A computer file containing Social Security numbers and other personal information on approximately 17,000 people enrolled in Humana Medicare plans was left unsecured in a hotel computer after a Humana employee called up the data, the Louisville insurer disclosed yesterday.
There is no evidence that the information fell into the wrong hands and was misused, Medicare spokesman Peter Ashkenaz said yesterday.
Still, the agency called the incident "unacceptable," ordered Humana to take corrective steps and said it was considering further action against the company.
Humana sent letters yesterday to each of the affected members, company spokesman Dick Brown said.
In addition to requiring that notification, Medicare ordered Humana to provide the 17,000 people free access to a credit-monitoring service for one year.
It also directed the company to submit a plan "to ensure that such privacy violations do not occur again," Mark McClellan, administrator of the Centers for Medicare and Medicaid Services, said in a statement.
Brown said the members' information was inadvertently left in a personal computer at a Baltimore-area hotel after a Humana employee staying there called up his e-mail and opened an attachment containing the information. He then logged off.
About a month later, Brown said, an employee of the Department of Health and Human Services' inspector general was staying at the hotel and used the computer to check his own e-mail. He then went into the computer's temporary Internet files to delete what he had downloaded, and found the Humana information, Brown said.
It was the second time that Humana customer files were compromised recently, Medicare said. Last month about 250 applications were stolen from an insurance agent's vehicle in Minnesota.
Humana said it takes members' privacy seriously and is strengthening controls on member information, both through software adjustments and educating employees and sales agents.
Humana has about 3.4 million people in its Medicare medical and prescription drug plans.
[an error occurred while processing this directive]