Cord Blood Bank Settles with FTC Over Alleged Breach Involving 300,000 | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

Cord Blood Bank Settles with FTC Over Alleged Breach Involving 300,000

January 30, 2013
by Rajiv Leventhal
| Reprints

The operator of Cbr Systems, Inc., a cord blood bank based in San Bruno, Calif., agreed to settle Federal Trade Commission (FTC) charges that it failed to protect the security of customers’ personal information, and that its inadequate security practices contributed to a breach that exposed Social Security numbers and credit and debit card numbers of nearly 300,000 consumers.

 “The FTC can and will take action to make sure that companies live up to the privacy promises they make to consumers, particularly when it comes to highly sensitive information like the health information collected by Cbr,” FTC chairman Jon Leibowitz said in a statement. “The exposure of this information has the potential to cause real harm to consumers.”          

Cbr Systems is a leading provider of umbilical cord blood and umbilical cord tissue banking services.  Consumers pay to preserve and store a newborn’s cord blood and cord tissue because they contain stem cells, the use of which researchers are investigating to treat some diseases and conditions.

In its privacy policy, according to an FTC statement, Cbr claimed that “[w]henever CBR handles personal information, regardless of where this occurs, CBR takes steps to ensure that your information is treated securely and in accordance with the relevant Terms of Service and this Privacy Policy. . . . ” 

According to the FTC, Cbr failed to use reasonable and appropriate procedures for handling customers’ personal information, making its privacy policy claim deceptive under the FTC Act.  According to the complaint, Cbr did not have reasonable policies and procedures to protect the security of information it collected and maintained.  In addition, Cbr allegedly created unnecessary risks to personal information by, among other things, transporting backup tapes, a thumb drive, and other portable data storage devices containing personal information in a way that made the information vulnerable to theft.  According to the FTC, Cbr also failed to take sufficient measures to prevent, detect, and investigate unauthorized access to computer networks.

The settlement is part of the FTC’s ongoing efforts to protect the security and confidentiality of consumers’ sensitive health and financial information.  It requires Cbr to establish and maintain a comprehensive information security program and submit to security audits by independent auditors every other year for 20 years.  The settlement also bars Cbr from misrepresenting its privacy and security practices.     

Get the latest information on Health IT and attend other valuable sessions at this two-day Summit providing healthcare leaders with educational content, insightful debate and dialogue on the future of healthcare and technology.

Learn More

Topics

News

Cumberland Consulting Buys LinkEHR, Provider of Epic Help Desk Services

Cumberland Consulting Group, a healthcare consulting and services firm, has acquired LinkEHR, which provides remote application support, including Epic help desk services.

Population Health Tool that Provides City-Level Social Determinants Data Expands to 500 Cities

A data visualization tool that helps city officials understand the health status of their population, called the City Health Dashboard, has now expanded to 500 of the largest cities in the U.S., enabling local leaders to identify and take action around the most pressing health needs in their cities and communities.

Trump will Nominate Acting VA Secretary Wilkie for Permanent Position

Just a day after the Department of Veterans Affairs (VA) and Cerner inked their $10 billion EHR (electronic health record) deal, President Trump said he would be nominating Acting VA Secretary Robert Wilkie for the permanent position.

ONC Names API Server Showdown Stage 2 Winner

The Office of the National Coordinator for Health Information Technology (ONC) has named 1UpHealth as the Stage 2 winner of the “Secure API Server Showdown” challenge.

EHNAC Developing Trusted Exchange Accreditation Program

To align with the Trusted Exchange Framework and Common Agreement, the Electronic Healthcare Network Accreditation Commission, a nonprofit standards development organization and accrediting body, is working with other organizations to establish a new Trusted Exchange Accreditation Program.

Lawmakers Demand New VA CIO, Citing “Malign Neglect” on EHR Project

A group of Democratic federal lawmakers, five senators and six members of Congress, are calling out the U.S. Department of Veterans Affairs (VA) for what they call “malign neglect” in the agency’s efforts to achieve electronic health record (EHR) modernization.