Virginia Medicaid agency reports breach affecting 1.2 million people

The Virginia Department of Medical Assistance Services, the state agency that administers Virginia's Medicaid and CHIP programmes, reported a data breach affecting 1,229,333 people to the US Department of Health and Human Services Office for Civil Rights on 18 September 2023.

The federal filing classified the event as a hacking or IT incident involving a network server. Neither the filing nor the agency stated publicly which categories of personal or health information were involved. HIPAA Journal, which tracks the federal breach portal, recorded the entry as an unspecified hacking incident and ranked it the second largest healthcare breach reported to regulators that month.

The department said it would send data breach notification letters to individuals whose information was affected, with each letter setting out the specific data elements involved for that recipient.

It was the department's second filing with the Office for Civil Rights that year. An earlier notice, submitted on 9 August 2023, covered more than 423,000 individuals. Coverage at the time noted that it was not clear whether the September filing described a new intrusion or a revised count arising from the earlier one. No group claimed responsibility, and the agency did not publicly attribute the incident.