On August 9, 2023, the Virginia Department of Medical Assistance Services filed a notice of data breach with the U.S. Department of Health and Human Services Office for Civil Rights after discovering that confidential information in its possession was subject to unauthorized access. Upon completing its investigation, DMAS began sending out data breach notification letters to all individuals whose information was affected by the recent data security incident.

If you received a data breach notification from the Virginia Department of Medical Assistance Services, it is essential you understand what is at risk and what you can do about it. As we’ve discussed in previous posts, data breaches put you at a significantly increased risk of identity theft and other frauds. However, there are steps you can take to reduce these risks. A data breach lawyer can help you learn more about how to protect yourself from becoming a victim of fraud or identity theft as well as discuss your legal options following the Department of Medical Assistance Services data breach.

What Caused the Data Breach at the Virginia Department of Medical Assistance Services?

The Department of Medical Assistance Services data breach was only recently announced, and more information is expected in the near future. However, DMAS’s filing with the U.S. Department of Health and Human Services Office for Civil Rights provides some important information on what led up to the breach. According to this source, the incident involved a “hacking/IT incident” targeting a network server. However, due to the limited amount of information available on the U.S. Department of Health and Human Services Office for Civil Rights data breach portal, it is unclear if the cyberattack was against Va. DMAS or one of the organization’s vendors.

Regardless, after learning that sensitive consumer data was accessible to an unauthorized party, the Department of Medical Assistance Services reviewed the compromised files to determine what information was leaked and which consumers were impacted. Although the DMAS filing does not specify what data types were compromised, typically, only those breaches that involve the protected health information of more than 500 people must be reported to the U.S. Department of Health and Human Services Office for Civil Rights.

On August 9, 2023, the Department of Medical Assistance Services sent out data breach letters to anyone who was affected by the recent data security incident. These letters should provide victims with a list of what information belonging to them was compromised.