North Dakota HHS Reports Data Breach Affecting Developmental Disabilities Service Recipients

The North Dakota HHS has said that a phishing attack in July compromised the email accounts of three employees in its Developmental Disabilities division, thereby exposing the protected health information of an unknown number of service recipients.

Here's a summary of what happened: NDIT detected the phishing attack on July 21 and intervened, but the following day observed unusual sign-in activity. Three employees from the DD division interacted with the phishing email, allowing an unauthorized third party to access their accounts. HHS then spent several weeks determining what was accessed and concluded the investigation on August 14.

The information made public is not the same for every individual, but HHS says it may include the name, contact details, date of birth, age, service information, the health plan and ID numbers, medical information, and details about the guardian.

The final point is worth some thought. In some cases, people receiving DD services have a legal guardian overseeing some or all of their affairs; in other cases, they have a decision-making arrangement in which a reliable individual assists them in making choices without formal legal authority. Regardless of the situation, this breach does not affect only the individual; it can also affect anyone involved in their medical, financial, or legal decisions. When you receive a notification letter, it's important to check who actually has your details listed, rather than assuming it is the service recipient's.

The Health and Human Services department is sending letters directly to those affected. The standard advice in such situations is for you to keep an eye on your financial and medical statements, credit reports, and explanation-of-benefits notices for anything that looks suspicious. It's best not to readily share personal information when you receive unexpected calls, emails, or text messages, since this is usually what happens after a breach of this kind. You can also establish a free fraud alert with Equifax, Experian, or TransUnion. For further information, both the North Dakota Attorney General's Office and the FTC provide advice on identity theft.

If you have any questions about the incident or the meaning of your letter, then you should get in touch with HHS directly—via Kristen Vander Vorst, Field Services Administrator for Developmental Disabilities, at telephone number (800) 755-8529, from 8 to 5 CT on weekdays.