New York City Human Resources Administration/Department of Social Services

From January 1, 2017 to March 13, 2018, an internal programming error in the mailing system for Medicaid renewal forms may have caused forms to be mailed to the wrong post office box addresses, affecting 2135 individuals. The types of protected health information (PHI) on the forms included Medicaid clients’ names, other household members’ names, addresses, clients’ dates of birth and other household members’ dates of birth, clients' identification numbers (a unique Medicaid case number), household compensation, resources, and income information. The CE provided breach notification to HHS, the media, and the affected individuals, and posted notice to its website. Following the breach, the CE determined that the programming error occurred because of an unintended electronic interaction of the various systems used in the mailing process and deployed a technical fix. To mitigate any potential harmful effects on Medicaid beneficiaries, the CE re-opened any case that closed in 2018 for failure to return the Medicaid renewal form, and provided such clients with instructions for seeking reimbursement for medical bills incurred after their Medicaid coverage ended. For those affected indivi