On November 8, 2010, the Connecticut Insurance Commissioner, Thomas Sullivan announced that the state's Insurance Department has reached an agreement with Health Net of Connecticut to pay $375,000 in penalties levied for what the Insurance Department characterized as "failures to safeguard the personal information of its members from misuse by third parties." This included what the Insurance Department considered untimely notification of the 2009 loss of a disk drive resulting in the loss of personal health information of approximately 500,000 Connecticut members.
Health Net will be providing credit monitoring protection for 2 years to all Connecticut members and providers who were affected by the 2009 data breach. Health Net also has undertaken significant steps to improve data and equipment security. Under the terms of the settlement, none of the cost of those improvements will be passed along to Health Net members.
Sources have indicated that the overall cost to Health Net in responding to this breach has been over $7 million. Our July 7, 2010 posting contains information about the Connecticut AG's settlement of HIPAA claims with Health Net.