Kentucky’s Cabinet for Health and Family Services said a vendor’s security failure exposed health plan details for nearly 3,816 Medicaid members, with notices going out from October 16.
According to a Monday statement, the contractor, Gainwell Technologies, suffered separate intrusions on March 26, April 16 and April 21 this year and only identified them in August. An unauthorized party reached provider payment accounts on the KY Health-Net Provider Portal and pulled down files holding member information. The cabinet said investigators believe the caller was chasing provider payment details rather than patient records.
Electronic health records, Social Security numbers and financial accounts were not exposed, but full names, provider and claims identification numbers, dates of service, descriptions of care and billing amounts, payment figures and other health coverage details may have been.
Gainwell holds a two-year state contract worth nearly $34M covering program integrity reviews. It has since added training for call center staff on validating anyone requesting new or revised portal access, and is tightening controls alongside the Department for Medicaid Services.
The case is a reminder that help-desk identity proofing protects claims data as much as a firewall does. Medicaid programs and their fiscal agents should require callback verification and time-boxed approvals for portal permission changes, and log every file download tied to a payment account.
