NAHGA Claims Services reports intrusion that exposed personal and health data

The Wisconsin Department of Corrections said it improperly released the protected health information of 1,723 people after an employee disclosed restricted medical data in response to a public records request.

The department identified the breach on September 16, 2025, and determined that the disclosure occurred on July 17, 2025, when records containing confidential medical details were sent to a state agency office in Kenosha. The mistake involved the names of individuals evaluated by the department’s Bureau of Health Services as part of a Chapter 980 Special Purpose Evaluation, along with their mental health diagnoses and diagnostic test scores. The evaluations dated up to October 2022 and involved both current inmates and people previously discharged from state custody.

Once the error was detected, the receiving agency was contacted and directed to permanently delete the documents from its systems. The department said the incident constituted a violation of the Health Insurance Portability and Accountability Act.

Officials said they began notifying all affected individuals and planned to report the breach to the U.S. Department of Health and Human Services. Individuals receiving letters were given access to a dedicated information line.

The department said public records staff implemented new safeguards to prevent future incidents. The changes required thorough reviews of all outgoing records to ensure they did not contain protected health information. If such information appeared in any materials, staff would obtain written patient authorization before release or apply the necessary redactions.