business

Blue Cross and Blue Shield of Minnesota, the state's largest health insurer, accidentally published a customer's personal medical information in a handbook prepared for 95,000 members of a popular health care plan, according to the woman's attorney.

The unnamed woman filed suit in Hennepin County District Court this week, accusing Blue Cross of violating the Minnesota Health Records Act and breaching her privacy by disclosing her name and providing confidential information about her medical treatment. While Blue Cross did not describe any procedures she may have received, the company disclosed she had been a patient at the Bemidji Sameday Surgery Center, according to the lawsuit.

Blue Cross spokeswoman Pam Lux said the company discovered the error last year and immediately destroyed or stopped using the material.

"We have very strict standards in terms of protecting personal health information," Lux said. "This was a very isolated incident. Unfortunately, human errors do happen."

State officials and industry experts said breaches of medical records privacy are extremely rare, given the strict laws that govern the release of that type of data. Minnesota law states that insurers cannot disclose any individual's "personal or privileged information" without their written authorization.

"I'm flabbergasted," said Julie Brunner, executive director of the Minnesota Council of Health Plans, a trade group whose members include Blue Cross. "I've never heard of a situation like this."

Marshall Tanick, the woman's attorney, said his client was stunned when she found out last April that her name and claim information were distributed to thousands of people. The handbook provides the dates and places she was treated, as well as the costs of her care.

"This is one of the most blatant and egregious violations of medical privacy I've ever seen," Tanick said.

A spokeswoman for the state Department of Commerce, which regulates insurance companies, provided information about one violation of the state's privacy laws. In 2009, the department suspended the license of agent Gary Scholnick for three months after a life insurance customer complained that Scholnick disclosed the customer's personal information to someone else.

The federal Health Insurance Portability and Accountability Act (HIPAA) prohibits the release of any health information that would identify an individual, including addresses, birth dates and Social Security numbers. The U.S. Department of Health and Human Services Office for Civil Rights investigates alleged violations of HIPAA, which could lead to penalties of up to $50,000.

Lux said Blue Cross conducts rigorous training with its employees several times a year to make sure they follow state and federal privacy laws when handling records for its 2.7 million members. Employees have access to personal medical information on a "need-to-know basis," which does not include marketing, she said.

Lux said that handbooks and other marketing materials are supposed to use "dummy information, not real information, and that was the error that happened. Someone didn't double check to make sure it was dummy information."

After the error was discovered, Blue Cross changed the woman's identification number, Lux said.

Tanick said Blue Cross sent his client a letter last year, notifying her that her personal information was mistakenly published in 400 copies of a pamphlet and in 95,000 copies of a member handbook. A page from the handbook, submitted with the lawsuit, shows that the woman's member ID and claims information were used to illustrate the company's website. Later, an acquaintance of the woman told her they had seen her name in a Blue Cross document, Tanick said.

"It's good to prevent future accidents, but it doesn't alleviate the fact that almost 100,000 people saw this," Tanick said. "The damage has been done."

Lora Pabst • 612-673-4628