The Department of Health Care Services said Monday it has breached the privacy of 49,352 people who receive adult day-care services from the state.
The department said that letters it mailed a week ago to 49,352 Medi-Cal beneficiaries wrongly included each patient's Social Security number on their address labels.
The department said the security incident took place Feb. 1, but it was only told about it on Thursday. It started to notify the 49,352 beneficiaries about the problem over the weekend.
"At this point, there is no evidence that unauthorized parties have acquired or accessed beneficiary personal information," the department said in a prepared statement.
DHCS officials said they regretted the breach, which has so far cost the state $50,000. It blamed itself and a private vendor for the problem mailings.
Karen Johnson, a deputy director at the department, said officials are investigating and will figure out who pays for what when they get the findings.
On Saturday, the department said it began sending notification letters to the 49,352 beneficiaries alerting them to the security breach.
The letter also advised beneficiaries how to protect themselves from identity theft by contacting the three credit reporting agencies and placing a fraud alert on their files.
Department of Health Care Services Director David Maxwell-Jolly said the breach occurred when officials sent a notice to beneficiaries, entitled: "Notice of Change in Medical Necessity and Eligibility Criteria for Authorization of ADHC Services."
In preparing a mailing list, beneficiaries' Social Security numbers were mistakenly included on mailing labels.
"We have implemented additional safeguards governing the release of Social Security numbers, and our mailing vendor has implemented additional quality control measures to prevent such errors from occurring in the future," Maxwell-Jolly added.
"We regret this error. We will redouble our efforts to ensure that all beneficiary information entrusted to the state is aggressively and appropriately protected," he added.
The SSNs didn't have spaces or dashes and may have appeared to be a random nine-digit number to people other than recipients, the department said.
© Copyright The Sacramento Bee. All rights reserved.
Call Andrew McIntosh, Bee Capitol Bureau, (916) 321-1215.
What You Should Know About Comments on Sacbee.com
Sacbee.com is happy to provide a forum for reader interaction, discussion, feedback and reaction to our stories. However, we reserve the right to delete inappropriate comments or ban users who can't play nice. (See our full terms of service here.)
Here are some rules of the road:
• Keep your comments civil. Don't insult one another or the subjects of our articles. If you think a comment violates our guidelines click the "report abuse" button to notify the moderators. Responding to the comment will only encourage bad behavior.
• Don't use profanities, vulgarities or hate speech. This is a general interest news site. Sometimes, there are children present. Don't say anything in a way you wouldn't want your own child to hear.
• Do not attack other users; focus your comments on issues, not individuals.
• Stay on topic. Only post comments relevant to the article at hand. If you want to discuss an issue with a specific user, click on his profile name and send him a direct message.
• Do not copy and paste outside material into the comment box.
• Don't repeat the same comment over and over. We heard you the first time.
• Do not use the commenting system for advertising. That's spam and it isn't allowed.
• Don't use all capital letters. That's akin to yelling and not appreciated by the audience.
You should also know that The Sacramento Bee does not screen comments before they are posted. You are more likely to see inappropriate comments before our staff does, so we ask that you click the "report abuse" button to submit those comments for moderator review. You also may notify us via email at feedback@sacbee.com. Note the headline on which the comment is made and tell us the profile name of the user who made the comment. Remember, comment moderation is subjective. You may find some material objectionable that we won't and vice versa.
If you submit a comment, the user name of your account will appear along with it. Users cannot remove their own comments once they have submitted them, but you may ask our staff to retract one of your comments by sending an email to feedback@sacbee.com. Again, make sure you note the headline on which the comment is made and tell us your profile name.
If you choose to use our "reply to comment" feature, you should note that the length of the quoted comment will count against the size limits for your comment.
About Comments
Reader comments on Sacbee.com are the opinions of the writer, not The Sacramento Bee. If you see an objectionable comment, click the "report abuse" button below it. We will delete comments containing inappropriate links, obscenities, hate speech, and personal attacks. Flagrant or repeat violators will be banned. See more about comments here.