Baltimore City Health Department investigates data breach involving insurance eligibility files

The Baltimore City Health Department is investigating a data breach involving its electronic medical records environment after unauthorized access was identified within a third-party insurance and eligibility processing system used by the agency.

City officials confirmed the incident involves files containing patients’ insurance eligibility verification information. The breach occurred within systems operated by Trizetto Provider Services, which supports insurance and eligibility processing for the department’s electronic medical record platform.

The health department uses an electronic medical record system provided by OCHIN Inc., a nonprofit health information technology organization that supports community health providers nationwide. OCHIN relies on Trizetto Provider Services for certain insurance and eligibility functions. The department was notified that Trizetto experienced a breach involving protected health information. OCHIN stated that its own systems remain secure and fully operational.

Officials emphasized that the Baltimore City Health Department’s internal systems were not affected by the incident. The investigation is ongoing to determine the scope of the breach and the individuals impacted.

Trizetto has engaged Kroll Associates, a firm specializing in fraud assistance and remediation services, to support response efforts. Affected individuals will receive notifications from Trizetto around Feb. 9. Those notices will include an offer of single bureau credit monitoring, a single bureau credit report, and a single bureau credit score at no cost.

The health department has also established a dedicated phone line for individuals seeking additional information. Questions can be directed to 410-545-6674.

Baltimore City Health Commissioner Dr. Michelle Taylor said the department is treating the matter with urgency and accountability.

“We deeply regret this breach of trust and take this matter extremely seriously,” Taylor said. “The privacy and security of our patients’ information is a top priority, and we are committed to ensuring our vendors comply with all security standards. We are working closely with TriZetto and other experts to mitigate the effects of the breach and to notify all affected individuals about the incident and available support services.”

The department said it will continue to monitor the situation and work with its partners to ensure appropriate safeguards and notifications are in place.