Health Share of Oregon healthshareoregon.org Health Share of Oregon data breach: what happened and what to do
Six laptops were stolen from the office of a Health Share of Oregon vendor in November 2019. HHS lists 654,362 people affected. Exposed data included names, addresses, phone numbers, birthdates, Social Security numbers and health insurance information.
View all 13,177 breaches- Breach date
- 18 Nov 2019
- Affected
- 654,362
- Data exposed
- Names, Physical addresses, Phone numbers, Dates of birth, Social security numbers, Health insurance information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Health Share of Oregon, a Medicaid coordinated care organization in the Portland area, reported that the office of a business associate was burglarized and six laptop computers were stolen. IAPP reported that the vendor was its transportation provider, GridWorks IC, and that the theft happened on November 18, 2019. Health Share learned of it in early January 2020 and began mailing letters in February 2020. The breach is listed on the HHS Office for Civil Rights portal with 654,362 people affected.
Sources checked: ocrportal.hhs.gov, iapp.org, hipaajournal.com
Last verified against the official page:
What was exposed
HHS says the data included names, addresses, phone numbers, birthdates, Social Security numbers and health insurance information. Coverage at the time said the laptops also held records of former members, which is why the count is so large.
A Social Security number plus a birthdate and address is enough to attempt new credit in your name. Phone numbers and insurance details also give scammers material for convincing calls about your coverage.
The response
Per HHS, Health Share notified affected people, HHS and the media, and provided free credit monitoring. It added safeguards, retrained all workforce members and built a new audit tool to check the security needs of its business associates.
What to do if you were in it
- 1
Freeze your credit
Place a free credit freeze at Equifax, Experian and TransUnion, as the FTC recommends. It stops lenders from opening new accounts in your name.
- 2
Use the free credit monitoring from your letter
The FTC recommends taking free monitoring if a company offers it. It alerts you to new activity but doesn't block it, so keep the freeze.
- 3
Watch your insurance and Medicaid statements
Look for services or claims you didn't use, and report them to your plan.
- 4
Expect scam calls and texts about your coverage
Don't give out your Social Security number or insurance ID to anyone who contacts you first. Hang up and call the number on your member card.
- 5
Report misuse
If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up in a new one.
Official filings
- U.S. Department of Health and Human Services , filed 5 Feb 2020 : 654,362 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Health Share of Oregon breach?
HHS lists 654,362 people. If you were a current or former member and received a letter, your information was on the stolen laptops.
What was exposed in the Health Share of Oregon breach?
Names, addresses, phone numbers, birthdates, Social Security numbers and health insurance information, according to HHS.
Should I freeze my credit?
If your Social Security number may have been included, yes. A freeze is free at Equifax, Experian and TransUnion.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- iapp.org/news/a/data-breach-affects-650k-health-share-of-oregon-members/
- hipaajournal.com/health-share-of-oregon-notifies-654000-members-about-business-associate-data-breach/
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
