Skip to main content

Statement Regarding Unauthorized Medicaid Data Access

Published Date

Tyson’s Corner, Va. – Gainwell Technologies LLC (Gainwell) today announced it has notified 2,765 Medicaid members of the Georgia Department of Community Health (DCH) of a privacy issue that may have impacted their protected health information. DCH is Georgia’s lead agency for Medicaid, and Gainwell is a Business Associate of DCH that provides fiscal agent and account administration services for the Medicaid program.

The notifications are related to unauthorized calls that occurred June 25, 2021 and October 29, 2021, and which were discovered on July 14, 2021 and December 10, 2021, respectively.  These incidents relate to an unknown individual(s) gaining access and viewing payment information. The unknown individual(s) attempted to obtain payments intended for providers. There is no indication that the individual(s) attempted to access member information; however, the individual(s) were able to view documents that included the names, Medicaid member IDs, medical record numbers, and billing codes for services covered under Georgia Medicaid. For some members with other insurance, information about that coverage may have been viewed. Social Security numbers were not disclosed as part of this incident.

After discovering the initial unauthorized access, Gainwell and DCH took prompt action to investigate and requested assistance from state and federal law enforcement agencies. While the investigation was ongoing, Gainwell subsequently discovered the additional unauthorized access. Gainwell continues to work with DCH as well as state and federal law enforcement authorities to investigate. Gainwell and DCH are also adding additional protections to prevent future incidents. Law enforcement officials have confirmed that Gainwell and DCH may proceed with notifications to affected individuals.

Gainwell is committed to protecting the privacy and safeguarding the personal health information of Medicaid members. Gainwell is not aware of any misuse of personal information; however, affected members are being offered free credit monitoring for one year.

Members who received a notification letter or have questions about this incident, can call 1-833-903-3648 from 9 a.m. to 9 p.m. Eastern Time Monday through Friday.