healthy4u: Health Net

Still More Electronic Medical Data Chaos, Pandemonium, Bedlam, Tumult and Maelstrom: But Don't Worry, Your Data is Secure

Case 1. Tumult <blockquote>October 5, 2011 New York Times <a href="http://www.nytimes.com/2011/10/06/us/stanford-hospital-patient-data-breach-is-detailed.html?_r=1">Patient Data Landed Online After a Series of Missteps</a> By KEVIN SACK Private medical data for nearly 20,000 emergency room patients at California’s prestigious Stanford Hospital were exposed to public view for nearly a year because a billing contractor’s marketing agent sent the electronic spreadsheet to a job prospect as part of a skills test, the hospital and contractors confirmed this week. The applicant then sought help by unwittingly posting the confidential data on a tutoring Web site. [Got all that? - ed.] In an e-mail sent to a victim of the breach, the billing contractor, Joe Anthony Reyna, president of Multi-Specialty Collection Services in Los Angeles, explained that his marketing vendor, Frank Corcino, had received the data directly from Stanford Hospital, converted it to a new spreadsheet and then forwarded it to a woman he was considering for a short-term job. The position was with Mr. Corcino’s one-man shop, Corcino & Associates, Mr. Reyna wrote in the e-mail, which was authenticated by his lawyer, Ellyn L. Sternfield. The job applicant apparently was challenged to convert the spreadsheet — which included names, admission dates, diagnosis codes and billing charges — into a bar graph and charts, Stanford Hospital officials said. Not knowing that she had been given real patient data, the applicant posted it as an attachment to a request for help on <a href="http://studentoffortune.com/">studentoffortune.com</a> [I wrote about that earlier <a href="http://hcrenewal.blogspot.com/2011/09/new-way-to-get-kids-interested-in.html">here</a> - ed.], which allows students to solicit paid assistance with their work. First posted on Sept. 9, 2010, the spreadsheet remained on the site until a patient discovered it on Aug. 22 and notified Stanford. </blockquote> My, how electronic data can travel when mishandled. Try that trick with 20,000 paper charts ... <blockquote> The hospital, located on the campus of Stanford University in Palo Alto, demanded that the spreadsheet be removed, and the Web site quickly complied. Pressed for time, the job prospect wound up completing the assignment herself and, in the end, did not get hired, Ms. Sternfield said. </blockquote> Ironically, this was all for naught. <blockquote>Mr. Corcino, in his first public statement, attributed the breach to “a chain of mistakes which are far too easy to make when handling electronic data.” </blockquote> Far too easy to make - especially by the dyscompetent. <blockquote>... Breaches of private medical data have become distressingly commonplace, with two substantial ones disclosed in the last week alone. [We don't know the details of those yet; that's for next week - ed.] </blockquote> Case 2: Pandemonium (from same NYT article) <blockquote>In Orlando, officials with Florida Hospital reported that three employees had improperly combed through emergency department records of 2,252 patients, apparently to forward information about accident victims to lawyers. The employees were fired, and law enforcement officials are investigating. </blockquote> Trolling for Torts - is this a new EMR TV game contestant show? Perhaps it could be followed by "<a href="http://hcrenewal.blogspot.com/2011/02/what-was-this-medical-resident-looking.html">Trolling for Tarts?</a>" Case 3: Bedlam (from the same NYT article) <blockquote>Meanwhile, Science Applications International Corporation disclosed that computer backup tapes containing medical data for 4.9 million military patients [that number also amounts to almost 2% of the total U.S. population - ed.] had been stolen from an employee’s car in San Antonio. The data included Social Security numbers, clinical notes, laboratory test results and prescriptions. The company said the risk of harm was low because retrieving data from the tapes would require specialized knowledge, software and hardware. [Who's to say the theft was not by someone with that specialization, or someone paid by same to steal the tapes? - ed.] The Texas breach is by far the largest since September 2009, when a new federal law began requiring disclosures of medical privacy violations involving at least 500 people. Some 330 such episodes have been tallied, including four others that affected more than one million people each. </blockquote> We'd all be buried in stray clinical paper by now if it weren't for computers. Thank god for them! <blockquote>Officials at the Department of Health and Human Services said the new reporting requirements had exposed deep vulnerabilities and encouraged renewed