Department of Health and Human Services had failed to guard some of their confidential information.

HHS Mistakenly Leaks Medicare Recipients' Private Information
By Elaine Grant on Wednesday, December 17, 2008.


This week, thousands of Medicare recipients got an unpleasant surprise when they learned that the Department of Health and Human Services had failed to guard some of their confidential information.
NHPR's Elaine Grant has the story.

Web resources:

New Hampshire Department of Health and Human Services
New Hampshire ServiceLink

New Hampshire Department of Justice
Consumer Affairs Identity Theft Toolkit

It’s open enrollment time for people who use Medicare drug prescription plans, or the so-called Medicare Part D.

Figuring out which drug plan is the best one -- can be confusing enough.
But now there’s an added problem for 93-hundred New Hampshire residents.
The state Department of Health and Human Services says a staffer mistakenly sent their private information to health care providers.

HHS Associate Commissioner Nancy Rollins says the employee sent a routine email about Part D prescription plans to 61 long-term care and home health organizations in the state.

Staffers at those companies use the information to help their clients choose the right Medicare prescription plans.
But, says Nancy Rollins, something went wrong.

Rollinsfacts.wav: Unfortunately the information was contained in an Excel spreadsheet, and it was attached to a workbook. The workbook had a tab and a document that contained information about the 9,300 individuals.

That information included names, addresses, social security numbers and the amount of people’s monthly Medicare Part D premiums.
Rollins stresses that it did not include medical or prescription information.
The department discovered the error on December fourth when a health care provider called them.
HHS immediately called the attorney general’s office, reported the incident and set about trying to remedy the problem.

Rollins1.wav: We contacted the 61 professional health care providers, that included independent case managers home health care providers and so forth and asked them to delete the information and to provide us confirmation that that had been done.

New Hampshire organizations that have had a data breach are required by law to notify the people involved.

On Monday, HHS sent thousands of letters informing people about the incident.
Those letters advise people on ways to avoid becoming a victim of identity theft.
Among those prescriptions: put a fraud alert or a credit freeze on your accounts.
A fraud alert is exactly what it sounds like – it alerts your credit card company to be on the lookout for strange or unlikely charges.
A credit freeze keeps people from checking your credit report, a necessary step when opening accounts or making loans.

It’s a more draconian measure – although it can deter criminals, it can also make it harder for people to open legitimate accounts or to borrow money.
Lauren Noether is a senior assistant attorney general in New Hampshire.

Noetherfreeze: If you know you’re not going to be borrowing any money, you put a freeze on it and that way if someone has your name and social security they’re not opening bank accounts in your name or taking out a mortgage in your name that you may later on be presumed to be liable for.

The Department of Health and Human Services has set up hotlines for concerned citizens.

By early afternoon on Wednesday, almost 300 people had called.
HHS Associate Commissioner Nancy Rollins says the department is still investigating the incident and determining what, if any, disciplinary actions it will take against the employee.She admits that the department did not have policies in place that could have prevented the problem.

Policy.wav: We are addressing the individual issue here, but also looking at if there are policy and protocol ramifications that we need to revisit.

Rollins says participants who did not receive a letter from the department, did not have their name and information leaked.
She adds that if you need help with fraud alerts or credit freezes, you can get assistance from one of 13 Service Link organizations around the state.
Service Links are agencies that counsel seniors and adults with disabilities about long term care.

For help, call the Department of Health and Human Services.
For NHPR News, I’m Elaine Grant