Human error’ leads to second privacy breach on Vermont Health Connect

by Alicia Freese vtdigger.org On Monday night, a Vermont Health Connect user was mistakenly given another user’s private information. It was the second breach of privacy that has occurred during the rollout of the state’s health insurance exchange, according to Mark Larson, commissioner of the Department of Vermont Health Access.
Larson ‘ who was publicly reprimanded by both Gov. Peter Shumlin and House Speaker Shap Smith for failing to disclose the previous breach ‘ shared the news during a House Health Care Oversight meeting on Tuesday.
The incident, according to Larson, was limited to two individuals with the same first and last names, and it was the result of a human error, not a technological problem.
Larson described the event as a ‘privacy incident,’ emphasizing that it did not constitute a ‘security breach’ because no one broke into the system.
What happened, according to Larson, is one user called a customer service representative to make a change to their application. The representative accidentally attached another user’s personal information to this caller’s account in the process of documenting their request.
The caller later noticed that another person’s information had been included in their account. They immediately notified the department, and DVHA has since reported the incident to the Centers for Medicare and Medicaid Services.
The sole question from lawmakers came from Sen. Sally Fox, D-Chittenden, who wanted to know whether Vermont Health Connect users have to provide information, in addition to their names, to verify their identity on the phone. People are required to answer additional security questions, Larson said. The incident occurred after the questions were asked.
‘We are not raising it because we feel there is a risk to other Vermont Health Connect users,’ Larson told the committee.
Asked whether he could assure Vermonters that a similar event won’t occur, Larson responded: ‘We’ll do a review of all of our procedures to see if there are more steps that we can take. It is unique to have two people with the exact same name.’