A data breach at a contractor for Health Share of Oregon, the Portland area’s Medicaid insurer, has potentially compromised the personal information of about 650,000 people.
Health Share said Wednesday that the breach involved a stolen laptop from the offices of GridWorks IC, which provides nonemergency transportation for Health Share’s members as part of its Ride to Care program. The laptop was stolen during a November break in at GridWorks offices but the contractor didn’t alert Health Share until January, the Medicaid insurer said.
On Wednesday, Health Share sent letters to those affected, offering one year of free credit monitoring, fraud consultation and identity theft restoration. The company said it took a month to verify that the theft had occurred and alert the Oregon Health Authority, Oregon attorney general and U.S. Department of Health and Human Services and then set up credit monitoring.
The breach affected 654,362 current and former Medicaid clients in the Portland metro area, Health Share said. The laptop contained members’ names, addresses, phone numbers, dates of birth, social security numbers and Medicaid identification numbers. Patients’ health histories were not on the computer.
“Though the theft took place at an external vendor, we take our members’ privacy and security very seriously,” Dr. Maggie Bennington-Davis, interim CEO and chief medical officer of Health Share said in a statement. “We are ensuring that members, partners, regulators and the community are made fully aware of this issue.”
GridWorks did not respond to a request for comment. It’s not clear what happened or why the company waited so long to alert Health Share.
Health Share said in its statement that it did not know whether the person or people who stole the laptop had access to members’ information. Health Share requires that its vendors encrypt personal information, the company said.
Health Share urged clients to take advantage of the free credit monitoring and take other steps to protect their information, including monitoring financial statements, credit reports and Social Security reports for suspicious activity; contacting banks about any suspected fraud; putting a freeze on credit reports; and reporting fraud to the Federal Trade Commission, Oregon’s attorney general or law enforcement.
Wednesday’s development was the latest involving problems with GridWorks. Last October, Health Share canceled its contract with GridWorks amid persistent problems with getting Medicaid members to appointments on time. GridWorks won the contract in 2018 following complaints about the previous vendor. The contract will end in April, when CareOregon will take over the nonemergency medical transportation services for Health Share’s clients in Multnomah, Clackamas and Washington counties.
Last October, PacificSource Community Solutions, another coordinated care organization, announced it had signed a contract with GridWorks to provide transportation services for Medicaid members in Hood River and Wasco County. But following reports of problems with GridWorks, PacificSource switched to another vendor - LogistiCare - for the Gorge.
Amid financial problems, GridWorks went into receivership late last year, with Multnomah County Circuit Court appointing an official to liquidate the company’s assets to pay off creditors.
The letters sent out Wednesday contain information about how members sign up for the service, including an activation code to sign up. Members can also call 800-491-3163 or go to www.HealthShareOregon.org for more information.
You can reach Lynne Terry at [email protected] or via Twitter @LynnePDX.
