Tribal health plan participants notified of data breach

By Dean Rhodes

Publications coordinator

More than 2,800 people enrolled in the Grand Ronde Tribe’s health insurance plan may have had their personal health information and date of birth disclosed to unauthorized entities, according to an Aug. 23 letter sent from Kannact, a company based in West Sacramento, Calif.

Kannact is part of the Tribe’s employee benefits package and provides health coaching and assistance to employees who are enrolled in the health plan. The company has access to health plan participants’ information that was subject to unauthorized access beginning in March.

The letter states that Kannact hired a cybersecurity firm to conduct a forensic investigation and preliminary findings suspected that the unauthorized access was through a third-party file transfer software.

“Based on the investigation, the following information related to you was subject to unauthorized access: Health insurance ID numbers, medications, medical condition, name, date of birth,” the letter states. “Your Social Security number was not impacted by the incident.”

The letter adds that a forensic investigation concluded in June confirmed that the third-party file transfer software was the reason for the data breach.

Kannact says that it has since disabled access to the transfer software and is working on improving its patient data process.

“We encourage you to remain vigilant against incidents of identity theft and fraud, to review your account statements, and to monitor your credit reports for suspicious or unauthorized activity,” the letter states. “Additionally, security experts suggest that you contact your financial institution and all major credit bureaus to inform them of such a breach and then take whatever steps are recommended to protect your interests, including the possible placement of a fraud alert on your credit file.”

People can obtain a free copy of their credit report from each of the three nationwide credit reporting agencies – Experian, TransUnion and Equifax – by visiting www.annualcreditreport.com or calling 877-322-8228.

In Oregon, state law advises people to report any suspected identity theft to law enforcement, including the state Attorney General, and to the Federal Trade Commission at www.identitytheft.gov.