The law firm Shulman, Rogers, Gandal, Pordy & Ecker filed the suit against TRICARE, seeking $1000 in damages for each of the 4.9 million affected beneficiaries in the TRICARE program, calling it a case of ‘intentional, willful, and reckless violation of privacy rights’. In addition to the monetary penalty, the lawsuit also requires defendants to offer free credit monitoring to the affected beneficiaries.

While TRICARE had confirmed that the stolen tapes contained Social Security Numbers, names, addresses, phone numbers, and some personal health data, it recently noted that there is no plan to offer free credit monitoring to the affected beneficiaries. Since reading the tapes requires special machinery and interpreting the data in the tapes requires specialized skills, TRICARE believes that the risk to beneficiaries is low.

The lawsuit however demands the court to bar TRICARE and DoD from transferring data in any form, subject to the Privacy Act, until such time that an independent panel of experts verify and confirm that information security has been adequately established. It also asks the court to prohibit the defendants from transporting confidential data off government property unless it has been properly and completely encrypted. And this is in addition to preventing them from transporting records by non-secure means such as unprotected cars, and prohibiting SAIC from accessing or transporting TRICARE information till an independent panel confirms the implementation of adequate security measures.

While the outcome of the lawsuit will determine further course of action for TRICARE, it is evident HIPAA violators have to bear the brunt for negligence and non-compliance. Although TRICARE may now take corrective measures to ensure that such breaches do not recur, this incident could have been completely averted if an integrated security and compliance solution like SecureGRC had been adopted. With its built-in HIPAA compliance support and end-to-end automation, SecureGRC has the capability to ensure conformance to regulatory controls with its built-in policies and best practices that would have alerted in the first place for instance that carrying the tapes was not the best or a secure practice. Every healthcare entity should therefore resort to a comprehensive security and compliance solution to avoid loss of data and consequent loss of reputation.

The post PHI breach lands TRICARE in hot soup appeared first on Aegify.