WellPoint has agreed to pay the government $1.7 million tosettle potential violations of HIPAA, the U.S. Department of Healthand Human Services said Thursday.

An HHS investigation found that the health insurance giant“impermissibly disclosed” electronic protected health informationof 612,402 individuals between Oct. 23, 2009 and March 7, 2010.That information included names, dates of birth, addresses, SocialSecurity numbers, telephone numbers and health information.

The health agency said that WellPoint may have violated HIPAA —the Health Insurance Portability and Accountability Act of 1996 —after the Indianapolis-based insurer reported the breach toHHS.

HHS said the case “sends an important message to HIPAA-coveredentities to take caution when implementing changes to theirinformation systems, especially when those changes involve updatesto Web-based applications or portals that are used to provideaccess to consumers’ health data using the Internet.”

Beginning Sept. 23, 2013, liability for many of HIPAA’srequirements will extend directly to business associates thatreceive or store protected health information, such as contractorsand subcontractors.