Nearly 3,800 estimated to be impacted by security breach of KYHealth-Net system
FRANKFORT, Ky. – The Cabinet for Health and Family Services is sharing information regarding a recent security breach involving Gainwell Technologies.
According to a release by the cabinet on Monday, Gainwell Technologies is a “vendor contracted with the Kentucky Department for Medicaid Services’ KY Health-Net information system.”
On Aug. 18, the release says a health care provider notified Gainwell about an unauthorized third party gaining access to some provider payment accounts on the KY Health-Net Provider Portal before the third party downloaded files containing Kentucky Medicaid member information.
Officials say an investigation revealed unauthorized access occurred on March 26, April 16 and April 21.
The cabinet says “immediate action took place” upon this discovery, and steps were taken to secure the information portal.
Law enforcement has been notified, and a thorough investigation followed, according to the cabinet.
Who is affected, and what was accessed?
The release states it is believed the unauthorized caller was trying to access provider payment information rather than patient information. However, officials say an estimated 3,816 individuals are believed to be impacted by this incident.
While the impacted information varied by each person, the cabinet says the incident involved the disclosure of the following:
- Full names
- Identification numbers associated with the provider’s account or Medicaid claims
- Dates of medical services
- Information about services received and how they were billed
- Payment information, including amounts paid
- Information about applicable non-Medicaid health insurance, including policy and group numbers
What was not accessed?
According to the cabinet’s release, the unauthorized third party did not access the following:
- Electronic health records
- Social security numbers
- Financial account information
“While CHFS has not yet received reports of any misuse of personal information or harm to KY Health-Net members as a result of this incident, potentially impacted individuals are encouraged to remain vigilant,” the release stated.
The cabinet says it began notifying all potentially impacted individuals on Oct. 16.
The notice letter includes more information about the incident, as well as an offer of free identity protection and credit monitoring services for one year by calling 1-888-202-1242 or visiting https://app.idx.us/account-creation/protect. Additional assistance is available from CHFS at (833) 372-0004 or by mail at 275 E. Main St. in Frankfort KY 40601. Medicaid members can obtain information about their accounts by calling (866) 231-0003 Option #2 or online at https://kyid.ky.gov/helpcenter/.
The cabinet states it is “working with Gainwell Technologies to ensure all necessary actions are taken to mitigate the impact of the incident and to prevent future incidents from occurring.”
In addition, the release says Gainwell Technologies has started specialized training for call center staff on validating individuals requesting new or revised provider portal access, as well as implementing security enhancements while coordinating with the Department for Medicaid Services, Division of Program Integrity on suspected bad-actor investigations.
