Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 1 of 24 UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLORADO

Transcription

1 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 1 of 24 UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLORADO Mary Mellon, on behalf of herself ) and all others similarly situated, ) ) Plaintiff, ) ) v. ) Case No. ) Anthem, Inc. and Rocky Mountain ) Hospital and Medical Service, Inc., ) Demand for Jury Trial ) Defendants. ) COMPLAINT Plaintiff Mary Mellon, individually and on behalf of others similarly situated, for her Complaint against defendants Anthem Insurance Companies, Inc. ( Anthem, Inc. ) and Rocky Mountain Hospital and Medical Service, Inc. d/b/a Anthem Blue Cross and Blue Shield (collectively Anthem ) allege: NATURE OF THE CASE 1. On February 4, 2015, Anthem, Inc. the second largest private insurer in the country publically disclosed that its information security system had been breached and the personal details of over 60 million Anthem customers was compromised. According to Anthem s President and CEO Joseph R. Swedish, the information stolen from Anthem s data systems includes names, birthdays, medical IDs, Social Security numbers, street addresses, address, and employment and income information ( personal medical information ). 2. Although Anthem s admission was not made public until February 4, 2015, Anthem s 1

2 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 2 of 24 databases were actually compromised on or about December 10, And, the theft of personal medical information went undiscovered until January 27, The impact of the breach was felt immediately: within days of Anthem s announcement, phishing s, crafted so they appear to be from Anthem, began reaching Anthem customers asking them to verify credit card information and personal health information through click here links in the s. Katherine Keefe, global focus group leader for breach response services at Beazley, which underwrites cyber-liability policies, has said The value to a criminal of having a full set of medical information on a person can go for $40 to $50 on the street. By contrast, a credit card number is often worth $4 or $5. 4. Anthem s failures are compound. First, Anthem failed to take adequate and reasonable measures to ensure its data systems were protected and to prevent the data breach in the first instance. Second, Anthem failed to disclose to its customers the material facts that it did not have adequate computer systems and security practices to safeguard customers personal data. Third, Anthem waited approximately nine days before it informed its customers of the data breach and theft of their personal medical information. 5. Anthem kept and maintained databases of all information obtained from Plaintiff and the Class and stored that information unsecured and inadequately protected. 6. Because of its inadequate security, Anthem negligently allowed the loss of data of potentially over 60 million records. 7. Anthem s failures caused substantial harm to Anthem s customers. 2

3 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 3 of 24 PARTIES 8. Plaintiff Mary Mellon is a resident of Denver County, Colorado. Ms. Mitchel currently has health insurance through Anthem, Inc. s affiliate Rocky Mountain Hospital and Medical Service, Inc. d/b/a Blue Cross and Blue Shield. When becoming a customer of Anthem, she provided Anthem with sensitive personal and/or financial information. She reasonably believed Anthem would maintain this personal and/or financial information in a secure manner and provided her information to Anthem on that basis. Had she known that Anthem would not maintain her information in a reasonably secure manner, she would not have provided that information to Anthem. 9. Defendant Anthem, Inc. is an Indiana corporation with its headquarters in Indianapolis, Indiana. It is one of the largest health benefits companies in the United States. and is an independent licensee of the Blue Cross and Blue Shield Association serving members in California, Colorado, Connecticut, Georgia, Indiana, Kentucky, Maine, Missouri, Nevada, New Hampshire, New York, Ohio, Virginia, and Wisconsin, and specialty plan members in other states, including Kansas. 10. Defendant Rocky Mountain Hospital and Medical Service, Inc. is an affiliate of Anthem, Inc. that serves customers across the U.S., including Plaintiff Mellon. Rocky Mountain Hospital and Medical Service, Inc. is a Colorado corporation with its principal place of business in Denver, Colorado. Anthem Blue Cross and Blue Shield is the trade name for Rocky Mountain Hospital and Medical Service, Inc. (hereinafter Anthem Blue Cross and Blue Shield ). 3

