About 41,000 state Medicaid members were affected by a data breach after an unauthorized third party gained access to a provider’s reimbursement account and obtained claims and payment information, according to the state Department of Social Services.
DSS and Gainwell Technologies, the state’s fiscal agent and account administrator for Medicaid (HUSKY), became aware of unauthorized access to certain payment accounts on the HUSKY provider portal on June 25, the DSS said in a news release Friday.
On June 18, the unauthorized third party first gained access to the provider’s reimbursement account, the release said.
DSS and Gainwell determined the unauthorized access didn’t compromise electronic health records, Social Security numbers, or financial account information, the release said.
DSS and Gainwell determined that while the impacted information varied by person, as a whole, the incident involved the person’s full name; identification number associated with the provider’s payment account or Medicaid claim; and dates of medical services, the statement said.
The incident also involved information about services received and how people were billed. Payment information was also involved, including amounts paid and information about applicable non-Medicaid health insurance, including policy and group number, the statement said.
The unauthorized activity appeared financially motivated rather than directed at obtaining patient data, the release said.
After becoming aware of this activity, Gainwell took steps to secure the provider portal and enhance the overall security of the provider portal, the release said.
DSS and Gainwell are working with external cybersecurity experts and state and federal law enforcement to investigate and resolve the incident. Additional security controls have been deployed to enhance the overall security strength of the provider portal, the release said.
“Patient safety and privacy are paramount,” Commissioner Andrea Barton Reeves said. “We take this incident seriously and are grateful that Gainwell’s swift action contained the breach. We continue to work closely with our contractor, cybersecurity experts, and law enforcement to investigate fully and strengthen our security protections.”
On Friday, DSS and Gainwell began notifying affected people through the mail. The notification includes an offer of credit and identity monitoring services and certain fraud support services, according to the news release.
Medicaid is the largest payer of long-term care in the state, covering residents in nursing homes and those receiving home healthcare, according to the state.
In May, a hacker accessed information belonging to thousands of Hartford HealthCare patients through the HUSKY provider portal, the state Department of Social Services said.
Individuals who believe they may be affected are asked to call 866-200-0986 for information.
This article originally published at Connecticut HUSKY data breach affects 41,000 Medicaid members. Here’s what was exposed.
