The backpack containing personal information on hundreds of clients of Connecticut’s health insurance exchange was left outside a Hartford deli Thursday afternoon by a worker from the exchange’s call center. His employer believes the man, who sat outside the deli while waiting for a ride, left it behind accidentally.
Another man later found the backpack, then called the office of his state representative, Republican Jay Case of Winsted. After the man brought the backpack to the Legislative Office Building, a GOP staffer notified the exchange’s chief executive around noon Friday.
It wasn’t clear why the call center employee left work with notepads containing information about clients in his backpack — a violation of policy — although a call center official described it as a mistake. The call center is now moving toward eliminating employees’ use of paper in the office, said the official, Ilene Baylinson, president of eastern region health services for Maximus, the company that runs the call center.
It also wasn’t clear Monday why the man who found the backpack alerted the Republican caucus, rather than police.
But House Minority Leader Lawrence J. Cafero Jr., R-Norwalk, released a statement saying that the incident showed an “appalling lack of oversight” by Access Health CT, the state’s exchange. And Cafero said it showed that a Republican legislative proposal to expand background checks on exchange employees and vendors had been warranted.
When the bill was proposed earlier this year, exchange CEO Kevin Counihan testified that it was unnecessary and noted that the exchange already required background checks for its employees and vendors. The measure died in committee.
Hartford police and Access Health are investigating the data breach. Officials with Access Health and Maximus said they did not think the employee intended to misuse the data.
The employee cleared a background check and had gone through training on privacy and security issues, Baylinson said during a press conference Monday.
The worker’s backpack contained notepads with handwritten names, birth dates and Social Security numbers. Access Health Chief Marketing Officer Jason Madrak said Monday that the material included information on approximately 413 people, including approximately 151 Social Security numbers.
Why would someone at the exchange call center write down names, birth dates or Social Security numbers?
Madrak said that when people phone the call center, representatives first enter information about the callers into a logging system. Then, if people decide to move forward and apply for coverage, the call center representatives enter information about them into another system. To make that process easier, it’s not uncommon for workers to write down the callers’ information, Madrak said.
Call center workers are now being given wipe boards to use when taking notes, and the call center will stop using paper notepads, Baylinson said.
The call center’s policy has been for paper with personal information on it to be shredded at the end of the day, she said. Workers are prohibited from removing information about customers from the office.
Baylinson said the worker, who is now on administrative leave, was extremely remorseful and that there was no reason to believe the information was used for fraud. Baylinson described him as “one of our better employees.”
“We believe it was an accident,” she said.
The exchange is sending certified letters to people whose information was in the backpack, and will follow up with phone calls, Madrak said. Those people will be offered free credit monitoring, fraud resolution and insurance for identity theft.
Maximus is reinforcing its policies and giving call center staff more training, Baylinson said.
The worker told Maximus officials that he had the backpack and a coat with him while he waited on a chair outside the deli Thursday afternoon. When his ride arrived, he thought he picked up both his coat and the bag but apparently only had the coat, Baylinson said. He looked for the backpack at the office the next day and then went home when he couldn’t find it, she said.
Alex Aldali, who works at New York Deli & More, down the street from Access Health’s Trumbull Street office in Hartford, said he saw a backpack outside while cleaning up one evening last week. He said his boss said to leave it outside. Later, a man asked if he wanted the bag inside. When Aldali said no, the man said he’d take it and return it, Aldali said.