vigilance. </blockquote> Exposed to whom? The blind, deaf and dumb? <blockquote>“We’re moving in the right direction in terms of a culture of compliance,” said Leon Rodriguez, director of the department’s Office for Civil Rights, which investigates medical privacy cases. “Are there still a lot of problems out there? Yeah, my sense is there are still a lot of problems.” </blockquote> The Titanic was moving in the right direction - towards New York Harbor, in fact, when it met a little unexpected obstacle. Perhaps a culture of brains would be better than a culture of compliance... <blockquote>The Stanford breach was notable for the duration of public exposure, and for spotlighting the vulnerability created by a medical provider’s business relationships with outside parties. Last week, lawyers filed suit in state court in Los Angeles, seeking certification as a class action and $20 million in damages from Stanford Hospital & Clinics and Multi-Specialty Collection Services, which is known as MSCS. </blockquote> $20 million might hurt a bit, and might help motivate the organization to hire better and/or more appropriate clinical information management expertise - in house where it belongs (see below). <blockquote>The threat of liability set off a predictable round of finger-pointing. In written responses to questions, Lisa Lapin, Stanford University’s assistant vice president for university communications, said, “MSCS bears the complete and sole responsibility for the breach.” </blockquote> It's their fault, not ours. <blockquote>Ms. Lapin said the hospital had sent the data in encrypted form to Mr. Corcino, who requested it on behalf of MSCS to analyze a strategy for improving billing collections. She said Mr. Corcino had regularly represented himself as MSCS’s executive vice president and had been Stanford’s “primary contact” during a seven-year relationship. MSCS, a five-person firm that audits hospital accounts to maximize reimbursement, possessed the passwords to unencrypt the data, she said. </blockquote> It was all about money and outsourcing. <blockquote>“This mishandling of private patient information was in complete contravention of the law and of the requirements of MSCS’s contract and is shockingly irresponsible,” the hospital said in a statement. </blockquote> It is foolish to believe that someone else can run critical aspects of your business, and it is even more foolish to believe that it is OK for someone else to run critical aspects of your business. <blockquote>Ms. Sternfield, Mr. Reyna’s lawyer, said Mr. Corcino had never been an MSCS employee, but rather was paid a monthly fee to drum up business, typically in face-to-face meetings with health care executives. Mr. Reyna, she said, had no knowledge that the Stanford data had been sent to Mr. Corcino, or that he had passed it on. Mr. Corcino was not authorized to use an MSCS title, Ms. Sternfield said, but she declined to say whether Mr. Reyna was aware of the practice. She acknowledged that Mr. Corcino sometimes used an MSCS e-mail account. In his e-mail to the breach victim, who shared it with The Times, Mr. Reyna wrote that Stanford had sent the file to Mr. Corcino “for a potential MSCS project that would audit paid accounts to verify that the reimbursement was correct.” For his part, Mr. Corcino said in a statement that he was an independent contractor but was “the marketing face of the company,” and that MSCS “allowed me to use the title of executive vice president.” He wrote: “Stanford sent the file to me at MSCS, and I imported the data into a spreadsheet that was forwarded to the job applicant as part of a skills test. I did not intend to provide any personal health information in the file. This was a marketing project.” Without explaining how or why he sent the data to the applicant, Mr. Corcino said MSCS had not trained him properly and faulted Stanford for sending him private information that he did not need. That, he said, was the “first link in a chain of mistakes.” “I regret that Stanford released a file containing unnecessary information,” Mr. Corcino said, “that MSCS did not have an appropriate training and audit system for the handling of electronic data and that I was not more careful with the file. While Stanford and MSCS left the information in the file I received, it was my mistake to not catch its inclusion and remove the data.” ... The hospital has terminated its relationship with MSCS, and Mr. Reyna has done the same with Mr. Corcino. </blockquote> Even I can't follow all that. This will be one convoluted court case... <blockquote>Stanford Hospital has reassured affected patients that the posted spreadsheet did not contain Social Security numbers, birthdates or credit card numbers, and has offered free identity theft protection services. The hospital said it had not uncovered any misuse