Insurance Firm Notifies 156K Victims

An Illinois-based brokerage firm that works with employers, businesses and consumers to obtain various types of insurance coverage is notifying nearly 156,000 people that their protected health information was compromised in a data theft hack that occurred more than a year ago. Why the delay?

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

The incident is shining a spotlight on the difficulties many HIPAA-regulated entities and other organizations face in meeting regulatory breach notification and reporting deadlines.

In some cases, breached organizations are spending a year reviewing a huge number of breached documents when they could get the list of victims from reports in a few days, said regulatory attorney Aleksandra Vold, a partner at law firm BakerHostetler. That means “not only that money was wasted on the document review, but the entity is at a much greater risk of regulatory and consumer backlash due to the timing of the notice.”

Alera Group said it first learned of unauthorized activity in its IT environment in August 2024 and “immediately” launched an investigation to determine the data involved.

“On April 28, Alera Group confirmed that personal information may have been removed from its network as the result of unauthorized access to the Alera Group technology environment that occurred between July 19, 2024, and Aug. 4, 2024”

The affected information varies among individuals, but potentially includes name, address, date of birth, birth and marriage certificate, Social Security number, driver’s license, financial account or credit card information, passport and other government-issued identification such as taxpayer ID or state ID.

Also potentially compromised information includes medical history, condition, diagnosis information, medications, treatment and testing information, medical record number, insurance or claims data, Medicare or Medicaid ID, digital signature, biometric information, usernames and password information.

Alera Group reported the hacking incident as a HIPAA breach to the U.S. Department of Health and Human Services on July 29, about a year after the discovery of the incident.

Under the HIPAA breach notification rule, covered organizations must notify HHS and affected individuals of breaches affecting 500 or more individuals “without unreasonable delay and in no case later than 60 days following a breach.”

Alera – a HIPAA business associate to covered entities – also reported the data breach to several state attorneys general in recent weeks and days, including Texas, Maine and Washington State.

Short Deadlines

Some states have even shorter breach reporting deadlines than HIPAA. Washington State, for example, has a 30-day data breach reporting deadline.

But many states have exemptions for HIPAA-covered organizations, meaning those shorter timelines do not apply to PHI, Vold said.

“That being said, the goal should always be to notify as quickly as possible – 60 days is the last day for compliant notification,” she said.

It’s also important to address that there are two different discovery dates and timelines at play when a business associate, such as Alera, has a breach, she said.

“The business associate date of discovery is the day on which it knew or, with reasonable investigation should have known, that PHI was subject to a use or disclosure that is not permitted by the HIPAA Privacy Rule,” she said.

“That discovery by the business associate does not constitute a discovery by the covered entity whose PHI was impacted. However, Alera did not share when it learned of specific covered entities impacted or when it began notifying those covered entities,” she said.

It is possible that Alera notified some of the affected covered entities within 60 days of learning that they were compromised, and that notice went out within 60 days after they received the notification, which would technically not be late notice, she said. “It is unlikely, however, that business associates would not know of at least some covered entities earlier than eight to 10 months after the fact.”

Alera Group did not immediately respond to Information Security Media Group’s request for additional details about the hacking incident and its breach discovery.

But in a statement to ISMG, the company hinted about some factors contributing to why the notification took so long.

“We are entering the final phase of the notification process that began recently and beginning to notify the impacted individuals, most of whom Alera Group does not have a direct relationship with,” an Alera spokesperson told ISMG.

“These individuals are related to the businesses who are our clients and partners, and we wanted to be sure our partners were properly informed and prepared before they receive questions from potentially impacted individuals. We look forward to continuing to meet our clients’ needs.”

Many HIPAA breach notifications lag well beyond the 60-day reporting deadline for breaches that affect 500 or more people (see: Small Rural Hospital Reports Big 2023 Hacking Breach).

But for the most part, HHS’ Office for Civil Rights has only mentioned late breach reporting in a small handful of HIPAA enforcement cases over the years, and most of those were tied to cases also involving delayed detection of breaches (see: Delayed Data Breach Detection Facing Consequences).

Most recently, HHS OCR took such an HIPAA enforcement action against Syracuse ASC LLC, which does business as Specialty Surgery Center of Central New York.

HHS OCR last month in its $250,000 financial settlement with Surgery ASC cited delayed breach notification as one of several potential HIPAA violations the agency found in its investigation of a ransomware breach at the practice affecting nearly 25,000 patients in 2021 (see: Feds Fine Surgery Practice $250K in Ransomware Breach).

Taking Action

Regulators at the state and federal level appear to be losing their patience with delayed breach reporting, some experts said.

“We are seeing a trend in new and proposed legislation at the state and federal levels with shorter reporting time requirements,” said Jon Moore, chief risk officer at privacy and security consultancy Clearwater. “I believe the hope is that faster reporting will allow affected individuals and organizations to take action to minimize the impact of a breach.”

“Often, organizations don’t know the full breach scope at reporting time but file timely initial notifications and update later as details emerge, as seen with Change Healthcare’s February 2024 ransomware attack, where they promptly notified OCR and clients, then progressively updated the affected count from millions to over 192 million as investigations advanced,” he said.

Under the HIPAA breach notification rule, the primary acceptable reason for delaying reporting beyond the 60-day deadline is a formal request from law enforcement if immediate notification would impede a criminal investigation or harm national security, Moore said.

“Difficulty in identifying compromised electronic PHI does not typically justify exceeding the timeline; regulators expect entities to report based on initial discovery with available information and update later as the investigation progresses, as seen in guidance emphasizing no delay for complete probes,” he said.

Other potential reasons for delayed reporting, though not statutorily defined, might include extreme circumstances like ongoing threats requiring containment to prevent further harm or coordination in multi-jurisdictional incidents, he said.

“But these are evaluated case-by-case and must demonstrate reasonable diligence to avoid enforcement. It is important to note that while these might be operationally understandable, they’re not legal grounds for delay.”

HHS OCR will still measure against the “without unreasonable delay” standard and can penalize if it sees procrastination, Moore said.

“We recommend, if an entity has a reasonable belief the breach will affect 500 or more individuals, it should file a timely preliminary notification to HHS OCR and/or its clients and update as more details emerge, mirroring practices in large incidents like Change Healthcare.”

Besides the wrath of regulators, organizations that appear to dawdle on their breach notification duties are also often called out in civil lawsuits.

Alera already faces several proposed federal class action lawsuits related to the hacking incident. At least one of those complaints is specifically asking whether Alera violated data breach notification laws “by failing to promptly notify plaintiff and class members that their private information had been compromised.”

Vold advises that timely and accurate breach reporting and notification is often a balancing act.

“Maintaining focus and efficiency in the data review is key to getting to notice more quickly – and being comfortable with the risk/benefit trade-offs inherent in choosing between complete accuracy – going through all the documents one by one, and timeliness – reviewing the types of documents involved to make an educated but overly inclusive determination on notice population,” she said.

“Spending a year reviewing hundreds of thousands of documents just to determine that all patients need to be notified when the entity could have searched the files impacted for things like yearly patient census reports and came to the same outcome in three days means not only that money was wasted on the document review, but the entity is at a much greater risk of regulatory and consumer backlash due to the timing of the notice. “