The Washington attorney general asserted that the company failed to meet its obligations under the federal Health Insurance Portability and Accountability Act (“HIPAA”) and violated the Washington State Consumer Protection Act by not addressing known cybersecurity vulnerabilities that gave a hacker access to protected health information for almost a year.

As alleged, from May 5, 2014 until March 6, 2015, a hacker had unauthorized access to the Premera network containing sensitive personal information, including private health information, Social Security numbers, bank account information, names, addresses, phone numbers, dates of birth, member identification numbers, and email addresses.

According to the Washington attorney general, the hacker took advantage of multiple known weaknesses in Premera's data security while. Moreover, as alleged, for years prior to the breach, cybersecurity experts and the company's own auditors repeatedly warned Premera of its inadequate security program, yet the company accepted many of the risks without fixing its practices.

The Washington attorney general asserted that Premera misled consumers about its privacy practices before and after the data breach. In privacy notices, Premera told its members, “We take steps to secure our buildings and electronic systems from unauthorized access.”

According to the Washington attorney general, after the breach became public, Premera's call center agents told consumers there was “no reason to believe that any of your information was accessed or misused.” They also allegedly told consumers that “there were already significant security measures in place to protect your information,” even though multiple security experts and auditors warned the company of its security vulnerabilities prior to the breach.

Under HIPAA, Premera is required to implement administrative, physical, and technical safeguards that reasonably and appropriately protect sensitive consumer information. Premera repeatedly failed to meet these standards, leaving millions of consumer's sensitive data vulnerable to hackers for nearly a year, according to the attorneys general.

The consent decree also requires Premera to:

• Ensure its data security program protects personal health information as required by law;
• Regularly assess and update its security measures;
• Map where HIPAA-protected information, including personal health information, is located on the Premera network;
• Provide data security reports, completed by a third-party security expert approved by the multistate coalition, to the Washington attorney general's office;
• Hire a chief information security officer, a separate position from the chief information officer. The information security officer must be experienced in data security and HIPAA compliance and will be responsible for implementing, maintaining, and monitoring the company's security program;
• Hold regular meetings between the chief information security officer and Premera's executive management. The information security officer must meet with Premera's chief executive officer every two months and inform the CEO of any unauthorized intrusion into the Premera network within 48 hours of discovery;
• Create a compliance program and hire a compliance officer with a background in HIPAA compliance;
• Map where HIPAA-protected information, including personal health information, is located on the Premera network; and
• Provide security training to all employees who handle personal information and protected health information.

Learn more: Consent decree.