The Illinois Department of Insurance accidentally led to the posting of Social Secrity Numbers of health records online.
How did a 3rd party get caught in a date release of health records? The agency sent records, including social security numbers, to Blue Cross Blue Shield which Blue Cross Blue Shield posted online.
What happened to the 3rd party? The Department of Insurance took immediate corrective measures against Blue Cross Blue Shield
What is the 3rd party’s responsibility? Providing notice to affected persons, whose health records were identifiable by social security number. Potentially also required data protection services paid for by the 3rd party for all affected individuals.
lesson: 3rd party contracts should verify the information received from a state agency complies with all data security laws or the 3rd party maybear the cost of repairing the data breach.