E
emailer
Guest
The company I work for recently required all employees to register for health and dental benefits over the Internet. We were required to access a third-party web server by providing it with our Social Security Number as the logon name and using the last for digits as a password.
I discovered a bug in the software that allowed me, or anyone, to see all of the Social Security Numbers of everyone from our company who had signed up. That means, I, or anyone, could have logged in and seen or changed another employee's health profile!
To emphasise to the person in charge of Human Relations, whose plan it was to out-source enrollement for health benefits, I enclosed her Social Securty Number in an e-mail to my boss to prove that I had found a bug in the software.
The e-mail never left our internal computer system; the e-mail did not go over the Internet, it remained within our building.
Ms. HR is irate that I sent her SSN via e-mail. Of course, she is trying to divert attention from the fact that she choose a third-party organization whose software exposed us all to having our personal health records, including medical numbers and preferred doctors, viewed on-line.
What legal exporsure do I have because I enclosed Ms. HR's SSN in an internal e-mail. Would she have grounds for a meritorius lawsuit against me? Is this grounds for firing in California.
And advice is appreciated. I made a mistake using her SSN, but I believe I did our company a service my notifing it that all employees were at risk to either identity theft, or to having information about themselves exposed to hacker.
Thanks for the help -Don
I discovered a bug in the software that allowed me, or anyone, to see all of the Social Security Numbers of everyone from our company who had signed up. That means, I, or anyone, could have logged in and seen or changed another employee's health profile!
To emphasise to the person in charge of Human Relations, whose plan it was to out-source enrollement for health benefits, I enclosed her Social Securty Number in an e-mail to my boss to prove that I had found a bug in the software.
The e-mail never left our internal computer system; the e-mail did not go over the Internet, it remained within our building.
Ms. HR is irate that I sent her SSN via e-mail. Of course, she is trying to divert attention from the fact that she choose a third-party organization whose software exposed us all to having our personal health records, including medical numbers and preferred doctors, viewed on-line.
What legal exporsure do I have because I enclosed Ms. HR's SSN in an internal e-mail. Would she have grounds for a meritorius lawsuit against me? Is this grounds for firing in California.
And advice is appreciated. I made a mistake using her SSN, but I believe I did our company a service my notifing it that all employees were at risk to either identity theft, or to having information about themselves exposed to hacker.
Thanks for the help -Don