of the exposed data. </blockquote> Yet, that is. (Is it no wonder that sedatives are among the most highly-prescribed medications?) Moving from the NYT article: Case 4: Tumult (I'm running out of descriptors) <a href="http://newsandinsight.thomsonreuters.com/California/News/2011/06_-_June/Health_Net%E2%80%99s,_IBM%E2%80%99s_negligence_compromised_medical_data,_suit_says/"></a><blockquote><a href="http://newsandinsight.thomsonreuters.com/California/News/2011/06_-_June/Health_Net%E2%80%99s,_IBM%E2%80%99s_negligence_compromised_medical_data,_suit_says/">A large class action lawsuit again Health Net and IBM</a>: California Legal Westlaw Journal Insurance Coverage Health Net’s, IBM’s negligence compromised medical data, suit says June 7 (Westlaw Journals) - Health Net Inc. and IBM face a class-action lawsuit seeking $5 million in damages over the loss of computer storage devices that held the medical histories, financial data and Social Security numbers of 2 million people. Health Net Policyholder Alana Bournas’ class-action complaint in the U.S. District Court for the Eastern District of California alleges that the insurer and IBM breached their duty of confidentiality and negligently allowed the release of highly personal and confidential information of millions of Health Net employees and policyholders. The complaint alleges violation of California’s Confidentiality of Medical Information Act, Cal. Civ. Code § 56; Cal. Civ. Code § 1798.2, which concerns the unauthorized disclosure of customer records; Cal. Bus. & Prof. Code § 17200, the state’s unfair-competition law; and public disclosure of private facts. </blockquote> Companies will either pay the going price for competent employees, or pay for the mistakes of incompetent ones. It would probably be better for society, however, to do the former habitually. <blockquote>The suit says IBM agreed to manage Health Net’s information technology database for five years beginning in 2008. IBM informed Health Net Jan. 21 that it had lost nine disk drives containing the confidential information of 2 million people, including Health Net policyholders and employees. Health Net failed to alert the victims of the breach until March 14, the complaint says. IBM allegedly also failed to encrypt the data, thereby enabling anyone who possesses the hard drives to easily access the confidential information. This puts the victims at an increased risk of identity theft and “other unauthorized uses of plaintiff and class members’ personal information” the suit says. </blockquote> Encryption, a feature now built into mainstream OS's by Microsoft and Apple? (Oh wait...IBM...) <blockquote> Health Net’s attempt to compensate the victims by providing two years of free credit monitoring services through TransUnion is an inadequate remedy for the defendant’s conduct, Bournas says. This “remedy” fails to address unauthorized disclosures of medical information, and the monitoring services only protect against new account fraud but do not address fraudulent activity with existing accounts, the suit says.</blockquote> These executives apparently can't even get the fix straight. <blockquote>Moreover, the complaint says, Health Net has previously been accused of a similar breach of confidential information. In 2009 it lost the same types of records of nearly 1.5 million people and waited six months before notifying the victims. In settling the state of Connecticut’s lawsuit stemming from that security breach, the company promised “to enhance security procedures and training,” the suit says. </blockquote> What can I say? <blockquote>The current breach could have been avoided had Health Net and IBM taken proper precautions and implemented security policies to maintain consumers’ confidential data, according to Bournas. Therefore, the protections granted under California law require that Health Net be penalized for its negligence, she says. The plaintiff notes that millions of people entrusted Health Net with their private data. “At best, defendants’ actions allowed this private information to go astray. At worst, the private information is being viewed, sold, resold, and used for illegitimate and illegal purposes,” the complaint says. The suit is seeking injunctive relief, compensatory damages, declaratory relief, and attorney fees and costs. Bournas v. Health Net Inc., No. 2_11-CV-01262, complaint filed (E.D. Cal. May 11, 2011).