Indiana Attorney General Gregory Zoeller has sued Indianapolis-based WellPoint seeking $300,000 in civil penalties, saying that the nation's largest private health insurer waited too long to notify more than 32,000 consumers of a breach involving their protected health information. The suit, filed under Indiana law--not HIPAA--alleges that a website for applying for individual coverage was breached in October 2009, but the company didn't secure it until March 2010. According to the suit, WellPoint received notice on Feb. 22 from one affected applicant, but didn't attempt to contact the consumer until March 4, or correct the breach until March 8, after that consumer filed a class-action suit against the company. And, the AG says, WellPoint didn't finish notifying others affected by the breach until July 30, Health Data Management reports. Article