Local
Kentucky Medicaid vendor breach may have exposed data of 3,816 people
A security breach at Gainwell Technologies may have exposed personal and Medicaid claims information for nearly 4,000 Kentuckians. The state says Social Security numbers, financial account details and electronic health records were not involved.
A security breach at Gainwell Technologies, a contractor for Kentucky’s Medicaid program, may have exposed information belonging to 3,816 people, the Cabinet for Health and Family Services said Monday.
The cabinet said the breaches occurred March 26, April 16 and April 21. Gainwell learned of them in August, and the state began notifying people who may have been affected on Oct. 16.
An unauthorized party accessed provider payment accounts on the KY Health-Net Provider Portal and downloaded files containing Medicaid member information, according to the cabinet. Potentially exposed data includes names, identification numbers tied to provider accounts or Medicaid claims, medical service dates, details about services and billing, payment amounts, and information about other health insurance policies.
The cabinet said the breach did not expose electronic health records, Social Security numbers or financial account information. It said investigators believe the intruder was seeking provider payment information rather than patient data.
The state said it secured the portal after discovering the breach, notified law enforcement and completed an investigation. Gainwell has added training for call-center staff who verify requests for new or changed provider portal access and is working with the Department for Medicaid Services on security improvements and investigations into suspected bad actors, the cabinet said.
Gainwell holds a two-year state contract valued at nearly $34 million for work that includes reviews for Kentucky’s Medicaid program.