</blockquote> I would revise that to say "The current breach could have been avoided had Health Net and IBM hired personnel in adequate numbers with the qualifications and true gravitas (and not laid them off, of course) to maintain consumers’ confidential data." Case 5: Maelstrom (I am reaching to the bottom of the barrel for such descriptors). <a href="http://www.ama-assn.org/amednews/2011/08/01/bisc0801.htm"></a><blockquote><a href="http://www.ama-assn.org/amednews/2011/08/01/bisc0801.htm">Wellpoint recently settled class-action suit in CA</a>. AMA news By Pamela Lewis Dolan, amednews staff. Posted Aug. 1, 2011. WellPoint reaches tentative accord in data breach suit It is the second settlement to come from lawsuits claiming that the company failed to protect the privacy of individual insurance applicants online. WellPoint has reached a preliminary settlement that will, if approved, bring an end to a class-action lawsuit filed more than a year ago. The lawsuit, filed in the Superior Court of the State of California, involves the potential exposure of data belonging to more than 600,000 individual health insurance applicants on a company-run website that allowed insurance applicants to track their applications. The situation came to light when an applicant to WellPoint-owned Anthem Blue Cross of California sued the company in March 2010. The applicant was able to manipulate the web address within the site to gain access to other applicants' information, including names, addresses, dates of birth, Social Security numbers and health and financial information. </blockquote> In other words, probably changing a simple number in the URL brought up someone else's records. Good going there, Wellpoint. What were the programmers thinking? (Were they thinking?) <blockquote>When the suit was filed, the company said an upgrade to the system caused the information to become exposed. The company said a third-party vendor validated that all security measures were in place when, in fact, they were not. Changes were made to the system soon after the situation was discovered.</blockquote> Blame someone else, yet again. <blockquote>In addition to the class-action suit, the company was sued by Indiana Attorney General Greg Zoeller in July 2010. The suit, filed in Marion County Civil Superior Court, alleged that the company violated the Indiana Disclosure of Security Breach Act by failing to notify Zoeller, and the 32,051 Indiana residents affected by the incident, in a timely manner. That suit was settled in early July, when WellPoint agreed to pay a $100,000 fine. As part of the settlement, WellPoint admitted it had a security breach and failed to properly notify the attorney general's office as required by law.</blockquote> <a href="http://www.urbandictionary.com/define.php?term=oy%20gevalt">Gevalt</a>. <blockquote> Under the preliminary settlement in the California class-action matter, WellPoint agreed to offer credit monitoring for two years to all affected individuals. Class members are eligible to receive reimbursement for identity theft losses of up to $50,000 per incident, as well as additional time to file identity theft claims until May 31, 2016. Those making identity theft claims are eligible for an additional five years of credit monitoring. The company also will donate a total of $250,000 to two nonprofit organizations whose efforts are directed at protecting consumers' privacy on the Internet.</blockquote> It might have been cheaper and better for goodwill not to outsource a vital function...those third-party vendors can really hurt you. (I'd really like to know - was this "third party vendor" domestic, or overseas?) <blockquote>WellPoint did not admit wrongdoing in the case, nor was it found guilty. A fairness hearing is scheduled for November, and the courts then will decide whether to approve the settlement.</blockquote> Large corporations are immune from such formalities as admitting wrongdoing or being found guilty. ----------------------- But don't worry. <a href="http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy">Your medical data's safe.</a> Sort of. See also: <ul><li>"<a href="http://hcrenewal.blogspot.com/2010/02/networked-emrs-and-healthcare.html">Networked EMR's and Healthcare Information Security: Practical When Massive IT Security Breaches Continue</a>?",</li></ul><ul><li>"<a href="http://hcrenewal.blogspot.com/2010/02/networked-interoperable-secure-national.html">Networked, Interoperable, Secure National Medical Records a Castle in the Sky?</a>",</li></ul><ul><li>"<a href="http://hcrenewal.blogspot.com/2010/01/it-flaws-and-coverups-of-same-why-i.html">Operation Aurora And a Widespread Reluctance to Discuss IT Flaws: Is Universal Healthcare IT Really a Good Idea in 2010?</a>",</li></ul><ul><li>"<a href="http://hcrenewal.blogspot.com/2010/10/medical-data-breach-of-week-but-your.html">Medical data breach of the week - but your EMR data is secure, trust us, we're IT experts</a>", </li></ul><ul><li>"<a href="http://hcrenewal.blogspot.com/2010/11/insurers-test-data-profiles-to-identify.html">Insurers Test Data Profiles to Identify Risky Clients</a>",</li></ul><ul><li>and <a href="http://hcrenewal.blogspot.com/search/label/medical%20record%20confidentiality">others</a></li></ul> -- SS