4 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 4 of 24 JURISDICTION AND VENUE 11. Personal jurisdiction is proper over Anthem, Inc. because it is a citizen of this state. 12. Personal jurisdiction is proper over Anthem, Inc. and Anthem Blue Cross and Blue Shield because they each has sufficient minimum contacts with Colorado to satisfy traditional notions of due process by transacting business in Colorado and entering into contracts with Colorado residents. Additionally, all defendants intentionally avail themselves of this jurisdiction by marketing and selling health insurance to Colorado consumers. 13. This Court has subject matter jurisdiction over this action pursuant to the Class Action Fairness Act of 2005, 28 U.S.C. 1332(d), because (a) the class has more than 100 members; (b) the amount in controversy exceeds $5 million, exclusive of interest and costs; and (c) Plaintiff and some putative class members are citizens of a different state from Defendants. 14. Venue is proper in this Court under 28 U.S.C. 1391(a) because Anthem, Inc. and Anthem Blue Cross and Blue Shield do business in this District and substantial events, acts, and/or omissions giving rise to Plaintiff s claims occurred in this District. FACTUAL ALLEGATIONS 15. Today, Anthem is the nation s leading health benefits company serving over 68 million customers. Stated another way, approximately one in nine Americans have health insurance through one of Anthem s affiliated plans According to its 2014 Fourth Quarter Earnings Release, Anthem s net income for 1 See 4

5 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 5 of was $2.6 billion. 17. The company was formed in 2004 through a merger of WellPoint Health Networks Inc. and Anthem, Inc. Initially, the parent company assumed the WellPoint, Inc. name, but in December 2014, WellPoint, Inc. changed its corporate name to Anthem, Inc. 18. Through its affiliated health plans, Anthem delivers a number of leading health benefit solutions through a broad portfolio of integrated health care plans and related services, along with a wide range of specialty products such as life and disability insurance benefits, dental, vision, behavioral health benefit services, as well as long term care insurance and flexible spending accounts. 19. Anthem, Inc. is an independent licensee of the Blue Cross and Blue Shield Association. It serves members as the Blue Cross licensee for California; and as the Blue Cross and Blue Shield licensee for Colorado, Connecticut, Georgia, Indiana, Kentucky, Maine, Missouri (excluding 30 counties in the Kansas City area), Nevada, New Hampshire, New York (as the Blue Cross Blue Shield licensee in 10 New York City metropolitan and surrounding counties and as the Blue Cross or Blue Cross Blue Shield licensee in selected upstate counties only), Ohio, Virginia (excluding the Northern Virginia suburbs of Washington, D.C.), and Wisconsin. 20. In most of these service areas, Anthem s plans do business as Anthem Blue Cross, Anthem Blue Cross and Blue Shield, Blue Cross and Blue Shield of Georgia and Empire Blue Cross Blue Shield (or Empire Blue Cross in the New York service areas). 21. Anthem Blue Cross and Blue Shield is the trade name of: a. In Colorado and Nevada: Rocky Mountain Hospital and Medical Service, Inc.; 5

