Major privacy violation by health insurance company

August 13, 2009 7:16 PM

My health insurance company accidentally sent me someone else's (extremely) personal and confidential information in the mail. They have no idea if or where my own information may have been sent. What should I do?

I recently signed up for individual insurance through a major provider. In the mail I received a "Guide to Your Benefits" type booklet, with my name and address printed on the back, but it contained someone else's information (name, address, social, personal health information for him and his family, credit card number). I was of course shocked and immediately wondered if my information had been sent to someone else as well. The steps I have taken so far are:

1) called insurance company and explained the situation. They told me they would file a formal grievance, and that they have no way of knowing if my information was sent out or where it might have gone, because it's a computerized system. I was very insistent about them informing the other person that their privacy had been compromised, and they told me they would call or mail them. I also informed them I would be filing a "Health Information Privacy Complaint" with the Office of Health and Human Services.

2) filed said complaint with HHS

3) canceled my credit card and placed fraud alert with credit agencies (in case someone did receive my information)

Other than that, is there anything else I should be doing? Should I cancel my insurance policy with them? I think this is a pretty big deal, and obviously a major violation of state and federal privacy laws, and don't want it to just get swept under the rug. I also want to make sure I have protected myself as much as possible.

posted by Dilemma to grab bag (7 comments total)

Have you considered telling the other party yourself? I am not sure I would trust them to do so.
posted by chesty_a_arthur at 7:17 PM on August 13

If you do what chesty recommends (and I think you should, since you'd want the same done for you), have a lawyer draft a letter to them on your behalf explaining what happened and concealing your identity. If I got an unsolicited personal correspondence like that from a stranger, it would scare the shit out of me. Having a lawyer do it would let you do the right thing while still protecting yourself.
posted by felix betachat at 8:24 PM on August 13

I haven't contacted the other party because I'm not sure if that could come back and bite me somehow. I don't really have the funds or time to talk to a lawyer, but I do want this person to know what happened. I feel like I should maybe mail them the booklet I got in the mail, but it has my name and address on it.
posted by Dilemma at 8:45 PM on August 13

Just give 'em a call.
posted by ageispolis at 2:42 AM on August 14

Personally I don't think a lawyer is necessary. Type a note saying that you recently signed up with XYZ Insurance company, and they sent you the enclosed booklet by mistake. Tell them that you filed a formal grievance with the insurance company and a complaint with HHS. Tell them that you didn't save a copy, won't be using their info, etc. but thought they should know so they can file their own complaints. Also, if they accidentally received someone else's information in their booklet, could they be so kind as to destroy it and include that information in their complaint. Include whatever materials the insurance company sent you, but remove your own name and info from any pages that include it.

Throw this all in an envelope, put a stamp on it but no return address, and drop it in a mailbox somewhere. That's not scary, it's good-samaritan-y, and unless they're crazy CSI private eye investigators from some cable tv drama, they're not going to know it came from you.
posted by vytae at 7:28 AM on August 14 [2 favorites]

I'd go the Good Samaritan route as Plan B, but Plan A should be for the insurance company, not you, to inform the other guy that there was a breach of confidentiality. It's their responsibility and their obligation. It'd be nice for you to contact him to tell him that you're the one who received the information and, don't worry, it's been shredded. But he should hear about it from the insurance company first.
posted by mudpuppie at 10:01 AM on August 14

Thanks for the thoughts about how to handle informing the other person. I'm still wondering if there's anything else I should do re. following up with the insurance co., canceling my policy, protecting my identity, though, which are my bigger concerns.
posted by Dilemma at 1:30 PM on August 14