Still More Electronic Medical Data Chaos, Pandemonium, Bedlam, Tumult and Maelstrom: But Don't Worry, Your Data is Secure

Case 1. TumultOctober 5, 2011New York TimesPatient Data Landed Online After a Series of MisstepsBy KEVIN SACKPrivate medical data for nearly 20,000 emergency room patients at California’s prestigious…

Đọc thêm »

07 Oct 2011

Medical Data Breach of the Month Department: Health Net Once Again a Star in the Healthcare Renewal Theatre

I have written frequently about the breaches of electronic information security, such as at my posts: <blockquote> "<a href="http://hcrenewal.blogspot.com/2010/02/networked-emrs-and-healthcare.html">Networked EMR's and Healthcare Information Security: Practical When Massive IT Security Breaches Continue</a>?" "<a href="http://hcrenewal.blogspot.com/2010/02/networked-interoperable-secure-national.html">Networked, Interoperable, Secure National Medical Records a Castle in the Sky?</a>" "<a href="http://hcrenewal.blogspot.com/2010/01/it-flaws-and-coverups-of-same-why-i.html">Operation Aurora And a Widespread Reluctance to Discuss IT Flaws: Is Universal Healthcare IT Really a Good Idea in 2010?</a>" <a href="http://hcrenewal.blogspot.com/2010/10/medical-data-breach-of-week-but-your.html">Medical data breach of the week - but your EMR data is secure, trust us, we're IT experts</a> </blockquote> and <a href="http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy">others</a>. This latest medical information breach only affected a mere 2 million people this time. Perhaps we should go for 20 million next time? And then - there were substantial delays in notification (to give identity thieves time to get rich?) <a href="http://www.eweek.com/c/a/Health-Care-IT/Health-Net-Delays-Notification-of-Data-Breach-Involving-2-Million-People-830137/"></a><blockquote><a style="font-weight: bold;" href="http://www.eweek.com/c/a/Health-Care-IT/Health-Net-Delays-Notification-of-Data-Breach-Involving-2-Million-People-830137/">Health Net Delays Notification of Data Breach Involving 2 Million People</a> By: Brian T. Horowitz 2011-03-16 Insurer Health Net waited until March 14 to disclose a data breach discovered on Jan. 21 involving the loss of nine server drives and the data of 2 million customers, employees and health care providers. Health Net, a provider of health insurance to about 6 million people across the United States, has come under fire for reporting the loss of nine server drives at its data center in Rancho Cordova, Calif., nearly two months after it occurred. More than 2 million Health Net members, employees and health care providers may have been affected by the data breach, including about 845,000 California policyholders, according to The San Francisco Chronicle. California regulators are investigating the breach, the newspaper reports. </blockquote> How did this happen? <blockquote>The insurer found out about the security lapse on Jan. 21, when IBM, which manages the company's IT infrastructure, informed Health Net that it was unable to locate server drives, according to a recording on Health Net's data breach hotline (855-434-8081).</blockquote> These drives perhaps are of a new technology, with motorized robotic legs that allow them to walk away. Or perhaps the drives were like this, where the round drive platter stacks perform double duty as wheels: <div style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrqfz2H4v-4ETZab1YQ_pMxAuYJmoss3TKM_4eO7IjmEVyGDcpVOyR7U6MCfqmBAwDwQE8unf7WI7HDUKVwZapo8G_oyT6xzZqPcnmYxP3a836CEjkhE2UPwKYgs0bRWDpd6CV7yMYaehF/s1600/hard_drive_platter_bike_2.jpg"><img alt="" border="0" id="BLOGGER_PHOTO_ID_5585148031017789426" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrqfz2H4v-4ETZab1YQ_pMxAuYJmoss3TKM_4eO7IjmEVyGDcpVOyR7U6MCfqmBAwDwQE8unf7WI7HDUKVwZapo8G_oyT6xzZqPcnmYxP3a836CEjkhE2UPwKYgs0bRWDpd6CV7yMYaehF/s320/hard_drive_platter_bike_2.jpg" style="display: