HHS and IDHS report incident involving protected health information

 

[February 27, 2021] 

Pursuant to the requirements of the Health Insurance Portability and Accountability Act, 45 CFR Sections 164.400-414 and corresponding regulations of the State of Illinois, the Illinois Department of Innovation & Technology (DoIT), the Illinois Department of Healthcare and Family Services (HFS) and the Illinois Department of Human Services (IDHS) (collectively, the Departments) are notifying the media of a security incident with the State of Illinois’ Integrated Eligibility System (IES).

A file received from the National Change of Address registry at the United States Postal Service was matched against an out-of-date client file by a state employee. The resulting file was loaded into IES, the State’s eligibility system, and incorrectly changed the addresses for 8,848 HFS and IDHS households. As a result of the error, in late November and December 2020, notices were mailed to 8,848 households at incorrect addresses. Notices were sent to the right customer name at the wrong customer address.

The information involved depends on the type of notice that was mailed. The notices may have included: name, case number, status as a recipient of medical assistance, Temporary Assistance to Needy Families (TANF) or Supplemental Nutrition Assistance Program (SNAP) benefits, names of dependents, birth dates, medical information numbers (RIN), medical eligibility category, and medical coverage dates.

Of the 8,848 notices that were mailed, one notice included a complete Social Security number, and five notices included a complete bank account number. To date, the Departments are unaware of any actual or attempted misuse of personal information as a result of the incident.

As soon as the Departments became aware of the issue, the correct addresses were entered into IES to prevent future notices from being mailed to incorrect addresses. The Departments are in the process of sending letters, as required by law, to the individuals whose information was sent to the incorrect address, members of the Illinois General Assembly, and the Office of the Illinois Attorney General. The Departments are working to ensure that this error does not happen again, as the privacy of our customers and their families is of paramount importance.

Individuals with questions may write to: HFS HIPAA/Privacy Officer, 201 South Grand Avenue East, Springfield, IL 62763, or email [e-mail]. Credit reporting agencies and the Federal Trade Commission can also offer information about fraud alerts and security freezes and contact information for those organizations are being provided to the affected individuals.

[Illinois Office of Communication and Information]