Medical lab allegedly exposed consumer info on P2P network

The Federal Trade Commission filed a complaint against medical testing laboratory LabMD claiming that in two separate incidents, LabMD collectively exposed the personal information of approximately 10,000 consumers.

LabMD conducts laboratory tests on samples that physicians obtain from consumers and then provide to the company for testing. The company, which is based in Atlanta, performs medical testing for consumers around the country.

The complaint alleges that a LabMD spreadsheet containing insurance billing information was found on a P2P network. The spreadsheet contained sensitive personal information for more than 9,000 consumers, including names, Social Security numbers, dates of birth, health insurance provider information, and standardized medical treatment codes. Misuse of such information can lead to identity theft and medical identity theft, and can also harm consumers by revealing private medical information.

The complaint also alleges that in 2012 the Sacramento, California Police Department found LabMD documents in the possession of identity thieves. These documents contained personal information, including names, Social Security numbers, and in some instances, bank account information, of at least 500 consumers. A number of these Social Security numbers are being or have been used by more than one person with different names, which may be an indicator of identity theft.

Among other things, the FTC claims that the company:

• did not implement or maintain a comprehensive data security program to protect this information;
• did not use readily available measures to identify commonly known or reasonably foreseeable security risks and vulnerabilities to this information;
• did not use adequate measures to prevent employees from accessing personal information not needed to perform their jobs;
• did not adequately train employees on basic security practices; and
• did not use readily available measures to prevent and detect unauthorized access to personal information.

The complaint includes a proposed order against LabMD that would prevent future violations of law by requiring the company to implement a comprehensive information security program, and have that program evaluated every two years by an independent, certified security professional for the next 20 years. The order would also require the company to provide notice to consumers whose information LabMD has reason to believe was or could have been accessible to unauthorized persons and to consumers’ health insurance companies.

The company has tried denying that the had anything to do with making the billing information available on P2P networks, and has claimed that the document was illegally downloaded from LabMD’s computers in 2008 by a security company called Tiversa, but the FTC has denied the company’s petition to negate the civil investigative demands.