CareOregon and Health Share of Oregon have notified members that unauthorized individuals accessed their personal information, which may have been used to create fraudulent claims.
The Portland-based insurers learned of the breach Oct. 27 when one or more people viewed member information without permission, according to a Dec. 26 letter to affected members.
The compromised data includes member names, birth dates, health plan information, Medicaid ID numbers, Medicare ID numbers and primary care provider offices. Social Security numbers and financial information were not accessed.
The insurers said some of the information may have been used to file fake claims, though they don’t know whether specific member data was used for fraudulent purposes. Members will not be billed even if their information was used to create false claims, since the plans don’t bill members for covered healthcare services. They have also notified law enforcement and taken remediation steps, including investigating and fixing the issue, changing access controls for member information and retraining staff.
