New York Insurer Resolves Social Security Number Breach

In addition to the monetary penalty, the agreement requires EmblemHealth to implement a corrective action plan and conduct a comprehensive risk assessment.

"The careless handling of Social Security numbers is never acceptable," Schneiderman said in the statement. "New Yorkers need to be able to trust that companies entrusted with their private information will guard it appropriately. This starts with good governance—which is why my office will continue to push for stronger security laws and hold businesses accountable for protecting their customers' personal data."

The EmblemHealth payment will amount to about $7 per Social Security number exposed.

It's not the first time in recent years that Schneiderman has reached a settlement with the New York City-based health care provider that has 3.4 million members. In 2014, EmblemHealth paid $1.2 million to settle allegations that the company's subcontractor issued 64% more denials of coverage for behavioral and substance abuse issues than it did in medical cases, allegedly in violation of New York's 2006 mental health parity law.

— Read Some 2015 HealthCare.gov Subsidy Applicants Were Dead: GAO on ThinkAdvisor.

Kristen Rasmussen is an Atlanta-based reporter who covers health care, corporate legal departments and in-house attorneys for ALM.