Press Release

Attorney General reaches settlement with Premera over data breach

July 11, 2019

(Anchorage, AK) – Attorney General Kevin G. Clarkson and 29 other attorneys general filed a settlement today that requires Premera Blue Cross, the largest health insurance company in the Pacific Northwest, to pay $10 million total, approximately $467,000 to Alaska, over its failure to secure sensitive consumer data. Premera’s insufficient data security exposed the protected health information and personal information of more than 10.4 million consumers nationwide to a hacker.

A coalition of 30 states, led by Washington State Attorney General Bob Ferguson, investigated Premera’s cybersecurity vulnerabilities that gave a hacker unrestricted access to protected health information for almost a year.

Under the settlement, Premera will pay $10 million total to the states. The company is also required to implement specific data security controls intended to protect personal health information, annually review its security practices and provide data security reports to the attorneys general. Premera’s $10 million payment to the states is in addition to any payment from the proposed class action settlement, which was filed in federal court in Oregon but not yet finalized by the court.

"In this electronic age, we all need to be vigilant about cybersecurity and that includes companies like Premera who hold sensitive personal and financial information from consumers," said Attorney General Clarkson. "It would be one thing if Premera had quickly notified individuals or tried to improve its security measures when it was alerted to the issues. Instead, Premera continued to downplay the harm and tried to convince consumers their information was still safe. This is unacceptable."

In today’s complaint, Attorney General Clarkson asserts that the company failed to meet its obligations under the federal Health Insurance Portability and Accountability Act (HIPAA) and violated the state consumer protection act by not addressing known cybersecurity vulnerabilities that gave a hacker unrestricted access to protected health information for almost a year.

From May 5, 2014 until March 6, 2015, a hacker had unauthorized access to the Premera network containing sensitive personal information, including private health information, Social Security numbers, bank account information, names, addresses, phone numbers, dates of birth, member identification numbers and email addresses.

The hacker took advantage of multiple known weaknesses in Premera’s data security. For years prior to the breach, cybersecurity experts and the company’s own auditors repeatedly warned Premera of its inadequate security program, yet the company accepted many of the risks without fixing its practices.

The complaint asserts that Premera misled consumers nationwide about its privacy practices in the aftermath of the data breach. After the breach became public, Premera’s call center agents told consumers there was “no reason to believe that any of your information was accessed or misused.” They also told consumers that “there were already significant security measures in place to protect your information,” even though multiple security experts and auditors warned the company of its security vulnerabilities prior to the breach.

Under HIPAA, Premera is required to implement administrative, physical and technical safeguards that reasonably and appropriately protect sensitive consumer information. Premera repeatedly failed to meet these standards, leaving millions of consumer’s sensitive data vulnerable to hackers for nearly a year.

Today’s settlement also requires Premera to:

Ensure its data security program protects personal health information as required by law
Regularly assess and update its security measures
Provide data security reports, completed by a third-party security expert approved by the multistate coalition, to the Washington State Attorney General’s Office
Hire a chief information security officer, a separate position from the chief information officer. The information security officer must be experienced in data security and HIPAA compliance and will be responsible for implementing, maintaining and monitoring the company’s security program.
Hold regular meetings between the chief information security officer and Premera’s executive management. The information security officer must meet with Premera’s CEO every two months and inform the CEO of any unauthorized intrusion into the Premera network within 48 hours of discovery.

Today’s multistate settlement against Premera involves Alabama, Alaska, Arizona, Arkansas, California, Connecticut, Florida, Hawaii, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Massachusetts, Minnesota, Mississippi, Montana, Nebraska, Nevada, New Jersey, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Rhode Island, Utah, Vermont, and Washington.

CONTACT: Assistant Attorney General John Haley at john.haley@alaska.gov or 269-5100.

# # #

Department Media Contacts: Communications Director Patty Sullivan at patty.sullivan@alaska.gov or (907) 269-6368. Information Officer Sam Curtis at sam.curtis@alaska.gov or (907) 269-6269.