Maximus Reports Breach Affecting 334,000 Medicaid Healthcare Providers
Ohio Medicaid has announced that its data manager, Maximus Corp, has experienced a data breach in which the personal information of Medicaid healthcare providers has been compromised.
Maximus is a global provider of government health data services. Through the provision of those services the company had been provided with the personal information of Medicaid healthcare providers. On May 19, 2021, Maximus discovered a server that contained personal information provided to the Ohio Department of Medicaid (ODM) or to a Managed Care Plan had been accessed by unauthorized individuals between May 17 and May 19, 2021.
Upon discovery of the breach, Maximus took the server offline to prevent any further unauthorized access and a leading third-party cybersecurity firm was engaged to assist with the investigation. The cybersecurity firm confirmed that the breach was confined to an application on the server and no other servers, applications, or systems were affected.
No evidence was found to indicate any information within the application has been misused, although data theft could not be ruled out. The application was used for the purposes of credentialing or tax identification related to the role of each individual as a healthcare provider.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The types of sensitive data contained within the application was limited to names, dates of birth, Social Security numbers, and Drug Enforcement Agency numbers. Maximus said individuals covered by Medicaid were not affected and the breach.
Maximus said the rapid detection of the breach limited potentially adverse impacts; however, since there is a possibility of data theft, all individuals affected were notified on June 18, 2021, and have been offered complimentary credit monitoring services for 24 months.
The breach has been reported to the Maine Attorney General as affecting 334,690 individuals. Those individuals are located in multiple U.S. states.