block; margin: 0px auto 10px; text-align: center; cursor: pointer; width: 320px; height: 240px;" /></a>A "mobile" hard drive. Click to enlarge. </div> The drives just rolled away - to the tune of Steppenwolf's "Born to be Wild" ... <div style="text-align: center;"><a href="http://www.youtube.com/watch?v=rMbATaj7Il8"><img alt="" border="0" id="BLOGGER_PHOTO_ID_5585151587729552738" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjcfj8OtLaCfr3LZXkP4FEC-vDFChrOQJKfnWKWbuSnJg-rZd3Js8f-qrm_UJpdBAJ0KZob6Ry_iVAcv8161Ip1F7yJqjYSzM75F4NySHR2Xhcqdf4NB08VBW748DUiMymg-Rh8Em29ha54/s320/easyrider.jpg" style="display: block; margin: 0px auto 10px; text-align: center; cursor: pointer; width: 320px; height: 231px;" /></a>These drives were just Born to be Wild! Click to play. </div> Get your motor runnin' ... head out on the highway ... <blockquote> The health benefits provider began its investigation at that time and learned that the nine drives included personal information for former and current Health Net members, employees and health care providers. The company didn't report the breach to the public until March 14.</blockquote> Gee, thanks. <blockquote>Health Net spokesman Brad Kieffer declined eWEEK's request for additional information on the breach but said, "We continue investigating unaccounted for server drives, and out of an abundance of caution we are notifying our members." </blockquote> "Abundance of caution" and an almost 2-month delay do not belong in the same news story. <blockquote> ... "Given the size and type of data lost, this is a serious breach, and those affected should have been notified and protected immediately when IBM notified Health Net of the loss," Rob Enderle, principal analyst for the Enderle Group, wrote in an e-mail to eWEEK.</blockquote> Indeed. <blockquote> "While the delay was likely due to the belief that these drives were either misplaced or reused and not logged and the hope they would turn up on a maintenance rotation, the exposure to those that may have been compromised is excessive, and for an insurance company not to immediately mitigate this exposure—unforgivable," Enderle said.</blockquote> "Hope/keeping your fingers crossed" and "due diligence/corporate responsibility" also do not belong in the same paragraph. <blockquote>Information included names, addresses, health information, Social Security numbers and/or financial information, Health Net reports. .</blockquote> All the news that's fit to print. <blockquote> The Health Net breach could be the most serious health care data breach since 2008, when incidents affected 2.2 million people at the University of Utah and 2.1 million people at the University of Miami, according to the San Francisco Chronicle report.</blockquote> Since 2008, eh, way back when, ancient history, when dinosaurs ruled the earth? <blockquote>In May 2009, Health Net suffered another security breach in which a portable disk drive holding the medical and financial data on 1.5 million members disappeared from its Connecticut headquarters.</blockquote> The portable disk drives must have robotic legs, too. <blockquote> Data breach penalties for Health Net could be severe, according to Enderle. </blockquote>Perhaps that's why they were crossing their fingers hoping the drives would turn up somehow? Finally, I note that this company has also been busy in recent years making a name for themselves in the Healthcare Renewal Theatre in other ways. They're stars! See <a href="http://hcrenewal.blogspot.com/search/label/Health%20Net" target="_blank">http://hcrenewal.blogspot.com/search/label/Health%20Net</a> -- SS

