Medical Data CD Recovered in Philadelphia

Clients of Empire Blue Cross and Blue Shield can breathe a little easier as a CD earlier reported missing has turned up in Philadelphia, the New York Times reports.

Magellan Behavorial Services, a third-party contractor that deals with mental health services for Empire disclosed that it had received a phone call from a Philadelphia resident Wednesday who reported he had mistakenly received the CD in January.

It was not immediately clear if the recipients had contacted Magellan due to the NYT story. They did say that the disc was found among other packages received as part of an audio system they had ordered.

Two employees from the company's security team visited the residence to recover the disc, and reported that it appeared it had not been tampered with. Data on the disc would have been easily readable due to the fact that the encryption had been removed.

Since the incident, Magellan has changed its policy and would now keep encryption on any disc it sends out. The fact that no encryption was on the disc may very well have been illegal - privacy laws require businesses to protect medical data from unauthorized access.

This was not the first incident of data loss for WellPoint: in October 2006, the company had data backup tapes holding data on 196,000 members of Anthem Blue Cross and Blue Shield in Kentucky, Indiana, Ohio and Virginia stolen.