Professionalism/Tom Yardic and Blue Cross Blue Shield of Minnesota

The Blue Cross Blue Shield Association (BCBSA) is a large 501(c)(4) public welfare organization formed under the merger of Blue Cross and Blue Shield in 1982 [1]. BCBSA is an entity composed of 35 distinct health insurance companies in the United States. In 2018 Tom Yardic, a cybersecurity engineer at BCBS of Minnesota, raised internal concerns about critical vulnerabilities discovered on company servers. Over 200,000 critical vulnerabilities were detected, which infiltrated over 2000 separate servers. Some of the earliest threats dated back to 2010, and more than half of them existed for more than three years. This ongoing problem heightened the risk for clients at BCBS of Minnesota. While BCBS of Minnesota is only a chapter of the national BCBSA, they still insure an mighty 3.9 million clients. The insured contracts hold a monetary value of approximately 6 billion dollars. New cloud-based healthcare innovations have emerged in the past few years and increased physicians' efficiency, thus allowing more patients to be served per medical practice. However, vulnerabilities in these systems can lead to potential medical fraud and other leaks.

In September of 2019 his team had still ignored his requests to install software patches. Since BCBS had failed to adequately address the detected vulnerabilities, Yardic escalated the issue by emailing the CEO and Board of Trustees explaining how severe the issue was on September 16th. “I am sending this e-mail because I have been unable to impact the situation within the avenues the organization provides,” wrote Yardic. “What has not happened is a serious attempt to remedy the situation.” Yardic ultimately left BCBS to continue his career as a process improvement consultant, but not before he confirmed the issues would be addressed. In December of 2019 BSBS released a statement from its IT security officer highlighting their dedication to cybersecurity only days before their systems' flaws were made public in local news. The company dedicated time in 2020 to repairing and patching these expansive exposures. Yardic's conduct exemplified professionalism, while also highlighting broader cybersecurity issues occurring within other BCBS entities.

Background Information

Blue Cross Blue Shield Association

One of the 35 companies that comprise the BCBSA

The Blue Cross Blue Shield Association is a federation of United States Health Insurance companies that insure a third of all Americans. Its 35 component companies operate on either a state or regional levels, they also vary in their status as either non-profit or for-profit enterprises. The Blue Cross Blue Shield of Minnesota is classified as a single-state, not-for-profit company.

Relevant Cyber Security Concepts

Vulnerabilities and Patching

A vulnerability in software terms is a weakness which can be exploited by a cyber attacker to gain unauthorized access to or perform unauthorized actions on a computer system. Vulnerabilities can come from a multitude of sources and vary in how difficult and time consuming they are to address. Vulnerabilities are addressed through the patching process.

A patch in programming terms is an update that fixes vulnerabilities and other problems within software. While patching seems straightforward, a company must make some considerations beforehand. It can take hours for a company to implement a patch to their software systems, which translates to lost revenue. So in response many companies patch very infrequently to reduce the impact on normal business operations. Patching less frequently has its risks, in a survey of companies affected by data breaches, 60% of them knew about the vulnerability that would go on to become a data breach before it had occurred, but for whatever reason did not patch it beforehand.

Phishing

Phishing attacks come in the form of fabricated emails meant to trick the receiver into giving up sensitive login information, which bad-actors and hostile organizations use to access private data.

Prior Breaches

There are other examples examples of customer information breaches that happened in the U.S. prior to Tom Yardic's professional incident.

Equifax

In 2017, the credit bureau Equifax back in 2017 had an information breach. The cause of the breach was a third-party software vulnerability that was already patched, however the patch was not implemented on Equifax’s servers, leading to one of the largest cyber-crimes involving identity theft to date, 148 million members were affected. Equifax had been warned 2 months before the breach of the exploit, but still chose not to patch it.

Anthem and Idaho Blue Cross

In 2015, Anthem, another company of the BCBSA from 2015 experienced a breach. The cause of the breach was a phishing attack that allowed hackers to steal a database admin’s login credentials and get access to customer’s private data. The data included name, date of birth, income data and social security numbers, 79 million customers were affected. Similarly, in 2019, at the Idaho Blue Cross, there was a breach also caused by phishing that allowed hackers to gain access to customer data including patient names, account numbers and payment data, 55,000 members were affected.

Related Professionalism Case

Dan Applegate was the director of product engineering for Convair jet planes. Applegate was aware of safety threats concerning the cargo door latching system, and expressed his concern for the planes safe operation. After management had failed to fix the problem, Applegate did not expose the company's awful decision. Applegate's failure to alert the public about the company's faulty plane permitted a fully boarded plane to crash outside of Paris, which killed 346 passengers on the flight. While aviation and cybersecurity are two separate industries, both cases demonstrate corporate negligence. An uninvolved professional with unique experience in risk management and control objectives of technology was interviewed to explain the significance of Yardic's case. He explained "Information is the most critical asset in healthcare today, and to keep it on systems that are not up to date and protected is negligent." Yardic's decision to alert executives at BCBSA saved millions of people's sensitive medical data. He exemplified professionalism by putting the safety of others before his career.

Case Results

Major results of this case include a new privacy protection law being proposed in Minnesota to prevent future breaches of sensitive data as well as corporate changes within BCBS to strengthen their system against future attacks. The governor of Minnesota, Tim Walz, has proposed that the Minnesota legislature adopt a uniform law on insurance privacy security. This law was written by the National Association of Insurance Commissioners (NAIC) and has currently been adopted by eight states. The goal is to have all states adopt this legislation so that sensitive patient information is protected uniformly across the nation. This law would enable the state Commerce Department to investigate breaches of patient information at insurance companies as well as require that insurance companies notify the state about breaches they find in their systems. The end result will be better protected patient information systems due to increased accountability. Outside of pending legislation, BCBS has taken voluntary steps to improve their system’s integrity to prevent future embarrassing breaches of patient data. This current breach was a result of failure to take the time needed to patch up the system. Now BCBS is dedicating time and resources to patching up those vulnerabilities in the system to prevent another breach, essentially doing what Yardic advised in the first place. This new corporate strategy of taking system security more seriously should help ensure the integrity of sensitive patient data going forward.

Conclusion

In conclusion, it can be seen that Blue Cross Blue Shield of Minnesota was negligent in refusing to patch up their network. They put profits above patient privacy in not dedicating the time and resources to fix the substantial vulnerabilities in their system as identified by Tom Yardic. Although hackers did illegally break into the BCBS system and unlawfully access privileged patient data, it is clear that insurance companies responsible for holding said patient data should be held accountable for its protection. Thus, the proposed law in Minnesota to ensure accountability of insurance companies through government oversight should be passed by the state legislature to reduce the risk of more sensitive patient data being breached. Also, all insurance companies should follow BCBS’s strategy in voluntarily improving their systems by investing more time in patching than they had previously done. Between the new proposed law and internal corporate changes, the state and private insurance companies will work in tandem to prevent future data breaches, thus protecting the privacy of the patients that the companies insure.

Unfortunately, there are many other instances of data breaches outside of the insurance world, some just as damaging as revealing private medical information. Oftentimes, like in the case of BCBS of Minnesota, warning signs are present and employees within the company blow the whistle to higher-ups about vulnerabilities in their system. All too often, these warnings go on deaf ears. Authors of future ethics cases should study similar whistleblowing cases outside the insurance industry, particularly in relation to data breaches. They should investigate the warning signs of vulnerabilities in the system before breaches actually occur and see if the breach should ultimately be found to have been due to the negligence of management and other responsible parties within the breached organization.