Iowa Department of Health and Human Services - Iowa Medicaid Enterprise

The covered entity (CE), Iowa Department of Health and Human Services – Iowa Medicaid Enterprise, reported that its business associate (BA)experienced a cyber-attack that affected the protected health information (PHI) of 20,815 individuals. The PHI involved included names, addresses, dates of birth, phone numbers, Social Security numbers, financial and claims information, diagnoses, health insurance information, and other treatment information. The CE notified HHS; the CE and BA notified the affected individuals, the media, and provided substitute notice. The CE and BA also created a toll-free phone number for questions and concerns. In its mitigation efforts, the CE and BA provided complimentary credit and identity monitoring services.