6 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 6 of 24 b. In Connecticut: Anthem Health Plans, Inc.; c. In Georgia: Blue Cross and Blue Shield of Georgia, Inc. and Blue Cross Blue Shield Healthcare Plan of Georgia, Inc.; d. In Indiana: Anthem Insurance Companies, Inc.; e. In Kentucky: Anthem Health Plans of Kentucky, Inc.; f. In Maine: Anthem Health Plans of Maine, Inc.; g. In Missouri (excluding 30 counties in the Kansas City area): RightCHOICE Managed Care, Inc. (RIT), Healthy Alliance Life Insurance Company (HALIC), and HMO Missouri, Inc. RIT and certain affiliates administer non-hmo benefits underwritten by HALIC and HMO benefits underwritten by HMO Missouri, Inc. RIT and certain affiliates only provide administrative services for self-funded plans and do not underwrite benefits; h. In New Hampshire: Anthem Health Plans of New Hampshire, Inc.; i. In Ohio: Community Insurance Company; j. In Virginia: Anthem Health Plans of Virginia, Inc. trades as Anthem Blue Cross and Blue Shield; 2 and k. In Wisconsin: Blue Cross Blue Shield of Wisconsin ("BCBSWi") which underwrites or administers the PPO and indemnity policies; Compcare Health Services Insurance Compcare Health Services Insurance Corporation ("Compcare") underwrites or administers the HMO policies; and Compcare and BCBSWi collectively underwrite or administer the POS policies. 22. Anthem has locations in less than 15 states, but its reach is far greater, with customers in all fifty states. 23. For example, Plaintiff Mellon resides and work in Colorado and is insured through an Anthem, Inc. affiliate. 2 The service area for Anthem Blue Cross and Blue Shield and its affiliated HMO HealthKeepers, Inc. is all of Virginia except the City of Fairfax, the Town of Vienna, and the area east of State Route

7 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 7 of Anthem touts that The Anthem brand is built on a foundation of trust it s the name consumers are most familiar with as a trusted health care partner through [its] affiliated health plans But Anthem violated that trust. 26. On or about December 10, 2014, Anthem s databases were compromised, when an unidentified person or persons gained access to Anthem s databases using an Anthem employee s credentials. 27. Anthem failed to identify the invasion until at least January 27, During that time, the unidentified persons had unfettered access to and siphoned off highly sensitive, personal medical information of millions of Anthem customers. 28. The data breach extended to all of Anthem's business, affecting customers with large employers, individual policyholders, and people enrolled in Medicaid managed-care plans. 29. In a public statement, the company said: Cyber attackers executed a very sophisticated attack to gain unauthorized access" to one of the company's computer systems and "have obtained personal information relating to consumers and Anthem Blue Cross employees who are currently covered, or who have received coverage in the past. 30. The personal medical information involved was not encrypted in Anthem s databases, even though it included, names, birthdays, medical IDs, Social Security numbers, street addresses, address, and employment and income information. 31. On information and belief, Plaintiff s information was stolen between December 10, 2014 and January 27,

8 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 8 of In late January, the breach was discovered when a database administrator found his login information being used to run a query he did not initiate. Soon thereafter, it was also discovered that other database administrators credentials had been compromised as well. 33. At the very least, the unidentified persons stole personal medical information. 34. Two days later, on January 29, Anthem alerted federal authorities of the data breach It wasn t until February 5, 2015, that Anthem informed its customer base that its databases had been compromised and customers personal medical information stolen. According to Anthem s President and CEO Joseph R. Swedish, the information stolen from Anthem s data systems includes names, birthdays, medical IDs, Social Security numbers, street addresses, address, and employment information (including data regarding income) On February 5, 2015, Anthem conceded that its customers were subject to the data breach in a notice on its website, which stated: Safeguarding your personal, financial and medical information is one of our top priorities, and because of that, we have state-of-the-art information security systems to protect your data. However, despite our efforts, Anthem was the target of a very sophisticated external cyber attack. These attackers gained unauthorized access to Anthem s IT system and have obtained personal information from our current and former members such as their names, birthdays, medical IDs/social security numbers, street addresses, addresses and employment information, including income data. Based on what we know now, there is no evidence that credit card or medical information, such as claims, test results or diagnostic codes were targeted or compromised. 3 See

