Why We Need Better Breach Disclosure Laws

I was reading my Twitter feed today and saw a Tweet announcing a

By  Sue Poremba | Oct 21, 2010
Print ArticleEmail Article
  • Share on Facebook
  • Share on Twitter
  • Share on LinkedIn

I was reading my Twitter feed today and saw a Tweet announcing a major medical data breach in Pennsylvania.

The breach was caused by a lost flash drive that included names, addresses, and health information of 280,000 people insured by Keystone Mercy Health Plan and AmeriHealth Mercy Health Plans, both based in Philadelphia. According to an article in Compliance in the Cloud:

The breach, which involves the records of Medicaid recipients, is the first such Medicaid data breach in Pennsylvania since at least 1997, according to the state's Department of Welfare, which has oversight.

The breach, one of the largest of the year, is bad enough. That it wasn't disclosed to affected members until the Philadelphia Inquirer began to investigate is disturbing. This follows on the heels of a breach in New York state that happened in July but it appears news of it may not have been released until September (hopefully the potential victims were notified earlier). 

The Pennsylvania law is vague about the time frame that can pass before affected parties should be notified -- it shouldn't be an unreasonable amount of time. However, the Inquirer reported:

The federal website explaining the law says that breaches must be reported "without unreasonable delay and in no case later than 60 days."

Medicaid is funded jointly by federal and state governments. Pennsylvania's agreement appears to require a report within two days. Myers said it was unclear when the companies reported the incident. The federal government did not respond on time.

Shouldn't the innocent victims of a data breach learn about it immediately?

 

Comment and Contribute
(Maximum characters: 1200). You have
characters left.
Get the Latest Scoop with Enterprise Networking Planet Newsletter
Helpful Links

  • Yankee Group Mobile WAN Optimization Report

    Mobile work continues to evolve. Your organization must keep up with the demands of its mobile workforce. This report introduces the concept of mobile WAN optimization and provides three case studies including RCM, PRTM and Einstein that highlight how this emerging technology can help IT departments achieve what previously appeared to be conflicting goals. Read >

  • Network Security Resources

    More threats than ever before pose a danger to today's enterprise network. Get the latest tips and intel on the newest risks in our guide to network security resources. Read >

  • Extreme Savings: Cutting Costs with WAN Optimization

    Did you know it's possible to cut IT costs without impacting day-to-day IT operations? In fact, when you download this whitepaper from Riverbed on cost-savings through WAN optimization, you'll discover how businesses of all different sizes have realized a return on investment in just a few months through significant hard cost savings in areas such as bandwidth reduction and IT consolidation. It's called Extreme Savings and its only from Riverbed. Read >