Medical Data Breach of the Month Department: Health Net Once Again a Star in the Healthcare Renewal Theatre

I have written frequently about the breaches of electronic information security, such as at my posts:"Networked EMR's and Healthcare Information Security: Practical When Massive IT Security Breaches C…

Đọc thêm »

17 Mar 2011

Health Insurers Sanctioned, Fined

It has not been a good few weeks for big US health insurance companies.  First was a report (e.g., <a href="http://online.wsj.com/article/BT-CO-20101122-708949.html">per</a> the Wall Street Journal) that three companies had been suspended from selling Medicare Advantage plans: <blockquote>The U.S. government's Medicare program has ordered three health insurers--Universal American Corp. (UAM), Health Net Inc. (HNT) and Arcadian Health--to stop marketing to and enrolling new members in their Medicare Advantage health and prescription-drug plans, saying the companies violated regulations. </blockquote> In particular, <blockquote>Universal American was told to stop marketing to and enrolling people in its Medicare Advantage plans effective Dec. 5. The action doesn't affect current members or the enrolling of beneficiaries in the company's stand-alone Medicare prescription-drug plans. Health Net had to suspend the marketing of and enrollment in its Medicare Advantage plans and stand-alone Medicare prescription-drug plans as of Friday, as the government said the company's conduct poses a 'serious threat' to enrollees. The sanction doesn't affect the status of current enrollees, however. In a letter Friday to Theodore Carpenter, head of Universal American's Medicare Advantage business, the Centers for Medicare and Medicaid Services alleged the company has a 'longstanding pattern of prohibited marketing practices targeted to highly vulnerable populations in violation' of federal law and guidelines as well as contractual terms with CMS. Universal American is a 'chronic poor performer' with respect to the regulations, according to CMS, which said the company's agents engaged in aggressive sales tactics and abusive behavior, and misled or confused beneficiaries or misrepresented the plan. The agency's letter to Health Net government-programs executive Scott Kelly said the company's conduct 'poses a serious threat to the health and safety of its enrollees,' as a result of the company's 'intractable failure to provide its enrollees with prescription drug benefits in conformance" with laws, guidelines and contract terms.' CMS cited a 'history of non-compliance.' </blockquote> Then, the state of California fined and ordered restitution from multiple companies, as <a href="http://articles.sfgate.com/2010-11-30/business/24951943_1_health-insurers-san-francisco-insurer-dmhc">reported</a> by the San Francisco Chronicle: <blockquote>State regulators Monday fined seven of California's largest health insurers nearly $5 million for systematically failing to pay doctors and hospitals fairly and on time. The California Department of Managed Health Care issued the fines following an 18-month audit in which investigators looked at a small but statistically significant sample of claims. The investigation found the plans were paying on average about 80 percent of the claims correctly, far below the legal threshold of 95 percent. 'Our clear and consistent message is that California's hospitals and physicians must be paid fairly and on time,' said Cindy Ehnes, director of the Department of Managed Health Care, which is charged with regulating the states' health maintenance organizations, or HMOs. In addition to the fines, the companies must pay the doctors and hospitals restitution that is expected to run into the "tens of millions of dollars," Ehnes said. The plans will also be required to come up with a plan to correct the problem and submit to future audits. Failing to pay providers properly makes it tougher for them to survive in the struggling economy, Ehnes said. 'If providers are not paid, patient care and access suffer,' she said. Regulators fined Anthem Blue Cross and Blue Shield of California $900,000 each. United/PacifiCare was fined $800,000 and Kaiser Foundation Health Plan and Health Net were both hit with fines of $750,000. The fines for Cigna and Aetna were $450,000 and $300,000, respectively, for a total of $4.85 million.</blockquote> Please note that some of these companies have become "frequent flyers" on the Health Care Renewal blog.  Anthem Blue Cross in California is a subsidiary of WellPoint. WellPoint, in particular, just appears again and again on Health Care renewal.  A list of all posts about that company is <a href="http://hcrenewal.blogspot.com/search/label/WellPoint">here</a>, and see <a href="http://hcrenewal.blogspot.com/2010/04/what-me-worry-leaders-prosper-despite.html">this post</a> for a list of past ethical and management missteps.  Health Net appeared in both stories above, and appeared on Health Care Renewal <a href="http://hcrenewal.blogspot.com/search/label/Health%20Net">here</a>.  Posts on Aetna are <a href="http://hcrenewal.blogspot.com/search/label/Aetna">here</a>. Having been writing for this blog now for several years, I am struck by how often the conduct of particular health care organizations has been discredited, without any discernible effect on the organization's leadership or course.  It is particularly striking how the attention paid and pay given to the leaders of some health care organizations contrasts with the public record of their organization's bad behavior. In particular, contrast the long catalog of misbehavior by WellPoint, noted above, with the enormous earnings of the company's CEO (more than $13 million in 2009), and her status as a prominent speaker on health care policy (see post <a href="http://hcrenewal.blogspot.com/2010/11/prominent-health-care-policy-advice.html">here</a>).  In the laissez faire, anything goes, wild, wild west economy of today, spearheaded by the financial service companies that lead us to the global economic collapse, it seems that ethical leadership counts for nothing.  This is bad when it applies to the leadership of financial services, whose bad leadership can cost us all a lot of money.  It is worse when it applies to health care, whose bad leadership can cost us our health and our lives. As I have said ad infinitum, to really reform health care, we will need to get accountable, ethical, transparent leadership of health care organizations.

