Maintaining reasonable policies and procedures governing its collection, use, and retention of patient information and.Reporting all data breaches immediately.Continuing to employ an executive or officer who shall be responsible for implementing, maintaining, and monitoring the Information Security Program.Continuing to develop, implement, and maintain a written Information Security Program that will comply with applicable laws and regulations.Not misrepresenting the extent to which it maintains and protects the privacy, security, or confidentiality of consumer information.Under the settlement EyeMed has agreed to implement additional privacy and security measures to improve the protection of consumers’ information. After the unauthorized user gained access, approximately 2,000 phishing emails were sent from the compromised email account. “This settlement is about holding companies like EyeMed accountable and protecting consumers from the harms of identity theft and fraud.”Īn unauthorized user gained access to the EyeMed email account in June 2020, exposing approximately six years of personal and medical information, including Social Security numbers, full names, addresses, dates of birth, phone numbers, email addresses, vision insurance account/identification numbers, medical diagnoses and conditions, and treatment information. “EyeMed was careless with the most sensitive personal information of over two million consumers, including thousands of Oregonians, and that is simply unacceptable,” said Rosenblum. Pennsylvania also joined in the settlement.

Oregon co-led with Florida and New Jersey a multistate investigation that found problems in EyeMed’s data security program, which contributed to the breach in violation of state laws and the federal Health Insurance Portability and Accountability Act (“HIPAA”).

Into the breach 2 download