Connecticut's health insurance marketplace found out that a backpack full of confidential documents, including residents' Social Security numbers, had been left lying in the street in Hartford last week from a Republican lawmaker, Access Health CT officials said Monday.
Now Connecticut House Republican leaders are criticizing the state-run health care exchange for an "appalling lack of oversight."
The backpack, found outside the Access Health CT office on Trumbull Street in Hartford on Friday, contained four notepads with handwritten names and birth dates of about 400 people, along with the Social Security numbers for 151 people, Access Health CT Chief Marketing Officer Jason Madrak said over the weekend.
The person held responsible is an employee of a company called Maximus, the call vendor for Access Health CT, which was created in the wake of the 2010 health care overhaul.
He apparently left the bag behind when he left a deli after work on Thursday evening and got a ride home, Ilene Baylinson of Maximus said. He left the deli around 4:30 p.m. on Monday and Access Health CT officials found out about it around noon on Friday, when they received a call from the office of state Rep. Jay Case.
Madrak said a member of Case's staff contacted Access Health CT and "indicated that they were in possession of a backpack that looked like it contained information related to some of our members and customers."
Access Health CT officials contacted Hartford police at 2:15 p.m. to report the incident so they could begin investigating. Then, they reached out to Maximus, the Health and Human Services, the state attorney general and then the media.
Local
The Maximus employee came forward after seeing a news report on the backpack on Friday night, according to officials.
He told his employer that he left the deli around 4:30 p.m. on Thursday and realized at home that he did not have the backpack, so he called the person who gave him a ride home. When it did not turn up, he continued to look for it when he went back to work on Friday.
The Maximus employee went home and came forward after seeing a news report on the backpack on Friday night.
“It strikes me as odd that someone felt compelled to compile the data into a notebook and take it from the intake offices,’’ Cafero said in a statement.
Access Health officials are contacting the individuals whose personal information might have been compromised.
Representatives from the health care exchange said individuals whose names were on the notepads will be offered free credit monitoring, fraud resolution, identity theft insurance and credit report security freezes.
"Obviously, we take this matter extremely, extremely seriously and we are extremely sorry that this is taking place. We are working, literally around the clock and as fast as humanly possible to make sure that we eleviate this and, more importantly, working very quickly to put the proper procedures in place to make sure something like this does not happen again," Madrak said.
The owner of the backpack is on administrative leave and “has had all system access privileges revoked,” according to Madrak.
Baylinson said the employee responsible is remorseful, passed a background check and went through security training. There is no reason to believe the information was used for fraudulent purposes, she said.
“This disturbing development highlights the concerns we raised three months ago during a hearing that we were afraid something like this might happen,’’ Cafero said in a statement. “We were told by Access Health CT overseers that our proposals for background checks and other safeguards were not needed, that the security situation was in hand. Clearly, that was not the case.’’
Questions remain on why anyone would be taking notes on information from residents who enroll in the program. The notes can be used to help customers navigate the enrollment process, Madrak explained in the news release.
There is a shredder onsite and employees are supposed to shred any personal information and not take it home.
The company is investigating and in the process of moving toward a "paperless office," so this does not happen again.
"The bottom line is that one of our team members made a mistake. He violated our corporate policies and procedures for personal data," Baylinson said.
He has been placed on administrative leave, Access Health CT officials said on Sunday, and Maximus said the company is moving toward a "paperless" office.
