State officials: DSS client identification data wrongly released

Officials at the state Department of Social Services and Office of Policy and Management are looking into whether a breach of federal privacy law occurred when they shared data about the cost of administering medication to Medicaid clients.

The information included DSS client identification numbers but not client names or Social Security Numbers, according to a statement by DSS Commissioner Roderick L. Bremby and OPM Secretary Benjamin Barnes. DSS identification numbers are unique and meaningless unless paired with other confidential information, they said. As many as 8,500 client identification numbers might have been included, although the statement said they are still determining the exact number.

DSS provided the data to OPM, the governor’s budget office, in late February as part of information about the cost of administering prescription drugs to DSS clients. The statement said the client information numbers should not have been included in the information sent to OPM. The data was later provided to legislators and legislative offices, as well as representatives of organizations involved in administering prescription drugs to DSS clients.

“Pending the investigation results, the information exchange is being regarded as an unauthorized disclosure of protected health information under the Health Insurance Portability and Accountability Act of 1996 (HIPAA),” the statement from Barnes and Bremby said. “We are evaluating whether an actual breach of unsecured protected health information has occurred.”

They said DSS is getting in touch with people who received the information to let them know the sensitivity of client identification numbers, ask them to not distribute them further and provide instructions on discarding them.

“We are working with the Attorney General’s Office in this matter, and will report on the results as soon as they are available,” the statement said. “We sincerely apologize to anyone that might have been affected by this error. We are working on methods to safeguard this information, so that something like this does not happen again.”

Gov. Dannel P. Malloy’s administration is seeking to allow unlicensed home health aides under nursing supervision to administer prescription drugs to people receiving home care through state programs. The administration has argued that doing so could save money, and cited the highest-cost cases, in which the state spent more than $100,000 in one year on nursing visits to administer medication to individual clients.