9 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 9 of 24 Once the attack was discovered, Anthem immediately made every effort to close the security vulnerability, contacted the FBI and began fully cooperating with their investigation. Anthem has also retained Mandiant, one of the world s leading cybersecurity firms, to evaluate our systems and identify solutions based on the evolving landscape. Anthem s own associates personal information including my own was accessed during this security breach. We join you in your concern and frustration, and I assure you that we are working around the clock to do everything we can to further secure your data. Anthem will individually notify current and former members whose information has been accessed. We will provide credit monitoring and identity protection services free of charge so that those who have been affected can have peace of mind. We have created a dedicated website - where members can access information such as frequent questions and answers. We have also established a dedicated tollfree number that both current and former members can call if they have questions related to this incident. That number is: As we learn more, we will continually update this website and share that information with you. I want to personally apologize to each of you for what has happened, as I know you expect us to protect your information. We will continue to do everything in our power to make our systems and security processes better and more secure, and hope that we can earn back your trust and confidence in Anthem. Sincerely, Joseph Swedish President and CEO Anthem, Inc. 37. Individual Anthem customers were sent a similar notice via from Anthem Blue Cross and Blue Shield disclosing the data breach. However, Anthem s promise to provide future protective services rings false. The unidentified persons have gained access to Plaintiff and Anthem customers and mailing addresses. A surge of phishing s has already plagued Anthem s customers with these same promises of future protection and 9

10 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 10 of 24 credit-monitoring; yet they are fictitious and aimed at accessing even more personal and financial information about Anthem s customers. 38. Anthem s customers whose information was stolen now cannot trust any communication they purportedly receive from Anthem as there is no way to detect whether it is legitimate or further perpetuating scamming efforts. 39. Additionally, Anthem has taken no steps to tell Plaintiff or the Class precisely what information particular to each person was stolen. 40. Privacy advocates said the Anthem hack may pose even greater risks to consumers than previous breaches at big retailers such as Home Depot and Target. Paul Stephens, director of policy and advocacy at the Privacy Rights Clearinghouse in San Diego, said the wide array of personal information taken opens up more possibilities for mischief. You essentially have the keys to the kingdom to commit any type of identity theft, Stephens said. The information can be used not only to establish new credit accounts but also potentially penetrate existing accounts at financial institutions or a stock brokerage. The scope of the information involved is incredible. 41. Cybersecurity analysts warned that the thieves might attack Anthem again using the employee data they took. Anthem said it s working to strengthen security and identify any potential gaps. But, those safeguards have still yet to be instituted. 42. The harm caused to Anthem s customers will be felt for years to come. Aside from the complete violation of trust and privacy, it will be necessary for individuals that have been victimized by the theft to have credit monitoring for many years, at great expense to them, 10

11 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 11 of 24 and as a direct result of the negligence of Anthem. 43. This is not the first time Anthem has had problems with its customers privacy. In 2013, the company agreed to pay $1.7 million to resolve federal allegations that it exposed protected health information of 612,402 people online because of security weaknesses. Federal officials said Anthem had inadequate safeguards in an online application database and left names, birth dates, Social Security numbers and health data accessible to unauthorized people. The investigation by the U.S. Department of Health and Human Services found that the insurer did not adequately implement policies for authorizing access to the database and did not have technical safeguards in place to verify users. 44. Based on what is known so far, it is likely this data breach will be one of the largest data breaches to date. 45. If confirmed, we are dealing with one of the biggest data breaches in history and probably the biggest data breach in the healthcare industry, said Jaime Blasco, vice president and chief scientist at AlienVault, a San Mateo, Calif., information security firm. For individuals, in a few words, it is a nightmare," he said. "If the attackers had access to names, birthdays, addresses and Social Security numbers, it means that information can be easily used to carry out identity theft schemes. 11

