SACRAMENTO, Calif. (AP) - A health insurance company that provides coverage to 6 million people nationwide said Monday it is missing data servers containing the health records, financial information and Social Security numbers for nearly 2 million current and past clients.
Health Net Inc. said Monday it cannot account for several hard drives from a data center in the Sacramento suburb of Rancho Cordova.
The Woodland Hills-based managed care company would not disclose how many people could be affected, but the California Department of Managed Health Care placed the number at 1.9 million. In a news release, the department said nine server drives are missing and that it is conducting its own investigation into the company's security practices.
"Obviously something went wrong, but we don't know," department spokeswoman Denise Schmidt said.
Health Net, which provides coverage to 6 million people across the country, would not say whether the drives were stolen.
In January, the company agreed to pay $55,000 to settle a similar case with the Vermont attorney general's office. That case arose after the loss of a portable, unencrypted hard drive that contained protected health information, Social Security numbers and financial information for about 1.5 million people. Health Net discovered the drive was missing on May 14, 2009, but did not start notifying affected Vermont residents until more than six months later.
UnitedHealth Group bought Health Net's assets in the Northeast in 2009 and the transition is winding down, Health Net spokesman Brad Kieffer said.
In the latest security breach, Health Net began analyzing its system after IBM, which manages the company's information technology, informed the company that it could not find the drives in question. They contain information for former and past clients, employees and health care providers.
The 1.9 million people potentially affected include more than 622,000 enrollees in Health Net products regulated by the state Department of Managed Health Care, more than 223,000 enrolled in California Department of Insurance products and an unspecified number enrolled in Medicare.
Health Net has notified people whose privacy might have been compromised and offered them two years of credit monitoring. Debix Identity Protection Network will provide identity theft insurance, fraud resolution and restoration of credit files.