Wellpoint Leaves 130,000 Customers' Data Swinging in the Breeze

Wellpoint said it is not aware of any identity theft related to the problem.

Operating in some places under the Unicare name, Wellpoint said customer information in several states, including Illinois, was exposed in the last year because two computer servers maintained by a vendor "were not properly secured for a period of time." The insurer declined to name the vendor.

Medical Records, SSNs

Wellpoint, the nation's largest health insurer, with 35 million subscribers that include 325,000 in Illinois, has been notifying customers of the security breakdown in recent days.

But customers who contacted the Tribune said they are worried that their prescription records, claims and Social Security numbers might still be somehow available on the Web or are in the hands of identity thieves.

"The idea that my medical records could be floating out there is outrageous to me," said Marc Roberts, 54, of Oswego, Ill., who has health insurance from Unicare. "I think the idea of electronic medical records is excellent. It's just their lack of monitoring their security that is a significant issue."

Move to Electronic Records

The security lapse comes as the health-care industry is moving quickly to adopt electronic health records, designed to reduce costs and improve efficiencies, instead of paper records.

However, as bugs have yet to be worked out, there have been several high-profile incidents where customers' health records have been exposed to potential breaches.

Last year, for example, another Wellpoint subsidiary, Empire Blue Cross Blue Shield, lost a compact disc containing the personal health information of more than 70,000 customers when it was shipped between vendors. Ultimately, it was found and there were no known cases of identity theft, the insurer said.

Attention From D.C.

But such incidents have gotten the attention of members of Congress.

U.S. Reps. Rahm Emanual (D-Ill.) and Edward Markey (D-Mass.) have introduced a bill that would require additional safeguards and standards to ensure privacy and integrity of personal health information.

"As medical records and patient histories become electronic, phrases like 'security,' 'privacy,' and 'access' should become just as important as 'take two of these and call me in the morning,'" Emanuel said in a statement to the Tribune.

Wellpoint said it is taking extra measures to protect the security of patients' records and has hired consultants to "reduce the risk of future incidents," company spokeswoman Cheryl Leamon said.

"To fix the problem, we conducted an internal analysis of the situation, used external consultants to confirm the security of our system and put additional measures in place to enhance our security checks and balances," Leamon said. "We have not received any reports of identity theft or credit fraud. We take the security of our members' personal health information very seriously."

The Standard Consolation Prize

Wellpoint and Unicare are offering customers who may have been affected one year of free credit-monitoring services from Equifax Credit Watch.

That offer, however, is not being greeted too warmly. "One year of credit monitoring to me and then what am I supposed to do ... buy it every year thereafter?" Roberts said. "It shouldn't be my responsibility."