12 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 12 of 24 CLASS ALLEGATIONS 46. Plaintiff brings this action under Fed. R. Civ. P. 23(a), (b)(2) and (b)(3) on behalf of herself and a Class defined as follows: All customers of Anthem, Inc. and Rocky Mountain Hospital and Medical Service, Inc. whose personal medical information was breached as a result of the data breach announced on or about February 4, Excluded from the Class are (i) Anthem, Inc., any entity in which Anthem, Inc. has a controlling interest or which has a controlling interest in Anthem, Inc., and Anthem, Inc. s legal representatives, predecessors, successors, assigns, and employees and (ii) the judge and staff to whom this case is assigned, and any member of the judge s immediate family. 48. Plaintiff is a member of the Class that she seeks to represent. Class members can be identified using Anthem s records that are kept by Anthem in the usual course of business. 49. Class members are so numerous that their individual joinder is impracticable. The precise number of the potential class members is unknown to Plaintiff, but it is clear that the number greatly exceeds the number to make joinder impossible. 50. Common questions of law and fact predominate over the questions affecting only individual Class members. Some of the common legal and factual questions include: a. Whether there was an unauthorized disclosure by Anthem of Class members personal medical information; b. Whether Anthem enabled an unauthorized disclosure of Class members personal medical information; c. Whether Anthem misrepresented the safety and security of Class members personal medical information maintained by it; d. Whether Anthem implemented and maintained reasonable procedures and practices appropriate for maintaining the safety and security of Class 12

13 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 13 of 24 members personal medical information; e. When Anthem became aware of an unauthorized disclosure of Class members personal medical information; f. Whether Anthem unreasonably delayed notifying Class members of an unauthorized disclosure of Class members personal medical information; g. Whether Anthem intentionally delayed notifying Class members of an unauthorized disclosure of Class members personal medical information; h. Whether Anthem s conduct was negligent; i. Whether Anthem s conduct was deceptive; j. Whether Anthem s conduct was knowing, willful, intentional, and/or malicious; and k. Whether Plaintiff and the Class are entitled to damages and/or injunctive relief. 51. Anthem engaged in a common course of conduct giving rise to the legal rights sought to be enforced by Plaintiff and Class members. Similar or identical common law violations, deceptive business practices, and negligence are involved. Individual questions, if any, pale by comparison to the numerous common questions that dominate. 52. The injuries sustained by the Class members flow, in each instance, from a common source: Anthem s misconduct. In each case, Anthem negligently secured the personal medical information of Plaintiff and the Class. 53. The Class members have been damaged by Anthem s misconduct, including but not limited to the financial loss from fraudulent use of personal medical information, unlawful intrusion into privacy, and cost of identification monitoring and/or credit monitoring. 54. Plaintiff s claims are typical of the claims of the putative Class. Plaintiff and the putative Class members were injured through Anthem s misconduct described above and 13

14 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 14 of 24 assert the same claims for relief. The same events and conduct that give rise to Plaintiff s claims are identical to those that give rise to the claims of every other Class member because each Plaintiff and Class member is a person that has suffered harm as a direct result of the same conduct (and omissions of material facts) engaged in by Anthem and resulting from the Anthem data breach. 55. Plaintiff will fairly and adequately protect the interests of the Class. Plaintiff s interests do not conflict with the interests of the putative Class. Plaintiff has retained counsel competent and experienced in class action litigation and intends to prosecute this action vigorously. Plaintiff and Plaintiff s counsel will fairly and adequately protect the interests of the putative Class. 56. The class action device is superior to other available means for the fair and efficient adjudication of the claims of Plaintiff and the proposed Class. It would be impracticable and undesirable for each member of the Class who suffered harm to bring a separate action. In addition, the maintenance of separate actions would place a substantial and unnecessary burden on the courts and could result in inconsistent adjudications, while a single class action can determine, with judicial economy, the rights of all Class members. 57. Individual litigation of the legal and actual issues raised by the conduct of Anthem would increase delay and expense to all parties and to the court system. The class action device presents far fewer management difficulties and provides the benefits of a single, uniform adjudication, economies of scale and comprehensive supervision by a single court. Given the similar nature of Plaintiff s and putative Class members claims based on the same 14

