Hartford (Conn.) HealthCare patients are among approximately 22,500 individuals whose information was accessed after an unauthorized third party gained entry to payment accounts on Connecticut’s Medicaid provider portal.
The incident involved the HUSKY Medicaid provider portal, which is administered by the Connecticut Department of Social Services and supported by Gainwell Technologies, according to a May 22 news release from the Connecticut Department of Social Services and Gainwell Technologies.
DSS and Gainwell said they learned March 25 that an unauthorized third party had accessed a small number of Hartford HealthCare payment accounts on the portal. An investigation later determined the activity began March 4 when the hacker used compromised credentials belonging to Hartford HealthCare employees to gain access to user accounts on the portal.
After discovering the activity, DSS and Gainwell said they launched an investigation with outside cybersecurity experts and coordinated with federal law enforcement. The organizations also took steps to secure the provider portal and terminate the unauthorized party’s access.
Investigators determined the attack has been contained and the unauthorized third party no longer has access to the affected environment.
According to DSS and Gainwell, investigators believe the activity appeared to be financially motivated rather than aimed at obtaining patient data. Still, the unauthorized party accessed information tied to approximately 22,500 individuals.
The compromised information varied by individual but collectively included names, identification numbers associated with Hartford HealthCare accounts or Medicaid claims, dates of medical services, information about services received and billing details, payment information including amounts paid, and non-Medicaid insurance information such as policy and group numbers, according to the release.
The organizations said Social Security numbers and financial account information were not involved because the information was not stored in the affected system.
DSS and Gainwell said they are implementing additional security enhancements intended to reduce the risk of similar incidents in the future.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.