Further updates regarding the security breach of Anthem's online application tracker program.
As of today, 470,000 individual subscribers have been notified of a potential compromise. 230,000 are in California, the rest across the various Anthem states.
There are some disturbing bits of information surfacing.
Apparently the breach went on for quite some time and was only discovered in March when an attorney who breached the system filed a class action lawsuit regarding the breach. I have at least two clients who were breached as far back as November, 2009.
Perhaps the most troubling is that, according to the Atlanta Journal-Constitution, a company investigation has yet to identify 10 computer addresses (IPs) that accessed information. This is of concern as this would indicate that these 10 breaches were not conducted by the attorney(s) and are IP addresses of unknown hackers.
I will update when I receive additional information. Questions for California subscribers should be addressed to Anthem individual membership at 800-333-0912.
Some current press articles on the Wellpoint/Anthem breach:
Reuters
Associated Press
Anthem Blue Cross CA Security Breach Update Pt IV
Anthem Security Breach Update
Article from the Orange County Register indicating that more than 200,000 affected so far by the security breach of the Anthem Blue Cross Online Application Tracker.
Orange County Register Article
According to the article, the attorneys who breached the system have returned all of the improperly obtained private information to a custodian of the court system. I expect that means that everyone who was affected by the breach can be assured that their private information is now safeguarded.
For clarification to the majority of my clients, this security breach does not impact HIPAA applications (nor small group). The application tracker program allows applicants (and apparently others) for individual & family plans to view a PDF of the electronic application. This PDF file contains the full application information including PHI and financial information.
HIPAA applications, like other "paper" applications, are not rendered to PDF for viewing and list on agent services as "application not submitted online -- not available for viewing". They are also not eligible for the application tracker program even though an e-mail is generated indicating it's availability.
Part Deux: Is The California Individual & Family Health Insurance Market In Critical Condition?
Having recently watched the "bi-partisan" meeting in Washington and many videos on youtube, I wonder if the problem is "un"-fixable.
Speaker Pelosi, in a recent youtube video answering questions on the meeting, pointed out two things which are absolutely of concern. 1, our health insurance system is employer-based in design and function. 2, there are many more people not covered under the employer-based system who choose to remain on the sideline than those who participate in the non-employer health insurance market.
I won't go through the numbers again since they are covered under part one of this topic below. Suffice to say, nearly two-thirds of those who should participate in the health insurance market in California for individual & family coverage do not. No employer-sponsored health plan, whether fully insured or self-funded, could operate at a participation level of 33% or less. Employer plans require 75% of all eligible employees to participate. I have worked in the past for employers who made it mandatory to buy a health plan through their fsa/cafeteria plan unless one had a valid waiver (so as not to mess up participation).
With rare exception, most every vlog I have seen, including the grilling of Anthem/Wellpoint CEO Braly in Washington, have had a nasty, negative tone. While it is without doubt that people are upset by the rate changes and popular press, there are implications to this notwithstanding the fact that my study below shows that even with the "massive" rate increase, Anthem prices below most of the other California carriers for like coverage (including 2 not-for-profits).
Now here's your "inside scoop" for the day, dear readers. I have it on good authority that a very large health insurance company in California (which shall remain anonymous), in the last six months, approached the state regulatory agency/ies to review the option of cancelling the individual & family market product and bailing out. To be clear as to what is at stake....
IN THE LAST SIX MONTHS, ONE OF THE LARGEST HEALTH INSURANCE COMPANIES IN CALIFORNIA ADDRESSED TO A STATE REGULATORY DEPARTMENT THE POSSIBILITY OF NO LONGER SELLING HEALTH INSURANCE TO INDIVIDUALS & FAMILIES IN CALIFORNIA.
The writing is on the wall across the spectrum of carriers. Sales of new plans are flat. HIPAA plans have been reformated to high deductibles and expensive HMO plans to stem the bleeding in that pool. Programs like Tonik for individuals and BeneFits for small group have experienced less-than-stellar sales.
The only two PPO programs (non-HIPAA) that are selling at all right now are SmartSense by Anthem and VitalShield by Blue Shield. Even in those cases, the sales of new plans is not keeping up with the cancellation of existing subscribers.
Anthem has launched three new product portfolios for IFP in the last six months--Core Guard, Clear Protection, and coming April 1, Premier. I will be curious to see whether or not new enrollments in these plans (lower cost) will overtake defections off of coverage as is the current trend.
Until and unless this trend shifts, the IFP market is going to be chaotic at best. Continuous premium increases will become the norm, and this in turn will drive more people off of coverage which will create a repetitive cycle.
So, Dave, you ask, what is your solution to the problem?
Well, I see two choices.
One, like Speaker Pelosi mentioned, mandate coverage and penalize those who do not participate. Increase participation to as close to 100% as possible, guarantee-issue health insurance coverage with no pre-existing conditions problems and create an incentive (tax or othewise) for people to participate in addition to a penalty.
Two, and this is one I may favor over the first one, kill off all non-employer coverage plans and go to a single payer exchange for coverage (with a mandate or incentive). The exchange could offer compliant private plans from carriers that wish to offer them and/or public plans like Medicare/FEHB or other plans designed under federal mandates. Allow carriers to sell private plans outside of the exchange to those who can qualify and wish to purchase outside of the exchange.
Make the exchange available to those who cannot obtain employer-sponsored coverage and do not wish to or cannot purchase a private plan outside of the exchange. Also, provide that any employer under 20 employees (2-19) who chooses the exchange over the group plan must pay a penalty per employee to the exchange, and any company over 20 employees must either provider group coverage or pay a payroll tax penalty per employee to the exchange.