Updated: Data breach at Arkansas DHS could affect 26,000 Medicaid beneficiaries; no evidence of ID theft, agency says | Arkansas Blog

Friday, September 15, 2017

Updated: Data breach at Arkansas DHS could affect 26,000 Medicaid beneficiaries; no evidence of ID theft, agency says

Posted By on Fri, Sep 15, 2017 at 1:52 PM

The Arkansas Department of Human Services announced Friday that spreadsheets containing personal information pertaining to some 26,044 Medicaid beneficiaries were emailed to an agency employee's "home email address."

DHS said this constituted a "breach of information as described in state and federal law."

In a press release, DHS said the spreadsheets included "linked Medicaid identification numbers, some social security numbers and codes for medical procedures that beneficiaries underwent." The agency has contacted the Pulaski County prosecutor's office to pursue criminal charges.

Those beneficiaries affected by the data breach should be receiving notification from DHS, the agency said.

UPDATE, 3:45 p.m.: DHS Spokesperson Amy Webb told the Arkansas Times this afternoon that the agency has no evidence that the breach has led to any instance of identity theft, or that that was the intent of the person who sent the spreadsheets.

A former DHS employee sent the documents from her work email to her personal email on March 23rd. "It was not an accidental email," Webb said. "We do believe the employee had awareness that she was about to be terminated, and after a conversation with the supervisor in which it was pretty clear she was going to be terminated, she then … sent the files to her personal email account." She was then fired on March 24th.

The employee, who held the position of Payment Integrity Coding Analyst, initiated the wrongful termination lawsuit against DHS after being fired. Webb said the agency's attorneys came across the emails as they prepared to represent DHS in court, and they notified DHS' privacy officer on August 7. DHS initiated an investigation, which is ongoing.

Webb said the letters notifying beneficiaries of the breach should be sent out early next week.

Here's the full release:
DHS Identifies Breach of Personal Information for Some Medicaid Beneficiaries
Agency referring situation to local authorities for prosecution

The Arkansas Department of Human Services (DHS) has determined that spreadsheets with personal and health information for some Medicaid beneficiaries were emailed to an employee’s home email address, constituting a breach of information as described in state and federal law and DHS policy.

After manually counting and sorting names to identify duplicates, DHS found that there were 26,044 unique names of Medicaid beneficiaries on the spreadsheets with linked Medicaid identification numbers, some social security numbers and codes for medical procedures that beneficiaries underwent.

“We at DHS want to make sure beneficiaries are aware of this situation, understand what happened and know the steps we are taking to ensure something like this doesn’t happen again,” said DHS Director Cindy Gillespie. “The privacy of beneficiaries is important to us, and we take this situation very seriously.”

The emailed spreadsheets were discovered as attorneys prepared to represent DHS in court against a wrongful termination lawsuit. The DHS privacy officer was notified by attorneys of the emails and reviewed the materials to determine the scope of the breach.

DHS is sending a letter to affected beneficiaries, and all DHS employees have been reminded about the responsibility DHS has to protect beneficiary information.

Gillespie noted that all DHS employees undergo security and privacy training and cannot gain internet access at work until they pass a test on what they were taught. The training includes the prohibition of emailing confidential information outside the scope of a person’s job. DHS is working with attorneys to recover the spreadsheets and has contacted the Pulaski County Prosecuting Attorney’s office to pursue criminal charges and prosecution.

The DHS Office of Security, Compliance and Integrity will review the situation to determine whether there are additional steps DHS can take ensure this does not happen again. 

Tags: , ,

From the ArkTimes store

Favorite

Comments (2)

Showing 1-2 of 2

Add a comment

 
Subscribe to this thread:
Showing 1-2 of 2

Add a comment

More by Benjamin Hardy

Readers also liked…

  • Auditor Lea caught not telling the truth

    State Auditor Andrea Lea, who began her tenure in statewide office with a degree of competence unseen in some other Republican counterparts (think Treasurer Dennis Milligan particularly), is becoming more deeply mired in a political scandal.
    • Mar 4, 2016
  • City Board votes to table homeless feeding ordinance for 8 weeks, study with commission

    The Little Rock Board of Directors voted tonight to table for eight weeks an ordinance that homeless advocates say would severely limit the ability of charities to feed homeless people in city parks. Before the ordinance was punted, Vice Mayor Kathy Webb proposed a nine-member commission to study the issue and make recommendations to the board.
    • May 16, 2017
  • Another Republican miracle-working governor

    Great piece in Washington Post on the budget crisis in Louisiana. Big tax cuts and corporate welfare will do that to a state, particularly to a state whose previous governor, Republican Bobby Jindal, refused to join the Obamacare-funded Medicaid expansion. There's a lesson there for Arkansas.
    • Mar 4, 2016

Most Shared

  • ASU to reap $3.69 million from estate of Jim and Wanda Lee Vaughn

    Arkansas State University announced today plans for spending an expected $3.69 million gift in the final distribution of the estate of Jim and Wanda Lee Vaughn, who died in 2013 and 2015 respectively.
  • Bad health care bill, again

    Wait! Postpone tax reform and everything else for a while longer because the Senate is going to try to repeal and replace the Affordable Care Act one more time before September ends and while it can do it with the votes of only 50 senators.
  • Sex on campus

    Look, the Great Campus Rape Crisis was mainly hype all along. What Vice President Joe Biden described as an epidemic of sexual violence sweeping American college campuses in 2011 was vastly overstated.
  • The inadequate legacy of Brown

    LRSD continues to abdicate its responsibility to educate poor black students.

Most Recent Comments

Blogroll

 

© 2017 Arkansas Times | 201 East Markham, Suite 200, Little Rock, AR 72201
Powered by Foundation