HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 7, 2014.
- Organization as reported
- Montana Department of Public Health & Human Services, MT
- Entity type as reported
- Health Plan
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- July 7, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15048, row:6187)
- Archived copy
- Held in the private archive (provenance)
Montana Department of Public Health and Human Services, the covered entity (CE), experienced a server hacking incident due to an undetected and unpatched application code vulnerability, which allowed misuse of its information system resources for about 9 months. The incident affected over 1 million individuals’ demographic, clinical, and/or financial information. Upon discovery, the CE immediately took the affected server offline, reported the incident to state and federal law enforcement, and conducted an investigation with assistance from an independent forensics firm. The CE provided breach notification to HHS, affected individuals, and the media. It also set up a call center and offered credit monitoring and identity theft services for all eligible individuals. OCR confirmed that the CE implemented a number of corrective actions as a result of this incident, including technical enhancements and safeguards to protect its information systems and network resources. OCR provided substantial technical assistance, and the CE implemented alternate safeguards, policies, and procedures to more effectively identify and remediate potential vulnerabilities in its server-hosted applications.