Privacy & Information Security Law Blog

On July 11, 2019, Washington Attorney General Bob Ferguson announced that his office had entered into a consent decree and $10 million settlement with Premera Blue Cross (“Premera”) that stems from a 2014-2015 breach that affected more than 11 million individuals. The settlement, which includes a payment of roughly $5.4 million to Washington state and $4.6 million to a coalition of 29 other state Attorneys General (the “Multistate AGs”), is one of the largest ever for a breach involving protected health information (“PHI”) and comes just one month after another notable HIPAA settlement involving a similar coalition of state AGs.

In March 2015, Premera announced that a hacker had gained entry to its systems and accessed a wide swath of PHI it maintained, including names, Social Security numbers, bank account information, addresses, phone numbers, dates of birth, email addresses and other health information. The hacker was able to exploit numerous vulnerabilities in Premera’s network, including inadequate safeguards against phishing attempts, ineffective password management policies and inadequate patch management. Premera had been previously notified of such vulnerabilities by its internal auditors and information security consultants.

In the complaint against Premera, the Washington AG asserted that Premera may have violated the HIPAA Privacy and Security Rules by:

• not reviewing and modifying security measures as needed to reasonably protect electronic PHI (“ePHI”);
• failing to conduct an accurate and thorough risk analysis of the risks and vulnerabilities to the confidentiality, integrity and availability of ePHI;
• neglecting to regularly review records of information system activity, such as audit logs, access reports and security incident tracking reports;
• failing to implement policies and procedures to guard against, detect and report malicious software;
• permitting unauthorized access to PHI; and
• failing to adequately train its workforce members.

The complaint also alleges that Premera engaged in unfair and deceptive acts or practices by (1) misrepresenting that it adequately safeguarded personal information and PHI, and (2) failing to remedy or mitigate known security risks.

The consent decree requires Premera to pay a total of approximately $10 million to the affected states and develop a compliance program that obligates Premera to:

• regularly assess and update its security measures;
• map all PHI stored on the Premera network;
• provide periodic data security reports from an independent third-party security expert to the Washington AG;
• hire a chief information security officer (“CISO”) and hold regular meetings between the CISO and Premera’s executive team, including at least every two months with Premera’s CEO;
• hire a compliance officer with a background in HIPAA compliance; and
• provide security training to all workforce members who use or disclose personal information and PHI.

In announcing the settlement with Premera, Washington AG Bob Ferguson stated, “Premera had an obligation to safeguard the privacy of millions of Washingtonians – and failed. As a result, millions had their sensitive information exposed. Premera repeatedly ignored both its own employees and cybersecurity experts who warned millions of consumers' sensitive health information was at risk.”

In addition to the settlement with the Multistate AGs, Premera is also finalizing the settlement of a class action lawsuit in connection with the breach. That proposed $74 million settlement is currently awaiting approval in federal court.