HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 10, 2023.
- Organization as reported
- Iowa Department of Health and Human Services - Iowa Medicaid Enterprise, IA
- Entity type as reported
- Health Plan
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- April 10, 2023
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 10800, row:1939)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Iowa Department of Health and Human Services – Iowa Medicaid Enterprise, reported that its business associate (BA)experienced a cyber-attack that affected the protected health information (PHI) of 20,815 individuals. The PHI involved included names, addresses, dates of birth, phone numbers, Social Security numbers, financial and claims information, diagnoses, health insurance information, and other treatment information. The CE notified HHS; the CE and BA notified the affected individuals, the media, and provided substitute notice. The CE and BA also created a toll-free phone number for questions and concerns. In its mitigation efforts, the CE and BA provided complimentary credit and identity monitoring services.