In violation of Department policy and its contract with the Department, a GHS employee saved personal health information on an unencrypted, portable USB memory device and then left UDOH headquarters with the device. The employee misplaced the device while traveling between Salt Lake City, Denver, and Washington DC. GHS confirmed the data were missing on January 15.
Personal information included in the data is limited to a Medicaid recipient's name, Medicaid identification number, age (but not date of birth), and recent prescription drug use history.
"There were no Social Security numbers or financial information included in the data, so we believe the potential risk for identity theft is minimal. Further, we have no reason to believe the data were targeted by anyone to be used for malicious purposes," said UDOH Deputy Director and state Medicaid Director Michael Hales. "Nevertheless, we understand the anxiety this will likely cause, and want clients to know we are taking all reasonable precautions to ensure the missing data cannot be used to harm individual clients or defraud the Medicaid program."
The Department is taking steps to protect the affected Medicaid identification numbers against potential fraudulent use. The Office of the Inspector General for Medicaid Services has been alerted to the situation and will also be monitoring for suspicious activity. In addition, the Office of the Health Data Security Ombudsman will commit its full resources to assisting affected clients in any way they need.
Medicaid clients whose information was involved will receive letters from the UDOH alerting them to the situation within the next several days.
"I have directed UDOH attorneys to review our contract with Goold Health Systems, and I fully intend to seek whatever financial or contractual remedies are available in order to ensure GHS is held accountable for this serious mistake," said UDOH Executive Director Dr. David Patton. "Protecting our clients' personal information is of utmost importance to our department, and it must be the number one priority of our contractors as well."
Patton also stated he expects GHS to assure the appropriate disciplinary action is taken, and that the responsible employee no longer be allowed to work with UDOH data.
For more information, Medicaid clients can call 1-800-662-9651 and select option 1 and then option 2, or e-mail firstname.lastname@example.org.