A CD storing the names, addresses, dates of birth, phone numbers, group numbers and some Social Security numbers of 850 Aetna consumers in Ohio was lost in the mail, the insurer announced Dec. 30.
The Hartford, Conn.-based payer said Aetna Signature Administrators mailed the CD to another office on Sept. 6, 2016, to archive members' personal information. However, an employee at the receiving office found the envelope carrying the CD empty upon arrival. Aetna learned about the misplaced CD Sept. 9 and immediately investigated and contacted the U.S. Postal Service.
Aetna said the CD has not been found, but an investigation indicated the U.S. Postal Service may have discarded and destroyed the CD. Aetna said it has no reason to believe an unauthorized person improperly accessed or misused the information.
Diane McCammon, director of Aetna's privacy office, said in a news release, "We take privacy seriously and sincerely apologize for this incident." Aetna also said it will take steps to make sure the event does not happen again, such as retraining employees on data protection and removing Social Security numbers from data exchanges.
Information about the incident in Ohio was released Dec. 30. However, the Houston Chronicle said 3,000 policyholders' information in Texas was breached when a CD was also reported lost Sept. 9. According to HHS, Aetna likewise reported on Nov. 28, 2016, the number of individuals affected by a data breach involving lost information totaled 18,854.
Editor's note: This article was updated on Jan. 5, 2016, at 10:17 a.m. CT to reflect in the headline the misplaced information affected 850 individuals in Ohio. In addition, a paragraph was added to reflect the incident involving individuals in Ohio was part of a broader data breach.