Data breaches have been announced by the Connecticut Department of Social Services, Public Partnerships LLC, Hattiesburg Eye Clinic, and the Eye Care Center of Snohomish.
Connecticut Department of Social Services
The Connecticut Department of Social Services (DSS) has reported a data breach involving the protected health information of 41,000 individuals. The incident involved claims and payment information related to the Connecticut Medicaid (HUSKY) program, which was exposed after an unauthorized user gained access to a Connecticut Medicaid provider reimbursement account. DSS was informed about the data breach by its fiscal agent and account administrator, Gainwell Technologies, on June 25, 2026. The investigation determined that the unauthorized access was most likely financially motivated, rather than to obtain patient data; however, data theft could not be ruled out.
The provider portal has been secured, and the affected individuals have been offered complimentary credit monitoring and identity theft protection services. Electronic medical records, financial information, and Social Security numbers were not involved. The breach involved a combination of names, identification numbers associated with Medicare claims or provider payment accounts, dates of service, payment information, information about the services received, amounts paid, and information related to non-Medicaid health insurance.
This is the second such incident to be announced this year. An earlier breach in March 2026 affected approximately 22,500 individuals and involved unauthorized access to the HUSKY system using the compromised credentials of a Hartford Healthcare employee.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Public Partnerships LLC, New York
A data breach we had previously missed was reported by Public Partnerships LLC in early August that involved the attempted sale of the protected health information of 12,018 individuals. Public Partnerships is the single fiscal intermediary (FI) for the New York Consumer Directed Personal Assistance Program (CDPAP). CDPAP is a state Medicaid program that allows individuals who require home care to choose, hire, train, and manage their own caregivers.
In June 2026, Public Partnerships learned that a former facilitator had attempted to sell consumer data to another New York CDPAP facilitator. The former facilitator had been terminated by Public Partnerships in March 2026 for (unspecified) non-compliance with the program integrity requirements. The facilitator who was approached and offered the data refused and reported the incident to Public Partnerships.
Before Public Partnerships became the single FI for CDPAP, the state used hundreds of localized independent organizations. These legacy FIs became network facilitators or subcontractors under Public Partnerships under the single statewide contract with Public Partnerships. When it learned of the alleged sale, the former FI was contacted, informed about the allegation, and was told that offering to sell CDPAP data is unlawful and a breach of its ongoing contractual obligations. The former FI was instructed to delete all CDPAP data in its possession. Public Partnerships also notified all remaining facilitators of their contractual obligations and that the sale and purchase of CDPAP data is unlawful.
The case has been reported to the HHS Office for Civil Rights and the HHS Office of Inspector General, and all potentially impacted individuals have been notified by mail. The impacted data included names, addresses, dates of birth, Medicaid ID numbers, PPL ID numbers, and information relating to enrollment in New York Medicaid. While the sale appears not to have gone ahead, and there have been no other known cases, the affected individuals have been offered complimentary identity protection and credit monitoring services.
Hattiesburg Eye Clinic, P.A., Mississippi
Hattiesburg Eye Clinic, P.A. in Mississippi has reported a data security incident that potentially involved unauthorized access to the protected health information of 6,137 individuals. A network disruption was experienced on August 18, 2026, and third-party cybersecurity experts were engaged to investigate and determine the nature and scope of the activity. The review of the incident concluded on September 16, 2026, and confirmed that patient data had been exposed and may have been acquired. The affected data varied from individual to individual and may have included first and last names, phone numbers, Social Security numbers, and medical diagnoses/conditions.
Additional technical safeguards have been implemented to prevent similar incidents in the future, and notification letters have been mailed to all potentially affected individuals. A ransomware and data theft/extortion group called The Gentlemen claimed responsibility for the incident and maintains that patient data was stolen.
Anup K. Deol, OD PS (Eye Care Center of Snohomish), Washington
Anup K. Deol, OD PS, doing business as Eye Care Center of Snohomish in Washington, has identified unauthorized access to parts of its network containing the protected health information of 3,059 patients. The unauthorized access was identified on August 12, 2026, and third-party cybersecurity experts were engaged to investigate the activity. The investigation confirmed that an unauthorized third party gained access to limited files on its network on or around July 28, 2026.
The review of the affected files was completed on September 28, 2026. The data involved varied from individual to individual and may have included names, addresses, birth dates, and medical information, which may have included lab results, diagnoses, medications, and treatment information. The incident was reported to law enforcement, and additional safeguards have been implemented to prevent similar incidents in the future.
The post 41,000 Connecticut Medicaid Recipients Affected by DHS Data Incident appeared first on The HIPAA Journal.
