January 21, 2014 - On the very first day that the federal and state healthcare exchanges opened up, there was a data breach. It occurred in Minnesota when the state sent out an email message which had an attachment on it. The attached file contained names, SSNs and other data on more than 2,000 people who had attempted to enroll in healthcare through the state's exchange. Now comes word of a similar incident using snail mail in Maryland.

Tweet

 The Maryland Department of Health and Mental Hygiene (DHMH) announced the data breach over the weekend. According to DHMH, more than 400 Medicaid packages containing data on more than 1,100 people were sent to incorrect addresses.

According to the state, the packages didn't contain SSNs or medical information but they did include names, addresses, dates of birth and Medicaid ID numbers. Enough information so that anyone receiving one of the packages could probably commit medical identity theft.

And much as with the data breach in Minnesota, it wasn't the state that caught the error. One of the people who received an erroneous Medicaid package was kind enough to pick up the phone and notify the state.

Since being made aware of the issue, Maryland has stopped sending out new Medicaid enrollment packages. The state is asking anyone who received one of the packages in error to call them at 1-855-642-8572.

The Department of Health and Mental Hygiene announced today that as a result of a programming error by Noridian, the prime contractor for the Maryland Health Benefit Exchange, a small percentage of Medicaid enrollment packages were mistakenly sent to the wrong addresses.

Information in the Medicaid enrollment packet includes name, date of birth, and Medicaid ID number. It does not contain Social Security number, financial information, or medical information.  There was no external incursion into the system or security breach by an outside entity.

An initial investigation has found that the error affected up to 383 households with 1,078 individuals.  This is fewer than 1% of the number of Marylanders enrolled in Medicaid to date with coverage beginning on January 1.

The issue was identified on Friday, after a consumer contacted the Medicaid enrollment broker and reported receiving the wrong Medicaid enrollment package. The state team immediately took action:

• The mailing of enrollment packages was stopped on Friday as the matter was investigated.  The Maryland Health Connection Consumer Services Center and Medicaid’s enrollment broker have been instructed how to assist callers who may have received the wrong information.
• Over the weekend, staff from Medicaid and IT have worked to trace the problem to its source and assess its scope. This initial review has found that the error was the result of a programming error by Noridian. No other individuals appear to be affected.
• The Department will notify directly everyone who has been affected and will send the correct enrollment packages early this week.

Individuals who receive the wrong Medicaid enrollment information should call the Maryland Health Connection Consumer Service Center at 1-855-642-8572.  All affected individuals have active Medicaid coverage and can still access services.

 byJim Malmberg

Note: When posting a comment, please sign-in first if you want a response. If you are not registered, click here. Registration is easy and free.

Follow me on Twitter:

Follow ACCESS