report if they are victims of identity theft; and
        • security freezes on their credit reports.
• discovered several states which will have over 500 members being notified:
  • the HITECH Act requires that media notice is provided to any jurisdiction where over 500 members may reside;
  • all Attorneys General in those states are being notified - so they:
    • may be aware of BlueCross' activities; and
    • can address questions they may receive from members of those states.
• posted on its website:
  • a copy of its HITECH-mandated press release; and
  • information from the FTC on how to detect and prevent identity theft.

Source Document:

http://www.oag.state.md.us/idtheft/Breach%20Notices/ITU182399.pdf