Aetna Breach Demonstrates Not All Breaches Are Hacking Related

When most people think of a data breach, they immediately think of a hacking event. Possibly the image is some person slumped over a computer in a dark room rapidly clicking keys on a keyboard trying to break some network defenses and steal valuable data that can be sold on the dark web. Indeed, that is one type of data breach. However, there are other types too and one of them is an accidental exposure type of data breach. That one is what health insurer Aetna is currently facing.

The company announced this week that a third-party vendor sent letters to approximately 12,000 patients regarding options for acquiring their prescriptions for treatment of HIV. The problem is that the first part of the letter where they mentioned the patients’ HIV status showed through the large address window of the envelopes on some of the letters. This allowed that information to be exposed to whomever saw it.

This is an example of an accidental or unintentional internal data breach. The third party had no intention of exposing the data, but because of a mistake information was seen by family members, neighbors, friends, or even strangers disclosing the status of patients that was intended to remain confidential.

Mistakes to happen. However, there are ways to limit them.

• Thoroughly train employees and third parties on strong security measures. Make the training mandatory and more than just once per year. A good policy is to provide awareness training continually so that everyone is reminded regularly of risks and prevention.

• Restrict what areas of the network employees can and cannot access. This keeps confidential data on a need to know level and limits risk of accidental exposure and the opportunity for internal breaches of all types.

• Review policies regarding your organization’s sensitive data with any third parties you employ. Make sure they understand how you want them to handle your data.

• Aetna has apologized for the mistake and wrote in a letter to those who may have been affected by this that they were going to review their processes to ensure something like this doesn’t happen again. Unfortunately, that’s no comfort to some of the victims of this incident.