15 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 15 of 24 common law, a Kansas Class will be easily managed by the Court and the parties. 58. Class certification is proper under Federal Rules 23(a) and (b)(2) because Anthem has acted or has refused to act on grounds generally applicable to the Class so that final injunctive relief or corresponding declaratory relief is appropriate as to the Class as a whole. 59. Class certification, therefore, is also appropriate under Federal Rules 23(a) and (b)(3). The above common questions of law or fact predominate over any questions affecting individual members of the Classes, and a class action is superior to other available methods for the fair and efficient adjudication of the controversy. COUNT I: NEGLIGENCE 60. Plaintiff re-alleges the above paragraphs as though fully set forth herein. 61. Anthem owed a duty to Plaintiff and Class members to exercise reasonable care in obtaining, retaining, securing, safeguarding, deleting, and protecting their personal medical information in Anthem s possession from being compromised, lost, stolen, accessed, and misused by unauthorized persons. 62. This duty included, among other things, designing, maintaining, and testing Anthem s security systems to ensure that Plaintiff s and Class members personal medical information in Anthem s possession was adequately secured and protected. 63. Anthem further owed a duty to Plaintiff and Class members to implement processes that would detect a breach of its security system in a timely manner and to timely act on warnings and alerts. 64. Anthem owed a duty, as articulated in Anthem s HIPAA Notice of Privacy Practices 15

16 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 16 of 24 handbook, to protect its customers sensitive personal medical information. 65. Anthem owed a duty to timely disclose the material facts that Anthem s computer systems and data security practices were inadequate to safeguard customers personal medical information from theft. 66. Anthem breached these duties by the conduct alleged in this Complaint by, including without limitation: (a) failing to protect its customers personal medical information; (b) failing to maintain adequate computer systems and data security practices to safeguard customers personal medical information; (c) failing to disclose the material fact that Anthem s computer systems and data security practices were inadequate to safeguard Plaintiff s and Class members personal data from theft; and (d) failing to disclose in a timely and accurate manner to Plaintiff and Class members the material fact of the Anthem data breach. 67. The conduct alleged in the Complaint caused Plaintiff and Class members to be exposed to fraud and be harmed. 68. The injuries suffered by the Plaintiff and the putative Class as a direct result of the Anthem data breach include: theft of their personal medical information; costs associated with the detection and prevention of identity theft and unauthorized use of their financial accounts; costs associated with time spent and loss of productivity from taking time to address and attempt to ameliorate, mitigate, and deal with the actual and future consequences of the data breach, including finding fraudulent charges, cancelling and reissuing cards, purchasing credit monitoring and identity theft protection services, 16

17 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 17 of 24 imposition of withdrawal and purchase and limits on compromised accounts, and the stress, nuisance, and inconvenience of dealing with all issues resulting from the Anthem data breach; the imminent and certainly impending injury flowing from potential fraud and identity threat posed by their personal and financial information being placed in the hands of unidentified persons; damages to and diminution in value of their personal financial information entrusted to Anthem for the sole purpose of obtaining health insurance from Anthem and with the mutual understanding that Anthem would safeguard Plaintiff s and Class member s data against theft and not allow access and misuse of their data by others. COUNT II: BREACH OF IMPLIED CONTRACT 69. Plaintiff re-alleges the above paragraphs as though fully set forth herein. 70. When Plaintiff and Class members provided Anthem with their personal medical information to Anthem to purchase health insurance, Plaintiff and other Class members entered into implied contracts with Anthem under which Anthem agreed to safeguard such information and to timely notify Plaintiff and Class members that their data had been compromised. 71. Each enrollment or application made by Plaintiff and Class members with Anthem was made under the implied contractual provisions under which Anthem agreed to safeguard and protect Plaintiff s and Class members personal medical information, and to timely and accurately notify them that such information was compromised and breached. 72. Anthem contracted to maintain the confidentiality of Plaintiff s and Class members personal medical information. On it s website, Anthem Blue Cross and Blue Shield obligates 17

