From securityweek.com
Premera Blue Cross, the largest health insurer in the Pacific Northwest, has agreed to pay $10 million to 30 states following an investigation into a data breach that exposed confidential information on more than 10 million people across the country.
The settlement, negotiated with the Washington attorney general’s office and filed in state court Thursday, comes several weeks after Premera said it would spend $74 million to settle a federal class-action lawsuit on behalf of affected customers.
The states said auditors had alerted Premera to the vulnerabilities in its system, including that it was slow to install software updates and security patches, but it failed to fix them. They accused Premera of failing to meet its obligations to protect the data under the federal Health Insurance Portability and Accountability Act, known as HIPAA, and Washington’s Consumer Protection Act.
“Premera knew they had a problem,” said Washington Attorney General Bob Ferguson. “Their own experts told them. They chose to ignore the advice of their own experts.”