Connecticut AG Richard Blumenthal is suing health provider Health Net over a lost external hard drive that contained sensitive information for 1.5 million past and present customers.  Under the new HITECH legislation passed last year, states can obtain statutory damages in the event of a HIPAA security breach.  The hard drive was not encrypted.

In a related story, BCBS of Tennessee just notified the public about a data breach affecting 500,000 customers.  57 unencrypted hard drives have gone missing.  The drives contained names, birth dates, social security numbers, and diagnostic healthcare information.  BCBS will pay for credit monitoring.  No word on HITECH penalties or lawsuits yet.

Data Security, Healthcare, Portable Storage