Anthem 78.8 Million Breach Notification Letter Mailing Almost Finished
According to a recent statement issued by Anthem spokeswoman, Sarah Yeager, the insurer expects to have completed the arduous task of mailing 78.8 million past and present policyholders – and other individuals – to advise them that their data has been compromised and obtained by hackers.
Under the Health Insurance Portability and Accountability Act – specifically the Breach Notification Rule – all covered entities (CEs) are required to send notification letters to all individuals affected by a data breach and to complete the process no later than 60 days following the discovery of the breach. It would appear that Anthem needed all of that time to complete such a monumental task.
In spite of the scale of the attack, only 937,478 individuals have so far signed up for the credit monitoring services offered by the insurer through AllClear ID. That figure is almost certain to rise considerably over the coming weeks as all the letters are finally sent.
According to an article in Hartford Courant, in spite of the scale of the attack and the number of individuals affected, the Connecticut Attorney General’s Office had received fewer than 50 calls regarding the Anthem data breach. Robert S. Blanchard, a spokesperson from the AG’s office, said there were a number of reasons for the calls, some from people just concerned about data theft, others that had noticed suspicious activity on their credit card statements while others claimed to have had their identities stolen.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Blanchard pointed out that when people check their credit and EOB statements carefully in the wake of a breach they discover instances of fraud, but that fraudulent activity could have occurred due to a number of reasons. He said, “The callers might have been affected by another cyber heist, like the one that affected 70 million Target customers last year”.
It is almost impossible to determine exactly where data was exposed and how it was obtained by criminals in many cases, and now after so many mega data breaches have occurred and many more likely to follow, the chances of attributing a case of identity theft to one particular HIPAA breach is likely to become an even harder task.