18 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 18 of 24 itself to maintain security measures to protect customer information: 5 Anthem Blue Cross and Blue Shield maintains policies that protect the confidentiality of personal information, including Social Security numbers, obtained from its members and associates in the course of its regular business functions. Anthem Blue Cross and Blue Shield is committed to protecting information about its customers and associates, especially the confidential nature of their personal information (PI). Personal Information is information that is capable of being associated with an individual through one or more identifiers including but not limited to, a Social Security number, a driver s license number, a state identification card number, an account number, a credit or debit card number, a passport number, an alien registration number or a health insurance identification number, and does not include publicly available information that is lawfully made available to the general public from federal, state or local government records or widely distributed media. Anthem Blue Cross and Blue Shield is committed to protecting the confidentiality of Social Security numbers and other Personal Information. Anthem Blue Cross and Blue Shield s Privacy Policy imposes a number of standards to: guard the confidentiality of Social Security numbers and other personal information prohibit the unlawful disclosure of Social Security numbers, and limit access to Social Security numbers. Anthem Blue Cross and Blue Shield will not use or share Social Security numbers or personal information with anyone outside the company except when permitted or required by federal and state law. Anthem Blue Cross and Blue Shield Associates must only access Social Security numbers or personal information as required by their job duties. Anthem Blue Cross and Blue Shield has in place a minimum necessary policy which states that associates may only access, use or disclose Social Security numbers or personal information to complete a specific task and as allowed by law. 5 w_ad htm&label=privacy%20statement. 18

19 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 19 of 24 Anthem Blue Cross and Blue Shield safeguards Social Security numbers and other personal information by having physical, technical, and administrative safeguards in place. 73. Anthem breached the implied contracts made with Plaintiff and Class members by failing to safeguard and protect the personal medical information of Plaintiff and Class members and by failing to provide timely and accurate notice to them that their personal medical information was compromised in and as a result of the data breach. 74. The losses and damages sustained by Plaintiff and Class members were the direct and proximate result of Anthem s breach of the implied contracts COUNT III: BREACH OF CONTRACT 75. Plaintiff re-alleges the above paragraphs as though fully set forth herein. 76. Anthem has a contractual obligation to maintain security of its customers personal medical information. 77. Anthem s own HIPAA Privacy Practices handbook acknowledges Anthem s contractual obligation to protect its customers personal medical information. 78. Anthem in the normal course of its business collected personal medical information. 79. Anthem misrepresented the safety and security of its computer systems by, inter alia, not complying with HIPAA. 80. The foregoing acts and conduct of Anthem are deceptive in that Anthem represented to Plaintiff and the Class that their personal medical information would remain secure and/or that it had the technology or policies to secure this information when Anthem in fact did not have adequate security measures. 19

20 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 20 of By these deceptive acts, Anthem breached its contracts with Plaintiff and Class members and caused harm to Plaintiff and the Class. COUNT IV: BAILMENT 82. Plaintiff re-alleges the above paragraphs as though fully set forth herein. 83. Plaintiff gave personal medical information to Anthem for the exclusive purpose of enrolling and/or insurance policies. 84. In delivering their personal medical information to Anthem, Plaintiff and Class members believed that Anthem would adequately safeguard their personal medical information. 85. Anthem accepted possession of Plaintiff s and Class members personal medical information for the purposes of purchasing and enrolling in insurance policies. 86. By accepting possession of Plaintiff s and Class members personal medical information, Anthem understood that Plaintiff and Class members expected Anthem to adequately safeguard their information. Accordingly, a bailment was established. 87. During the bailment, Anthem owed a duty to Plaintiff and Class members to exercise reasonable care, diligence, and prudence in safeguarding their personal medical information. 88. Anthem breached its duty of care by failing to take appropriate measures to safeguard and protect Plaintiff s and Class members personal medical information, resulting in the disclosure of their personal medical information. 89. Anthem further breached their duty to Plaintiff and Class members when it failed to notify Plaintiff and Class members of the breach in a timely manner. 20

