Official figures show that the data of more than 1.9 million members and users of a US health insurance policy and healthcare provider had their data compromised after insurer Health Net lost nine server drives from its data center in Rancho Cordova, California earlier this year.

It is the worst case of its type in the US since figures were officially collected by the Department of Health and Human Services.

The insurer was first aware of the incident on January 21 but according to reports, Health Net only alerted authorities on March 14.

Health Net's IT infrastructure is managed by IBM, which discovered the drives which included addresses, health information, social security numbers and financial information were missing, sparking an investigation.

IBM entered into a five-year IT infrastructure services agreement with Health Net in August 2008, with a contract worth more than US$300m. It was signed to manage the entire IT infrastructure with a view to bring about data center reliability for the insurer.

Infrastructure management services including data center services, IT security management, help desk and desk side support were to be provided by IBM, with network and voice and data management being handled by its partner AT&T. 

It is the second large-scale event of its type experience by Health Net, In May 2009 it lost a computer disk drive with details of up to 1.5m consumers. This also fell into IBM's contract period.