HARTFORD — A call center worker has been identified as the owner of a backpack containing personal information from about 400 accounts associated with Access Health CT, the state's health insurance exchange.
According to a press release Sunday from Access Health spokeswoman Kathleen Tallarita, the employee came forward on his own after hearing of the backpack's discovery on TV. The employee is from Maximus, the organization's call center vendor. The individual, who was not identified, has been placed on administrative leave and has had all system access privileges revoked, according to the press release.
"While we are still working to understand exactly why this person took the information out of the building, based on what we have learned so far it does not appear there was malfeasance on the part of this person," the press release said.
Access Health CT senior management and senior Maximus representatives plan to meet Monday morning in Hartford to continue the investigation and "determine any actions necessary to ensure this does not occur again," according to the release.
The backpack found on Trumbull Street Thursday contained four notepads with personal information for about 400 people. The information included a mix of names, Social Security numbers and birth dates of customers of the state's health insurance exchange. On Sunday, officials said fewer than 200 Social Security numbers were contained on the pads.
Access Health CT officials said Sunday that notes similar to those found in the backpack are sometimes made by call center representatives to assist clients as they navigate through the enrollment system but that it is "expressly prohibited" for the information to leave the call center.
Access Health CT chief operations officer Peter Van Loon said Saturday that people whose information was compromised were being notified.
"Access Health CT has begun calling individuals whose names were handwritten on the work papers to inform them of this potential breach," he said. "Consumers will be offered the following remedies … at no cost: credit monitoring, fraud resolution, identity theft insurance, and security freezes of credit reports."
Friday afternoon, Tallarita said she did not know exactly what time the backpack was found or how close it had been to the exchange's office at 280 Trumbull St.
Hartford police sent officers to the exchange office about 2:15 p.m. to meet with an Access Health CT employee "regarding an employee possibly taking customers' personal information," Deputy Police Chief Brian Foley said Friday. Police are investigating.
The circumstances surrounding the backpack's discovery were unclear.
In a written statement Friday, Access Health CT CEO Kevin Counihan said he had directed staff to work with Maximus, the exchange's call center vendor, and the exchange's outreach team to address the issue of any potential identity theft.
Access Health CT said its legal department is filing required state and federal information breach reports.
"As we said [Friday], we are sorry this happened," Van Loon said. "This is a serious situation that we are working to rectify as quickly as possible, and we'll do whatever is necessary to try to prevent it from happening again.
Access Health CT is Connecticut's public health exchange. It is an online marketplace for health insurance and is the only place people can buy coverage in the state and get a tax credit, or subsidy, if they qualify. The Affordable Care Act, sometimes called Obamacare, called for state exchanges to bring price transparency and competition to the health insurance market.
During the enrollment period from October through March, 208,301 signed up for coverage through Access Health CT, which includes 78,713 who bought private plans and 129,588 who were income eligible for government-funded Medicaid.
The backpack containing information about Access Health CT customers was found in Hartford on Thursday. The date was incorrect in an earlier version of this story.Copyright © 2015, CT Now