Colorado Breach Affects 111,000
Hard Drive Missing From State Office
The hard drive included recipients' names, state ID numbers and the name of the specific program in which they were enrolled, according to the Colorado Department of Health Care Policy and Financing. The drive did not include addresses, dates of birth, Social Security numbers or other financial information.
The state has notified the 111,000 affected, who represent one-fifth of those receiving public health insurance in the state, as required under the HITECH Act's breach notification rule.
The incident occurred between May 17 and June 4 at the Governor's Office of Information Technology, a spokesman for that office confirmed. The office provides IT services to state agencies, including the department that oversees Medicaid. The computer was in a building that requires a security card for entrance, the spokesman said.
The Colorado Bureau of Investigation is conducting a criminal investigation of the incident. Meanwhile, state officials are attempting to recover the missing hard drive and are auditing processes and procedures to help prevent a similar event from occurring.
