State seal of the State of Vermont
The State of Vermont
The Office of the Attorney General




Home » Press Releases

Press Releases

Court Approves Attorney General HIPAA Settlement With Health Insurer

CONTACT: Sarah London, Assistant Attorney General, (802) 828-5479

January 26, 2011

Judge William K. Sessions has approved Attorney General William Sorrell’s proposed settlement with Health Net, Inc., and Health Net of the Northeast, Inc., regarding the health insurance company’s loss of an unencrypted portable hard drive containing protected health information. The State’s complaint alleged violations of HIPAA (the Health Insurance Portability and Accountability Act), Vermont’s Security Breach Notice Act, and Consumer Fraud Act. The settlement approved by the court on Friday requires the defendants to pay $55,000 to the State, submit to a data-security audit, and file reports with the State regarding the company’s information security programs for the next two years.

The lawsuit is Vermont’s first enforcement action under the Security Breach Notice Act and the second HIPAA enforcement action of its kind since state attorneys general were given HIPAA enforcement authority in 2009. The case arises from a portable hard drive that contained protected health information, social security numbers, and financial information of approximately 1.5 million people, including 525 Vermonters. Health Net discovered that the drive was missing on May 14, 2009 and did not start notifying affected Vermont residents until more than six month later. When it did notify Vermont residents, Health Net told them that it believed their risk of harm was “low” because “the files on the missing drive were not saved in a format that can be easily accessible.” The files on the unencrypted drive were in TIF (Tagged Image File) format, which can be viewed using a variety of freely available software.

Health Net, Inc., and Health Net of the Northeast, Inc., cooperated with the Vermont Attorney General’s investigation of this matter and have settled similar actions in Connecticut and New York.

  Website consulting provided by The National Association of Attorneys General.