Connecticut Medicaid data breach exposes payment information of 41,000 HUSKY Health members

Connecticut’s Department of Social Services is alerting roughly 41,000 HUSKY Health members that their claims and payment information was exposed after an unauthorized party breached a Medicaid provider’s account.

Gainwell Technologies, which serves as the state’s fiscal agent and administers accounts for the HUSKY Health program, detected the intrusion on June 25. The company moved to lock down the provider portal and bolster its defenses once the activity was discovered, according to DSS.

Investigators determined the person behind the breach appeared to be pursuing financial gain rather than seeking patient records. Electronic health records, Social Security numbers and financial account details were not compromised, and DSS said there is no indication so far that any exposed information has been used improperly.

The scope of exposed data differed from person to person. Collectively, the incident touched full names, identification numbers tied to a provider’s payment account or a Medicaid claim, dates of medical services, details on the services rendered and how they were billed, payment amounts, and, where applicable, policy and group numbers for non-Medicaid health insurance.

DSS Commissioner Andrea Barton Reeves said protecting patients remains the department’s top priority, crediting Gainwell’s response for limiting the damage. "We take this incident seriously and are grateful that Gainwell’s swift action contained the breach," Barton Reeves said. "We continue to work closely with our contractor, cybersecurity experts, and law enforcement to investigate fully and strengthen our security protections."

Gainwell has since added further safeguards to reinforce the portal’s overall security, state officials said. DSS and the company began sending notification letters by postal mail to affected members on Friday. Those individuals will be offered credit monitoring, identity monitoring and fraud support services at no cost. Anyone who suspects they may be affected can call 1-866-200-0986 for additional information.

This marks the second time this year that DSS has had to notify HUSKY Health members of a security incident tied to a Medicaid provider portal. In March, an unauthorized user gained access to accounts belonging to roughly 22,500 patients of Hartford HealthCare.