Data Breach News

Health data missing from state agency

By Pablo Carlos Mora
July 23, 2010

A computer hard drive containing confidential information on thousands of state Medicaid clients is missing, but state officials are downplaying any threat of rampant identity theft.
"We take client privacy very seriously and are doing everything we can to recover the missing hard drive," Dara Hessee, public information officer for the Department of Public Health Care Policy and Financing, said Thursday. "To support our efforts, the Colorado Bureau of Investigation is conducting a criminal investigation based on our request."

The missing hard drive contains client information "for 105,000 households in Colorado receiving benefits from Medicaid and the Children's Health Insurance Program," Hessee said. Letters were mailed to clients beginning July 9.
A Chieftain reader who received a notification letter asked if her identity might be stolen by whoever has the hard drive.

The risk of identity theft is minimal, Hessee said.
"The hard drive contained protected health care information including client name, state ID number and the name of the client's program," Hessee said. "The hard drive did not contain addresses, dates of birth, Social Security numbers or any other financial information that could result in financial harm or identity theft."

The letters were sent to comply with federal privacy law, she said.
"The Office of Information Technology takes privacy concerns very seriously. On June 11, we requested CBI to conduct a criminal investigation," Hessee said. "We don't know if it was stolen or if there was malicious intent, but regardless, we wanted to conduct a formal criminal investigation."
The investigation is ongoing, she said.

"It does take time. It involves a series of interviews (of office staff)," Hessee said. "(CBI agents) are doing a thorough analysis of what might have happened.
"We are doing everything we can and working through all avenues to recover the hard drive."

Besides the CBI probe, the agency has begun a comprehensive review of security.
"The Office of Information Technology is a secured building and the office space where (the hard drive) was located is secured," Hessee said. "We are conducting a policy review process and a comprehensive security assessment looking for any weaknesses."

More information can be had by sending an e-mail to incident-info@state.co.us or by calling 866-668-2656 (toll-free) or 303-866-4431.

Source: Chieftain.com