The Department of Health Care Services said today it may have breached the privacy of 49,352 state residents who receive adult day health care services from the state.
In a terse news release, the department said that letters it mailed a week ago to 49,352 beneficiaries wrongly included those patients' Social Security Number on address labels.
The Department said the incident took place Feb. 1. It was notified of the error on Feb. 4. It started to notify the 49,352 beneficiaries about the problem on Sunday.
"At this point, there is no evidence that unauthorized parties have acquired or accessed beneficiary personal information," the department said in a prepared statement. Officials said they regretted the incident.
On Saturday 6, the department said it began sending notification letters to beneficiaries alerting them to the security breach. The letter also advised beneficiaries how to protect themselves from identity theft by contacting the three credit reporting agencies and placing a fraud alert on their files.
Department of Health Care Services Director David Maxwell-Jolly said in the statement that the incident occurred when officials sent a notice to beneficiaries, entitled: "Notice of Change in Medical Necessity and Eligibility Criteria for Authorization of ADHC Services."
In preparing a mailing list, the beneficiaries' social security numbers were mistakenly included on the mailing labels, Maxwell-Jolly explained.
"We have implemented additional safeguards governing the release of Social Security Numbers, and our mailing vendor has implemented additional quality control measures to prevent such errors from occurring in the future," added Maxwell-Jolly.
The department did not identify the mailing vendor involved in the news release.
"We take any breach of secure documents very seriously, and we regret this error. We will redouble our efforts to ensure that all beneficiary information entrusted to the state is aggressively and appropriately protected," Maxwell-Jolly said.
The SSNs didn't have spaces or dashes and may have appeared to be a random nine-digit number to people other than recipients, the department said.