For many years, typing in an insured person's identity number was sufficient to reveal medical appointments intended for them in the Clalit Health Fund's automated response system. <\/p>\n\n\n\n
An insured person in the fund, who filed a class action lawsuit, did not give up for years, and only after the matter was rejected in two instances and reached the Supreme Court, did the Clalit Health Fund agree to close the loophole.<\/p>\n\n\n\n
For a long time, anyone who held an insured person's identity number in the Clalit Health Insurance Fund could call the fund's call center and receive classified information about future medical appointments - when the appointment was scheduled, with which doctor, and at which clinic. <\/p>\n\n\n\n
The information that was exposed was capable of revealing sensitive details about the condition of each insured person, their daily routine, and where they are expected to be.<\/p>\n\n\n\n
The problem was revealed as part of a class action lawsuit filed by the fund's insured, N. D., through attorneys Eva Steinmetz and Saleh Diwani, who specializes in class actions.<\/p>\n\n\n\n
However, even after the procedure was filed and the failure was brought to public attention, the identification mechanism was not changed for more than 4 years. Only after a legal battle that went through the Labor Court, the District Court, and finally in an appeals court in the Supreme Court, did the fund correct the mechanism.<\/p>\n\n\n\n
The road to fixing the security breach at the country's largest health insurance company was long and exhausting. The lawsuit filed by the insured, through attorneys Steinmetz and Diwani, was initially dismissed in the regional labor court, after a dispute arose over which court had jurisdiction to hear it. <\/p>\n\n\n\n
The lawyers resubmitted the lawsuit, this time to the Central District Court in Lod, but there it was rejected outright, and the appellant was ordered to pay legal costs of 25,000 shekels.<\/p>\n\n\n\n
Despite this, the appellant and her lawyers did not give up and appealed the decision to the Supreme Court.<\/p>\n\n\n\n
The breach that was revealed during the hearing deeply concerned the head of the panel, Judge Ofer Grosskopf, at least that is the impression one can get from the hearing minutes.<\/p>\n\n\n\n
During the hearing, Judge Grosskopf asked, for example, what would happen if someone held the ID number of the famous singer Omer Adam, and knew that he was insured by Clalit? Would that person be able to call the hotline and find out when the singer had a medical appointment, with which doctor, and at which clinic? The response from the health insurance company's attorney indicated that at least some of the appointments would allow for this type of information to be obtained.<\/p>\n\n\n\n
Judge Grosskopf made it clear during the hearing that there is no need to establish an impenetrable security mechanism, but a reasonable means of identification is required that will prevent a person who holds someone else's identity number from receiving personal information about him. He said that one does not need to be a "Nobel Prize winner in physics" to add an additional layer of identification, as is done in other vaults.<\/p>\n\n\n\n
According to attorneys Steinmetz and Diwani, who represented the class appellant, an ID number alone cannot serve as a key to obtaining medical and personal information. Even if the information provided only concerns queues, it may provide information about the type of problem an insured person suffers from, the treatment he receives, his future location, and his daily routine.<\/p>\n\n\n\n
The general counsel argued, on the other hand, that this is limited and mainly technical information, and that a simple and accessible telephone service should be maintained even for policyholders who have difficulty using the site or app. Among other things, the fund's counsel pointed to older policyholders and users of kosher telephones, for whom more complex verification could make it more difficult for them to receive service.<\/p>\n\n\n\n
But despite Clalit Health Insurance's stubborn resistance to blocking the serious security breach for many years, following the convening of the appeal hearing before the Supreme Court, the insurance company announced that it had changed the identification mechanism at the call center and blocked the security failure.<\/p>\n\n\n\n
According to the new method, the fund's automated services will only be provided when the call is made from a mobile phone number that is identified in the fund's systems and linked to the insured's ID card. When there is no match between the phone number and the ID number entered, the call center will not provide the information.<\/p>\n\n\n\n
