A claims management company that violated New York's breach notification law for taking seven weeks to report a missing laptop containing personal information of more than a half-million injured workers has settled with the state.
Under the agreement, Chicago-based CS STARS, contracted to manage the personal data of some 540,000 injured workers receiving compensation from the New York Special Funds Conservation Committee, has been ordered to comply with the state’s Information Security Breach and Notification Law.
In addition, the company agreed to implement new data security solutions and will pay the state $60,000 in fines related to the cost of the investigation.
According to a statement released late last week by the Attorney General Andrew Cuomo, a CS STARS employee noticed the laptop missing ON May 9, 2006, but the company did not report the incident to the state until June 29.
The FBI, which was also notified, requested notifications not be immediately sent due to an ongoing investigation, the statement said. Letters notifying victims were sent on July 18.
A week later, the FBI determined the laptop was stolen by a cleaning contractor and that the private data was not accessed.
Still, the company should have reported the incident "immediately following discovery," as prescribed under law, the statement said.
"This company had sufficient cause to believe that the private information contained in the missing computer had been acquired by a person without valid authorization," Cuomo said. "Had the sensitive personal information fallen into the hands of criminals with the intent of identity theft, there would have been ample time to victimize hundreds of thousands of customers."
A CS STARS representative was not immediately available to comment.
But company spokesman Al Modugno told SCMagazine.com last year that the employee responsible for the laptop never notified senior management about the incident. Once officials were notified, however, they immediately "took the necessary steps to address the matter."
Click here to email reporter Dan Kaplan.