Thread regarding Cigna layoffs

@d1 DOD and Medicaid can’t be offshore per Cigna compliance/legal department. Sadly Med D can go offshore ought; something I don’t understand since we use federal databases to pull Med D info in. I would be leery if I were a Med D recipient and I start getting scam calls/texts/emails.

@e4 probably why they sold Medicare. Less regulations to follow…

@e4
Reporting the unauthorized exposure of Personally Identifiable Information (PII) to a foreign entity involves distinct pathways depending on whether you are the insurance contractor (corporate reporting) or an individual/whistleblower (public reporting).

1. Mandatory Corporate Reporting (If you represent the insurer)
   If the health insurance corporation holds a contract with the Department of Defense (such as a TRICARE managed care contractor or a vendor bound by DFARS 252.204-7012), the organization is legally mandated to report the incident immediately.

• Cyber Incident Reporting via DIBNet: The corporation must report the incident electronically within 72 hours of discovery via the DoD DIBNet Portal.

https://www.dc3.mil/Missions/DIB-Cybersecurity/DIB-Cybersecurity-DCISE/

• This requires a DoD-approved Medium Assurance Certificate.
• Privacy Act / PII Breach Reporting: Simultaneously, the contractor must coordinate with their Contracting Officer's Representative (COR) and submit DD Form 2959 (Breach of Personally Identifiable Information Report) to the component’s privacy office. DoD guidelines generally require an initial alert to the federal team within 1 hour of discovery.
• Defense Health Agency (DHA): For healthcare data, the corporate privacy official should immediately contact the Defense Health Agency Privacy and Civil Liberties Office to manage Military Health System data breaches.

1. Whistleblower and Public Reporting (If you are an employee or citizen)
   If you are an individual exposing corporate wrongdoing or an illegal transfer of sensitive DoD data to a foreign nation, you should route the report through oversight and counterintelligence bodies:

• DoD Inspector General (OIG) Hotline: File an unclassified complaint regarding corporate mismanagement, systematic information loss, or regulatory violations via the DoD IG Hotlineor by calling 1-800-424-9098.
• Defense Counterintelligence and Security Agency (DCSA): Because a foreign entity is involved, this escalates the incident beyond a standard data breach into a potential national security concern. If you have security clearance or work within the defense industrial base, report the foreign contact or exploitation target immediately to your Facility Security Officer (FSO) or directly to the DCSA Reporting Channels.

https://www.dcsa.mil/Personnel-Vetting/Background-Investigations-for-Applicants/Report-a-Security-Change-Concern-or-Threat/

1. Parallel Legal Requirements
   Because the entity is a health insurance corporation, standard healthcare laws apply alongside defense regulations:

• HHS Office for Civil Rights (OCR): The breach must be reported to the Department of Health and Human Services through the HHS Breach Portal.

https://ocrportal.hhs.gov/ocr/breach/breach_frontpage.jsf?faces-redirect=true

• If the breach affects 500 or more individuals, it must be reported within 60 days.

It’s absolutely shocking how much companies like Cigna (and maybe Cigna too?) send data oversees. And why so many Americans, especially the elderly, are scammed. It’s insane. You would think it would be illegal.

Everyone needs to submit. And if you worked internal and saw this whistleblow. India should be nuked.

@d1

How to report to department of defense when pII has been sent to a foreign entity by a health insurance corporation 

Reporting the unauthorized exposure of Personally Identifiable Information (PII) to a foreign entity involves distinct pathways depending on whether you are the insurance contractor (corporate reporting) or an individual/whistleblower (public reporting).

1. Mandatory Corporate Reporting (If you represent the insurer)
   If the health insurance corporation holds a contract with the Department of Defense (such as a TRICARE managed care contractor or a vendor bound by DFARS 252.204-7012), the organization is legally mandated to report the incident immediately.

• Cyber Incident Reporting via DIBNet: The corporation must report the incident electronically within 72 hours of discovery via the DoD DIBNet Portal.

https://www.dc3.mil/Missions/DIB-Cybersecurity/DIB-Cybersecurity-DCISE/

• This requires a DoD-approved Medium Assurance Certificate.
• Privacy Act / PII Breach Reporting: Simultaneously, the contractor must coordinate with their Contracting Officer's Representative (COR) and submit DD Form 2959 (Breach of Personally Identifiable Information Report) to the component’s privacy office. DoD guidelines generally require an initial alert to the federal team within 1 hour of discovery.
• Defense Health Agency (DHA): For healthcare data, the corporate privacy official should immediately contact the Defense Health Agency Privacy and Civil Liberties Office to manage Military Health System data breaches.

1. Whistleblower and Public Reporting (If you are an employee or citizen)
   If you are an individual exposing corporate wrongdoing or an illegal transfer of sensitive DoD data to a foreign nation, you should route the report through oversight and counterintelligence bodies:

• DoD Inspector General (OIG) Hotline: File an unclassified complaint regarding corporate mismanagement, systematic information loss, or regulatory violations via the DoD IG Hotlineor by calling 1-800-424-9098.
• Defense Counterintelligence and Security Agency (DCSA): Because a foreign entity is involved, this escalates the incident beyond a standard data breach into a potential national security concern. If you have security clearance or work within the defense industrial base, report the foreign contact or exploitation target immediately to your Facility Security Officer (FSO) or directly to the DCSA Reporting Channels.

https://www.dcsa.mil/Personnel-Vetting/Background-Investigations-for-Applicants/Report-a-Security-Change-Concern-or-Threat/

1. Parallel Legal Requirements
   Because the entity is a health insurance corporation, standard healthcare laws apply alongside defense regulations:

• HHS Office for Civil Rights (OCR): The breach must be reported to the Department of Health and Human Services through the HHS Breach Portal.

https://ocrportal.hhs.gov/ocr/breach/breach_frontpage.jsf?faces-redirect=true

• If the breach affects 500 or more individuals, it must be reported within 60 days.

Wait until DOD realizes their data is in foreign hands. An audit would be revealing.