HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Maximus Reports Breach Affecting 334,000 Medicaid Healthcare Providers

Ohio Medicaid has announced that its data manager, Maximus Corp, has experienced a data breach in which the personal information of Medicaid healthcare providers has been compromised.

Maximus is a global provider of government health data services. Through the provision of those services the company had been provided with the personal information of Medicaid healthcare providers. On May 19, 2021, Maximus discovered a server that contained personal information provided to the Ohio Department of Medicaid (ODM) or to a Managed Care Plan had been accessed by unauthorized individuals between May 17 and May 19, 2021.

Upon discovery of the breach, Maximus took the server offline to prevent any further unauthorized access and a leading third-party cybersecurity firm was engaged to assist with the investigation. The cybersecurity firm confirmed that the breach was confined to an application on the server and no other servers, applications, or systems were affected.

No evidence was found to indicate any information within the application has been misused, although data theft could not be ruled out. The application was used for the purposes of credentialing or tax identification related to the role of each individual as a healthcare provider.

Get The Checklist

Free and Immediate Download
HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The types of sensitive data contained within the application was limited to names, dates of birth, Social Security numbers, and Drug Enforcement Agency numbers. Maximus said individuals covered by Medicaid were not affected and the breach.

Maximus said the rapid detection of the breach limited potentially adverse impacts; however, since there is a possibility of data theft, all individuals affected were notified on June 18, 2021, and have been offered complimentary credit monitoring services for 24 months.

The breach has been reported to the Maine Attorney General as affecting 334,690 individuals. Those individuals are located in multiple U.S. states.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.