Health Insurers Sanctioned, Fined

It has not been a good few weeks for big US health insurance companies. First was a report (e.g., per the Wall Street Journal) that three companies had been suspended from selling Medicare Advantage …

Đọc thêm »

03 Dec 2010

Managed Care Executives Will Not Limit Rescissions

We have posted before about how certain health care insurance companies/ managed care organizations in California were found to have cancelled individual health insurance policies after the people holding them made substantial claims, supposedly rationalized by minor errors or omissions in the information the people supplied to the companies on their individual applications found after the claims were made. Several companies were subsequently disciplined by the state government for these "rescissions." See posts on rescissions by WellPoint <a href="http://hcrenewal.blogspot.com/2007/03/wellpoint-fined-1-million-for-canceling.html">here</a>, <a href="http://hcrenewal.blogspot.com/2007/07/more-than-half-of-wellpoints-policy.html">here</a>, and <a href="http://hcrenewal.blogspot.com/2008/07/wellpoint-settles-but-has-it-become-too.html">here</a>, and by Health Net <a href="http://hcrenewal.blogspot.com/2007/11/health-net-statements-inoperative-in.html">here</a>. Executives of several such companies testified before a US congressional committee recently, with remarkable results, as reported by Lisa Girion <a href="http://www.latimes.com/business/la-fi-rescind17-2009jun17,0,5870586.story">writing in the Los Angeles Times</a>. First, by way of background, the article suggested that rescissions are widespread: <blockquote>An investigation by the House Subcommittee on Oversight and Investigations showed that health insurers WellPoint Inc., UnitedHealth Group and Assurant Inc. canceled the coverage of more than 20,000 people, allowing the companies to avoid paying more than $300 million in medical claims over a five-year period. </blockquote> Furthermore, <blockquote> The committee's investigation found that WellPoint's Blue Cross targeted individuals with more than 1,400 conditions, including breast cancer, lymphoma, pregnancy and high blood pressure. And the committee obtained documents that showed Blue Cross supervisors praised employees in performance reviews for rescinding policies. One employee, for instance, received a perfect 5 for 'exceptional performance' on an evaluation that noted the employee's role in dropping thousands of policyholders and avoiding nearly $10 million worth of medical care. </blockquote> Nonetheless, the executives were not prepared to abandon rescissions: <blockquote> Executives of three of the nation's largest health insurers told federal lawmakers in Washington on Tuesday that they would continue canceling medical coverage for some sick policyholders, despite withering criticism from Republican and Democratic members of Congress who decried the practice as unfair and abusive. The executives -- Richard A. Collins, chief executive of UnitedHealth's Golden Rule Insurance Co.; Don Hamm, chief executive of Assurant Health and Brian Sassi, president of consumer business for WellPoint Inc., parent of Blue Cross of California -- were courteous and matter-of-fact in their testimony. But they would not commit to limiting rescissions to only policyholders who intentionally lie or commit fraud to obtain coverage, a refusal that met with dismay from legislators on both sides of the political aisle. Sassi said rescissions are necessary to prevent people who lie about preexisting conditions from obtaining coverage and driving up costs for others. 'I want to emphasize that rescission is about stopping fraud and material misrepresentations that contribute to spiraling healthcare costs,' Sassi told the committee. But rescission victims testified that their policies were canceled for inadvertent omissions or honest mistakes about medical history on their applications. Rescission, they said, was about improving corporate profits rather than rooting out fraud. </blockquote> Also, <blockquote> Late in the hearing, Stupak, the committee chairman, put the executives on the spot. Stupak asked each of them whether he would at least commit his company to immediately stop rescissions except where they could show 'intentional fraud.' The answer from all three executives: 'No.' </blockquote> This is just amazing. Here are executives of three of the country's largest for-profit health care insurance companies/ managed care organizations asserting they will continue cancelling peoples' policies after they make claims, simply because of minor errors or omissions in the application documents that have no bearing on the particular claims, or on discrepancies between information provided by patients and doctors, given that patients may not have full access to or understanding of what is in their charts. What good is an insurance policy that is liable to be cancelled as soon as one makes a claim on it? Whatever these companies are selling, it is not insurance. Basing our health care system on their products is foolish, but that is what we are doing, and what many political leaders would continue to do. In my humble opinion, if we are going to have a system based on privately provided insurance, that insurance has to be honest, unlike what some of our largest insurance companies seem to be peddling.

Managed Care Executives Will Not Limit Rescissions

Đọc thêm »

19 Jun 2009

Load more posts