On Monday , in a similar error , some California residents received emails from their health insurer , Anthem Blue Cross , with personal details about them contained in the subject line . The text of the emails encouraged members to visit their doctors for checkups and to discuss certain medical screening tests . Routine checkups and preventive screenings can help you live a healthy life , it said . But the emails subject lines included member - specific demographic details like age range and language . They also listed possible medical screening tests marked Y for recommended tests and N for tests not listed in the email . One woman in California , for example , received an email with the following subject line : Do nt miss out call your doctor today ; PlanState : CA ; Segment : Individual ; Age : Female Older ; Language : EN ; CervCancer3yr : N ; CervCancer5yr : Y ; Mammogram : N ; Colonoscopy : N This information is certainly sensitive , as you can imagine , because a call for certain tests , and frequency , could indicate a health problem , the woman who received that email wrote in a message to a reporter . Kristin Binns , a spokeswoman for Anthem Blue Cross , said the company was looking into the matter . Anthem Blue Cross is the trade name for Blue Cross of California . The email problem comes at a time when many medical institutions around the country are moving to more secure forms of communication when handling users health information . Many hospitals , for instance , have set up online portals where people can log on to see personalized health - related messages and screening recommendations rather than hospitals sending that information directly to personal email addresses . Hospitals have moved away from using ordinary email because there are all sorts of ways in which it can be compromised , intercepted in transit , or seen by your email provider , said Jonathan Mayer , a computer scientist and lawyer at Stanford who specializes in data security and privacy . He added , Its especially bad when the information is in the subject line because who knows where that could pop up on a desktop , a phone . California has a law requiring businesses to notify California residents , within a reasonable time period , if their unencrypted personal information including medical history , mental or physical condition , medical treatment or diagnosis by a health care professional might have been involved in a security breach . It is the first state to enact such a data breach notification law . It is unclear whether the emails sent on Monday will require a breach notification . In 2012 , Anthem Blue Cross agreed to settle a lawsuit brought by Kamala D. Harris , the California attorney general . The complaint charged that the company had failed to protect the personal information of plan members by sending letters to 33,000 people with their Social Security numbers visible through the envelope . As part of the settlement , the company agreed to put in new technical safeguards for its data management system and improve data security training for employees . In 2013 , Anthem Blue Cross sent data breach notices to an undisclosed number of doctors informing them that their names , Social Security numbers and business addresses had been erroneously displayed in a document posted on the companys website . ;