BCBS Laptop Theft Leaves 850,000 at Risk

As many as 187,000 files contained doctor SSNs

October 9, 2009

About 850,000 doctors in the BlueCross BlueShield (BCBS) network who accepted out-of-state members have had their personal identifying information potentially exposed via a laptop computer stolen from a BCBS employee, according to American Medical News (AMN).

BCBS became aware last month that a file containing the name, address, tax identification number and national provider identifier number for every physician in the country contracted with a BCBS-affiliated insurance plan was on an employee laptop reported stolen, Jeff Smokler, spokesman for the Chicago-based BCBS told AMN on Oct. 6.

As many as 187,000 of the physicians listed used their Social Security numbers as tax or provider ID numbers, he said.

In violation of company policy, an unidentified employee downloaded the unencrypted BlueCard network physician file, which is updated weekly, to his personal computer to work on it at home. The laptop was stolen in August from an automobile, according to The Pittsburgh Post-Gazette.

“It was a mistake, an unfortunate mistake, but the association and plans involved have moved swiftly and deliberately to rectify the situation,” Smokler told AMN. He told The Globe corrective action was taken but declined to elaborate on the employee’s status. So far, the BCBS hasn’t detected any evidence that the information has been misused, according to the Post-Gazette.

Blue doctors seeing red?

BCBS member associations are notifying network physicians of the breach. Credit monitoring will be offered free to those whose SSNs were in the file, and any other physicians in the file who request the service, Smokler said.

Some 39 BCBS affiliates feed information about their providers into the database maintained by the association’s national headquarters, according to The Boston Globe. Roughly 39,000 physicians in that state were notified by mail of the potential breach.

The BCBS in Massachusetts has made it a priority to persuade state physicians and other health care providers to apply for new tax ID numbers that are not the same as their SSNs, said BCBS-Massachusetts spokeswoman Tara Murray.

A little bit of good news? The Globe reported that the data on the stolen laptop did not contain any patient identification information or personal health records.