Updated: Data breach at Arkansas DHS could affect 26,000 Medicaid beneficiaries; no evidence of ID theft, agency says | Arkansas Blog

Updated: Data breach at Arkansas DHS could affect 26,000 Medicaid beneficiaries; no evidence of ID theft, agency says

by

2 comments
The Arkansas Department of Human Services announced Friday that spreadsheets containing personal information pertaining to some 26,044 Medicaid beneficiaries were emailed to an agency employee's "home email address."

DHS said this constituted a "breach of information as described in state and federal law."

In a press release, DHS said the spreadsheets included "linked Medicaid identification numbers, some social security numbers and codes for medical procedures that beneficiaries underwent." The agency has contacted the Pulaski County prosecutor's office to pursue criminal charges.

Those beneficiaries affected by the data breach should be receiving notification from DHS, the agency said.

UPDATE, 3:45 p.m.: DHS Spokesperson Amy Webb told the Arkansas Times this afternoon that the agency has no evidence that the breach has led to any instance of identity theft, or that that was the intent of the person who sent the spreadsheets.

A former DHS employee sent the documents from her work email to her personal email on March 23rd. "It was not an accidental email," Webb said. "We do believe the employee had awareness that she was about to be terminated, and after a conversation with the supervisor in which it was pretty clear she was going to be terminated, she then … sent the files to her personal email account." She was then fired on March 24th.

The employee, who held the position of Payment Integrity Coding Analyst, initiated the wrongful termination lawsuit against DHS after being fired. Webb said the agency's attorneys came across the emails as they prepared to represent DHS in court, and they notified DHS' privacy officer on August 7. DHS initiated an investigation, which is ongoing.

Webb said the letters notifying beneficiaries of the breach should be sent out early next week.

Here's the full release:
DHS Identifies Breach of Personal Information for Some Medicaid Beneficiaries
Agency referring situation to local authorities for prosecution

The Arkansas Department of Human Services (DHS) has determined that spreadsheets with personal and health information for some Medicaid beneficiaries were emailed to an employee’s home email address, constituting a breach of information as described in state and federal law and DHS policy.

After manually counting and sorting names to identify duplicates, DHS found that there were 26,044 unique names of Medicaid beneficiaries on the spreadsheets with linked Medicaid identification numbers, some social security numbers and codes for medical procedures that beneficiaries underwent.

“We at DHS want to make sure beneficiaries are aware of this situation, understand what happened and know the steps we are taking to ensure something like this doesn’t happen again,” said DHS Director Cindy Gillespie. “The privacy of beneficiaries is important to us, and we take this situation very seriously.”

The emailed spreadsheets were discovered as attorneys prepared to represent DHS in court against a wrongful termination lawsuit. The DHS privacy officer was notified by attorneys of the emails and reviewed the materials to determine the scope of the breach.

DHS is sending a letter to affected beneficiaries, and all DHS employees have been reminded about the responsibility DHS has to protect beneficiary information.

Gillespie noted that all DHS employees undergo security and privacy training and cannot gain internet access at work until they pass a test on what they were taught. The training includes the prohibition of emailing confidential information outside the scope of a person’s job. DHS is working with attorneys to recover the spreadsheets and has contacted the Pulaski County Prosecuting Attorney’s office to pursue criminal charges and prosecution.

The DHS Office of Security, Compliance and Integrity will review the situation to determine whether there are additional steps DHS can take ensure this does not happen again. 



From the ArkTimes store

Comments (2)

Showing 1-2 of 2

Add a comment
 

Add a comment

Clicky