North Carolina Department of Health and Human Services Email Breach Impacts 12,700
The North Carolina Department of Health and Human Services has announced that the names, addresses, and Medicaid numbers of 12,731 patients were exposed as a result of an email error. The data were sent via email to adult care homes last year, but the emails were not encrypted. Potentially, the emails could have been intercepted and the data obtained by individuals unauthorized to view the information.
The emails were sent on November 30, 2016 and the Department of Health and Human Services’ Office for Civil Rights has now been notified of the incident. No mention has been made of when the incident was discovered.
This is the third such incident of this nature to have affected the NC Department of Health and Human Services in the past 38 months.
On December 30, 2013, 49,000 Medicaid cards of minors were accidentally mailed to incorrect recipients, exposing Medicaid numbers, names and birth dates. The privacy breach was attributed to human error. Two years later, 1,615 patients were impacted when an unencrypted email containing was sent to the Granville County Health Department. The email contained a spreadsheet containing names, Medicaid ID numbers, provider’s name and ID number, and other Medicaid related information.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The two email incidents are not believed to have resulted in any individual’s data being compromised. No indications that the emails were intercepted has been found by the NC Department of Health and Human Services, although the possibility cannot be ruled out. Individuals affected by the latest incident have been advised to monitor their accounts for any signs of fraud as a precaution.
In order to prevent similar security breaches from occurring in the future, policies and procedures have now been changed. Rather than emailing Medicaid numbers and names, identification numbers will be used in future. Should any email messages be intercepted, it would not be possible for patients to be identified.