After the changes were examined and found to be satisfactory, and in light of the Supreme Court's recommendation, the appellant and her attorney announced that they no longer saw a need to continue the class action lawsuit, but requested appropriate compensation and reimbursement of all expenses incurred throughout the years of the proceeding.<\/p>\n\n\n\n
In the ruling, recently issued by Judge Grosskopf with the concurrence of Justices Yael Wilner and Ruth Ronen, the Supreme Court determined that the request raised a real problem in the area of \u200b\u200bprotecting the privacy of Clalit policyholders, and that the procedure brought benefit to the public of policyholders.<\/p>\n\n\n\n
The judges noted that following the filing of the lawsuit, the health insurance company corrected the failure through a technological change, and also added clarifications regarding the manner in which the service was provided and the protection of the privacy of the insured.<\/p>\n\n\n\n
The court accepted the appeal, overturned the district court's ruling and the NIS 25,000 costs imposed on the appellant. Instead of returning the hearing on the request for approval to the district court, the Supreme Court ordered it to be struck out as part of a withdrawal, since its practical purpose had already been achieved and in order to leave an opening for those whose privacy was violated to take appropriate legal action.<\/p>\n\n\n\n
Clalit was ordered to pay the insured a compensation of 25,000 shekels, and to her lawyers a fee of 100,000 shekels, plus VAT. In addition, the fund was ordered to refund the insured the fee she paid in the district court.<\/p>\n\n\n\n
The court emphasized in its ruling that the issue concerns a possible violation of the privacy of a large number of insured persons, and that it is of particular importance since it concerns medical and personal information. It was further clarified that the deletion of the proceeding does not prevent insured persons who believe that they have suffered personal harm from filing an independent lawsuit.<\/p>\n\n\n\n
Clalit stated: The proceedings ended by withdrawing and deleting the request to approve the lawsuit as a class action, after the Honorable Court was convinced that the actions taken by Clalit provided a response to the plaintiffs' claims regarding possible violation of privacy, and that there was no longer any hope of continuing the proceedings. The court rejected the plaintiffs' request for a ruling on compensation and severance pay, and ruled in their favor for amounts significantly lower than those they requested.<\/p>","protected":false},"excerpt":{"rendered":"\u05dc\u05d0\u05d5\u05e8\u05da \u05e9\u05e0\u05d9\u05dd \u05d0\u05e8\u05d5\u05db\u05d5\u05ea \u05d4\u05e1\u05e4\u05d9\u05e7\u05d4 \u05d4\u05e7\u05dc\u05d3\u05ea \u05de\u05e1\u05e4\u05e8 \u05d6\u05d4\u05d5\u05ea \u05e9\u05dc \u05de\u05d1\u05d5\u05d8\u05d7 \u05e2\u05dc \u05de\u05e0\u05ea \u05dc\u05d7\u05e9\u05d5\u05e3 \u05ea\u05d5\u05e8\u05d9\u05dd \u05e8\u05e4\u05d5\u05d0\u05d9\u05d9\u05dd \u05d4\u05de\u05d9\u05d5\u05e2\u05d3\u05d9\u05dd \u05dc\u05d5 \u05d1\u05de\u05e2\u05e0\u05d4 \u05d4\u05d0\u05d5\u05d8\u05d5\u05de\u05d8\u05d9 \u05e9\u05dc \u05e7\u05d5\u05e4\u05ea \u05d7\u05d5\u05dc\u05d9\u05dd \u05db\u05dc\u05dc\u05d9\u05ea. \u05de\u05d1\u05d5\u05d8\u05d7\u05ea \u05d1\u05e7\u05d5\u05e4\u05d4, \u05e9\u05d4\u05d2\u05d9\u05e9\u05d4 \u05d1\u05e7\u05e9\u05d4 \u05dc\u05ea\u05d5\u05d1\u05e2\u05e0\u05d4 \u05d9\u05d9\u05e6\u05d5\u05d2\u05d9\u05ea, \u05dc\u05d0 \u05d5\u05d9\u05ea\u05e8\u05d4 \u05dc\u05d0\u05d5\u05e8\u05da \u05e9\u05e0\u05d9\u05dd, \u05d5\u05e8\u05e7 \u05dc\u05d0\u05d7\u05e8 \u05e9\u05d4\u05e2\u05e0\u05d9\u05d9\u05df \u05e0\u05d3\u05d7\u05d4 \u05d1\u05e9\u05ea\u05d9 \u05e2\u05e8\u05db\u05d0\u05d5\u05ea \u05d5\u05d4\u05d2\u05d9\u05e2 \u05dc\u05e4\u05ea\u05d7\u05d5 \u05e9\u05dc \u05d1\u05d9\u05ea \u05d4\u05de\u05e9\u05e4\u05d8 \u05d4\u05e2\u05dc\u05d9\u05d5\u05df, \u05d4\u05d5\u05d0\u05d9\u05dc\u05d4 \u05e7\u05d5\u05e4\u05ea \u05d7\u05d5\u05dc\u05d9\u05dd \u05db\u05dc\u05dc\u05d9\u05ea \u05dc\u05e1\u05d2\u05d5\u05e8 \u05d0\u05ea \u05d4\u05e4\u05e8\u05e6\u05d4. \u05d1\u05de\u05e9\u05da \u05ea\u05e7\u05d5\u05e4\u05d4 \u05de\u05de\u05d5\u05e9\u05db\u05ea, \u05db\u05dc […]","protected":false},"author":47,"featured_media":1062295,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[4],"tags":[2004,15261,7231,66408,171,11420],"class_list":["post-1062294","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-4","tag-2004","tag-15261","tag-7231","tag-66408","tag-171","tag-11420"],"acf":[],"yoast_head":"\n