|
|
Authority:
Risk Guidance:
Control Guidance:
|
Relevance:
Background Facts:
- ABC6.com has reported that the Blue Cross & Blue Shield of Rhode Island ("BCBSRI") suffered a security breach impacting approximately 12,000 BlueCHiP for Medicare members.
Relevance to Business Activity:
-
data management - destruction considerations:
- BCBSRI announced that personal information belonging to approximately 12,000 BlueCHiP for Medicare members was inadvertently contained in a filing cabinet donated with other surplus office furniture to a local nonprofit organization:
- the filing cabinet contained completed BlueCHiP for Medicare Health Surveys, and the surveys included:
- names;
- addresses;
- telephone numbers;
- Social Security numbers;
- Medicare identification numbers; and
- self-reported medical information.
-
breach response considerations:
- BCBSRI's Privacy Officer:
- immediately retrieved the documents;
and - launched a full investigation:
- BCBSRI's internal investigation revealed that the disclosure was the result of the failure of certain employees to adhere to the company's strict policies and procedures:
- the responsible employees have been appropriately disciplined, including termination.
- BCBSRI notified appropriate federal and state authorities of the incident, including the:
- U.S. Centers for Medicare and Medicaid Services;
- U.S. Department of Health & Human Services Office for Civil Rights;
- Rhode Island Attorney General; and
- Rhode Island Health Insurance Commissioner.
- in a letter to the approximately 12,000 affected BlueCHiP for Medicare members, BCBSRI:
- apologized for the error;
- notified them of a special hotline available;
- offered each affected member free credit monitoring for one year;
- assistance in every aspect of identity theft protection; and
- identity protection product guarantee for one year, provided by an Experian company:
- members were given direct access to immediately activate their protection;
- among other services, members will have free access to:
- a copy of their Experian credit report;
- daily monitoring and timely alerts of any key changes to their credit reports;
- daily scanning of the Internet of their Social Security, credit card and debit card information to better protect against potential fraud;
- assistance with the cancellation of their credit and debit cards;
- toll-free access to a dedicated team of fraud resolution representatives who will:
- help investigate each incident;
- contact credit grantors to dispute charges;
- close accounts, if necessary;
- compile documents; and
- contact all relevant government agencies.
- a $1 million product guarantee to reimburse them from identity theft related losses such as lost wages, legal fees, and stolen funds should the protection fail.
Source Document:
http://ww.abc6.com/global/story.asp?S=12326346&clienttype=generic&mobilecgbypass