The new state health insurance exchange in Minnesota is under fire for an accidental security breach.
It is reported that an employee of the Minnesota Exchange erroneously emailed confidential information of approximately 1,600 insurance agents to another agent who was not authorized to see the information. The disclosed information included Social Security Numbers, names, addresses and other information, and was housed in an un-encrypted Excel spreadsheet.
The mistake was immediately recognized and the recipient was asked to permanently delete the information. The breach was a result of human error and reportedly violated Exchange policy. The individual who caused the breach is no longer employed by the Exchange.
This event serves as a wake-up call to the Exchanges, which must have processes and procedures in place to protect the large amount of sensitive data they retain.