Decoded - Technology Law Insights, V 5, Issue 8, October 2024

“The hacker has created Telegram bots to access data of 31,216,953 customers updated till July 2024 and 5,758,425 claims of the company available till early August.”

Why this is important: Corporate espionage by an insider is every company’s nightmare. It is even worse if the insider is purposefully sharing customers’ personal identifying information (PII) and protected health information (PHI) with bad actors. That was the case with Star Health, an insurance company in India. In this instance, it is alleged that Star Health’s own chief information security officer (CISO) colluded with bad actors to compromise the data of 31 million insureds’ PII and PHI. The breach exposed insureds’ names, PAN numbers, mobile numbers, email addresses, policy details, birthdates, and confidential medical records. The breach was only discovered after third parties alerted Star Health to the possible breach.

If this had happened in the U.S., this breach would have constituted a major HIPAA violation. The breach would have triggered the reporting requirements outlined in the Breach Notification Rule (45 CFR §§ 164.400-414). Specifically, impacted individuals would have to be contacted without reasonable delay, and in no case later than 60 days following the discovery of the breach. The breach notification would be required to include, to the extent possible, a brief description of the breach, a description of the types of information that were involved in the breach, the steps affected individuals should take to protect themselves from potential harm, a brief description of what the covered entity is doing to investigate the breach, mitigate the harm, and prevent further breaches, as well as contact information for the covered entity, or business associate, as applicable. Because this breach would have impacted more than 500 residents of a state or jurisdiction, the covered entity or business associate would also be required to notify prominent media outlets serving the state or jurisdiction. Additionally, if this breach had taken place in the U.S., the covered entity or business associate would also have to contact the Office of Civil Rights within the Federal Department of Health and Human Services without unreasonable delay, and in no case later than 60 days following a breach.

It is well known that an organization’s employees are the greatest risk to the organization’s data because they have the most access. Most of the time, data breaches caused by employees are not malicious. That is why we recommend extensive training so that your employees can easily recognize threats to the organization’s data, develop a culture that values data security so that your employees feel safe reporting potential threats, and limit access to data to only those who need to know the information to do their job duties. While these steps likely would not have prevented the breach that Star Health experienced because its head data privacy officer purposefully provided access to the bad actor in exchange for a bribe, a culture that values data privacy and reporting threats may have minimized the harm by empowering a lower level employee to recognize a possible problem to report it to other high level executives. --- Alexander L. Turner