Colorado Department of Health Care Policy and Financing hcpf.colorado.gov Colorado Department of Health Care Policy and Financing data breach 2015: what happened and what to do
Between May 25 and July 5, 2015, a technical error sent letters with Medicaid clients' information to the wrong people. HHS's report says it affected up to 3,537 people. Data included names, addresses, state ID numbers and dates of birth.
View all 13,177 breaches- Breach date
- 25 May 2015
- Data exposed
- Names, Physical addresses, Dates of birth, State identification numbers, Medicaid case numbers, Employer names, Income information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
This 2015 incident involved the Colorado Department of Health Care Policy and Financing, which runs the state's Medical Assistance (Medicaid) program. It was a mailing error, not a hack.
What happened
HHS's report says that between May 25, 2015 and July 5, 2015 the Governor's Office of Technology, a business associate, sent letters for the department to the wrong Medical Assistance Program clients because of a technical error in its computer system. The breach affected up to 3,537 individuals according to the description, while HHS's breach portal lists 1,622.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What was exposed
The information varied from household to household. It included names, addresses, state identification numbers, Medicaid case numbers, employers' names, amount of income, the approved Advanced Premium Tax Credit, approvals or denials for the program, and dates of birth.
The response
The department notified HHS, the people affected and the media. Deloitte, the business associate's subcontractor, fixed the software used for the Colorado Benefits Management System so letters go to the right recipients, and added quality control for mailings. HHS's Office for Civil Rights obtained written assurances that the corrective actions were in place.
What this means for you
There's no sign of theft, but a stranger received your letter. State ID numbers, dates of birth and income details are enough to try impersonation or benefits fraud, so it's worth checking your accounts.
What to do if you were in it
- 1
Check your benefits and statements
Look at your Medicaid and other benefits notices for anything you didn't request. Report anything odd to the department using the contact details on its official website.
- 2
Look at your credit reports
Order your free credit reports and look for accounts you don't recognize. The FTC says a free credit freeze makes it harder for someone to open new accounts in your name, which is reasonable here because a date of birth and state ID number were included.
- 3
Use IdentityTheft.gov if something looks wrong
The FTC's IdentityTheft.gov/databreach page gives steps based on the type of data exposed, and lets you report identity theft and get a recovery plan.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches your email address or phone number appears in. Serus monitors breach databases and the dark web and alerts you when something new turns up. It can't remove data that has already leaked, so the steps above are still the fix.
Official filings
- U.S. Department of Health and Human Services , filed 18 Aug 2015 : 1,622 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by this breach?
If the department told you that one of its letters about your benefits went to someone else in mid-2015, you were. HHS's description says up to 3,537 people, and its portal lists 1,622.
What was exposed?
Names, addresses, state ID numbers, Medicaid case numbers, employer names, income amounts, tax credit amounts, program decisions and dates of birth, depending on the household.
Was it a hack?
No. HHS says a technical error in a business associate's system sent letters to the wrong clients.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
