Personal data stolen from Access Health CT?

The facts are not in yet, but it looks like an employee or contractor at Access Health CT – the Obamacare exchange for Connecticut – may have stolen the names, dates of birth and social security numbers of 400 people who are either enrolled or applying to the program.

From The Hartford Courant.

A backpack found on Trumbull Street appears to have contained personal information from accounts associated with Access Health CT, the state’s health insurance exchange.

The backpack contained four notepads with personal information for about 400 people, the chief executive of the exchange, Kevin Counihan, said in an emailed statement.

Four notepads? It looks like an insider who had access to either the computer files or written applications just started copying the information by hand and walked out of the office with the information.

“Let me be clear: We are sorry this happened,” Counihan said. “This is a very serious situation and we will hold the person or persons who are responsible to account. We will work tirelessly until we have remedied this problem and can prevent any such reoccurrence.”

This is a problem not unique to state health care exchanges. It’s amazing how willing we are to hand over our social security number to someone over the phone or in person. At least when you enter private information online, there should be a secure, encrypted connection between your computer and the computer with the encrypted database. But as we’ve learned recently, information can be snagged in transit, and there will always be an employee or contractor who has access to information in the database.

Then there is credit card fraud. Earlier this year I completed a transaction with a company online, and the credit card data was “skimmed” at some point during the transaction. The connection was “secure” but there were files placed on the server that skimmed the data and pushed it – decrypted – to another server. A few months later, hundreds of people reported unauthorized transactions. I got hit for almost $600, and someone in New Jersey picked up a nice new projector from Fry’s Electronics. I got my money back, Fry’s took the hit.

I tell ya… there seems to be a tremendous opportunity here for an entrepreneur to come up with a better way of doing this.