<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.6000.16544" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>
<P><A
href="http://www.crainsnewyork.com/apps/pbcs.dll/article?AID=/20071120/FREE/71120008/1049">http://www.crainsnewyork.com/apps/pbcs.dll/article?AID=/20071120/FREE/71120008/1049</A></P>
<P>United Healthcare posted the social security numbers of doctors at Columbia
University’s faculty practice on a public Web site in a breach of security that
exposed the doctors to identity theft.<BR><BR>The sensitive information was
loaded on Oct. 31 and taken down Nov. 2.<BR><BR>United posted the taxpayer
identification numbers, some of which were Social Security numbers, alongside
the names of 993 providers at Columbia who participate in the insurer’s network.
The list was supposed to be accessible to Columbia employees during the current
open enrollment period. <BR><BR>A United spokesman said the tax ID
“inadvertently” included social security numbers, which were removed once the
insurer was informed of the error. A forensic analysis showed there were some
non-Columbia computers that downloaded the information, says the spokesman.
<BR><BR>The Web page was viewed 157 times before the ID information was removed.
He adds that United also is trying to determine “from a technology perspective”
how the breach occurred.<BR><BR>United notified the New York state Attorney
General’s office of the incident.<BR><BR>The insurer has written to the Columbia
doctors to apologize. The providers can have their credit reports monitored by
Equifax, which will alert them if a credit check is
performed.<BR><BR>Subsequently, Columbia’s faculty practice organization will
closely monitor whether its doctors become the victims of identity theft.
<BR><BR>A spokeswoman for the university said that although only a small subset
of the FPO’s doctors had their SS numbers publicly displayed, the breach was
“very serious” and has made the doctors unhappy. <BR><BR>United complied with
Columbia’s request to notify the doctors, sent a company representative onsite
to answer the doctors’ questions, and provided one-year protection from Equifax.
Columbia’s legal department will monitor whether fraud occurs. For now, most of
the information appears to have been accessed by “legitimate Columbia
addresses,” says the spokeswoman. </P>
<P> </P>
<P> </P>
<P>Michael Hill <BR>Certified Identity Theft Risk Management Specialist<BR>IDT
Consultants<BR>404-216-3751</P>
<P><BR><FONT size=3><STRONG><EM>"If You Think You're Not At Risk, Think
Again!"</EM></STRONG></FONT></P></FONT></DIV></BODY></HTML>