[Dataloss] Insurer inadvertently posted physician SSNs

[Michael Hill, CITRMS]

http://www.crainsnewyork.com/apps/pbcs.dll/article?AID=/20071120/FREE/71120008/1049

United Healthcare posted the social security numbers of doctors at Columbia University's faculty practice on a public Web site in a breach of security that exposed the doctors to identity theft.

The sensitive information was loaded on Oct. 31 and taken down Nov. 2.

United posted the taxpayer identification numbers, some of which were Social Security numbers, alongside the names of 993 providers at Columbia who participate in the insurer's network. The list was supposed to be accessible to Columbia employees during the current open enrollment period. 

A United spokesman said the tax ID "inadvertently" included social security numbers, which were removed once the insurer was informed of the error. A forensic analysis showed there were some non-Columbia computers that downloaded the information, says the spokesman. 

The Web page was viewed 157 times before the ID information was removed. He adds that United also is trying to determine "from a technology perspective" how the breach occurred.

United notified the New York state Attorney General's office of the incident.

The insurer has written to the Columbia doctors to apologize. The providers can have their credit reports monitored by Equifax, which will alert them if a credit check is performed.

Subsequently, Columbia's faculty practice organization will closely monitor whether its doctors become the victims of identity theft. 

A spokeswoman for the university said that although only a small subset of the FPO's doctors had their SS numbers publicly displayed, the breach was "very serious" and has made the doctors unhappy. 

United complied with Columbia's request to notify the doctors, sent a company representative onsite to answer the doctors' questions, and provided one-year protection from Equifax. Columbia's legal department will monitor whether fraud occurs. For now, most of the information appears to have been accessed by "legitimate Columbia addresses," says the spokeswoman. 





Michael Hill 
Certified Identity Theft Risk Management Specialist
IDT Consultants
404-216-3751


"If You Think You're Not At Risk, Think Again!"
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://attrition.org/pipermail/dataloss/attachments/20071121/98076b15/attachment.html