CareCentrix carecentrix.com CareCentrix data breach: what happened and what to do
CareCentrix told HHS that its collections vendor, American Medical Collection Agency, found unauthorized access to its web payment portal. It affected 467,621 people. Exposed data included names, dates of birth, Social Security numbers, insurance and financial information.
View all 13,177 breaches- Breach date
- Aug 2018
- Made public
- 11 Jul 2019
- Affected
- 467,621
- Data exposed
- Identification numbers, Health insurance information, Names, Dates of birth, Physical addresses, Phone numbers, Social security numbers, Financial information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
CareCentrix, a home health benefits company, reported to the U.S. Department of Health and Human Services (HHS) that its business associate, the American Medical Collection Agency (AMCA), discovered unauthorized access to its web payment portal. HHS lists 467,621 people affected.
AMCA's system is reported to have been exposed from August 1, 2018 to March 30, 2019. The incident reached several healthcare companies that used AMCA to collect unpaid bills, so you may see much larger totals in stories about the whole AMCA case. The 467,621 figure is the CareCentrix share.
Sources checked: ocrportal.hhs.gov, hipaajournal.com, cbsnews.com
Last verified against the official page:
What was exposed
HHS says the protected health information included identification numbers, insurance information, names, dates of birth, addresses, phone numbers, Social Security numbers and financial information. The Maryland Attorney General noted that what leaked varied from one AMCA client to the next.
With a Social Security number and date of birth, a criminal can try to open credit or file a false tax return in your name. Insurance details can be used for medical identity theft, where someone gets care billed to your plan. Contact details give scammers a believable reason to call or text.
The company's response
CareCentrix notified all affected people and the media. Because of the breach it ended its relationship with AMCA. Other AMCA clients, including Quest and LabCorp, also dropped the firm, and AMCA's parent company filed for bankruptcy.
What this means for you
If CareCentrix sent you a letter, assume the Social Security number is in circulation. Breach data can't be pulled back, so the useful moves are the ones that make it harder to use.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A freeze is free and stops most new accounts being opened in your name. Place it separately at Equifax, Experian and TransUnion, as the FTC explains. Lift it when you apply for credit yourself.
- 2
Read your statements and explanation of benefits
Look for charges, accounts or medical services you don't recognize, and report anything odd to the company that sent it.
- 3
Expect messages that mention the breach
Scammers write to affected people with real details to sound credible. Don't click links in unexpected emails or texts. Go to the company's own site or the phone number on your card.
- 4
Report misuse
If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
- 5
Check whether your email or phone is in this and other breaches
A free Serus scan checks breach databases for your email, phone and other details and alerts you when they appear in a new leak.
Official filings
- U.S. Department of Health and Human Services , filed 11 Jul 2019 : 467,621 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the CareCentrix breach?
CareCentrix notified affected people by letter. If you got one, you were included. HHS lists 467,621 people in total.
What was exposed?
Names, dates of birth, addresses, phone numbers, Social Security numbers, insurance information, identification numbers and financial information, per HHS.
Should I check my insurance statements?
Yes. Read your explanation of benefits for services you didn't receive, which can signal medical identity theft.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