21 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 21 of As a direct and proximate cause of Anthem s behavior, Plaintiff s and Class members bailments were damaged and its value diminished. COUNT V: VIOLATIONS OF COLORADO DATA BREACH STATUTE 91. Plaintiff re-alleges the above paragraphs as though fully set forth herein. 92. Colorado has enacted a data breach statute, Colo. Rev. Stat. Ann (2), et seq., that generally requires any person or business conducting business in Colorado that owns or licenses computerized data that includes personal information (i.e., Anthem) to disclose any breach of the security of the system to its customers in Colorado whose information was compromised. Additionally, Colorado statutes require the data breach disclosure to be made in the most expedient time possible and without unreasonable delay. 93. The Anthem data breach constitutes a breach of the security system of Anthem within the meaning of the Colorado data breach statutes. 94. Plaintiff and Class members names, birthdates, addresses, employment details, social security numbers, and street addresses constitute personal information under and subject to Colorado data breach statutes. 95. Anthem unreasonably delayed in informing the public, including Plaintiff and Class members that their personal information had been compromised. 96. Upon information and belief, Anthem knew at least as of January 27, 2015 that the data breach had occurred. Yet, Anthem waited until February 5, 2015 to publically disclose the breach or inform its Colorado customers. 97. Anthem failed to disclose to Plaintiffs and Class members without unreasonable delay 21

22 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 22 of 24 and in the most expedient time possible, the breach of security of Plaintiff and Class members personal medical information when Anthem knew or reasonably believed such information had been compromised. 98. Plaintiff and Class members suffered harm directly resulting from Anthem s failure to provide and the delay in providing Plaintiff and Class members with timely and accurate notice as required by Colorado statute. 99. Plaintiff and Class members suffered the damages alleged above as a direct result of Anthem s delay in providing timely and accurate notice of the data breach Had Anthem provided timely and accurate notice of the data breach, Plaintiff and Class members would have been able to avoid and/or attempt to ameliorate or mitigate the damages and harm resulting in Anthem s unreasonable delay in providing notice Anthem s failure to provide timely and accurate notice of the data breach violated Colo. Rev. Stat. Ann (2). REQUEST FOR RELIEF WHEREFORE, Plaintiff, on behalf of herself and all others similarly situated, request the Court order relief and enter judgment against Defendants and enter an order: a. Certifying this case as a class action under Fed. R. Civ. P. 23(a), (b)(2), and (b)(3); b. Appoint the named Plaintiff to be Class representative and her counsel to be Class counsel under Fed. R. Civ. P. 23(g); c. Adjudge and decree that Defendants are liable to Plaintiff and the Class for: i. Negligence; 22

23 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 23 of 24 ii. Breach of implied contract; iii. Breach of contract; iv. Bailment; and v. Colo. Rev. Stat. Ann (2), et seq. d. Require Defendants to make whole any and all losses suffered by Plaintiff and the Class; e. Enjoin Defendants from further engaging in the unlawful conduct complained of herein; f. Award Plaintiff and the Class appropriate relief, including but not limited to actual damages, restitution, disgorgement, pre- and post-judgment interest, attorneys fees and costs as required by statute; g. Require Defendants to notify (and pay to notify) the Class of the pendency of this action; and h. Such other and additional relief as the Court deems equitable, appropriate, and just. JURY DEMAND Plaintiff demands a jury trial on all claims so triable. 23

24 Case 1:15-cv REB Document 1 Filed 02/17/15 USDC Colorado Page 24 of 24 Dated: February 17, 2015 Jonathan Little SAEED and LITTLE LLP (pro hac vice forthcoming) 1433 N. Meridian Street Indianapolis, Indiana (317) jon@sllawfirm.com Respectfully submitted, /s/ Ashlea G. Schwarz Richard M. Paul III Mo. Bar #44233 (Admitted D. Colorado) Ashlea G. Schwarz Mo. Bar #60102 (Admitted D. Colorado) PAUL McINNES LLP 601 Walnut Street, Suite 300 Kansas City, Missouri Ph: Fax: paul@paulmcinnes.com ashlea@paulmcinnes.com ATTORNEYS FOR PLAINTIFF AND THE PUTATIVE CLASS 24