Oklahoma State University Center for Health Sciences

Summary

An unauthorized third-party accessed folders containing Medicaid patient billing information on the Oklahoma State University Center for Health Sciences network. The compromised data potentially included patient names, Medicaid identifiers, provider details, service dates, and limited treatment information, though medical records were unaffected and only one social security number was present on the server. While investigators could not confirm whether the intruder specifically viewed patient data and found no evidence of misuse, the institution notified affected individuals and established a dedicated call center as a precaution. Additional security measures were implemented following the incident to strengthen data protections.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On November 7, 2017, Oklahoma State University Center for Health Sciences (OSUCHS) discovered unauthorized third-party access to folders within its computer network containing Medicaid patient billing information. The institution acted swiftly the following day by removing the compromised folders from the network and terminating the unauthorized access. OSUCHS initiated an investigation supported by an independent data security firm to assess potential data exposure. The forensic analysis could not definitively determine whether the intruder accessed or exfiltrated patient information stored in the folders. The exposed data potentially included patient names, Medicaid identification numbers, healthcare provider names, service dates, and limited treatment details. Medical records were not stored in the affected system, though investigators confirmed one social security number resided on the compromised server. OSUCHS found no evidence indicating actual misuse of the exposed information during their investigation.

OSUCHS mailed notification letters to potentially affected Medicaid patients on January 5, 2018, advising vigilance against unauthorized medical services billed to their accounts. The organization established a dedicated call center operational from 8 am to 8 pm Central Time, Monday through Friday, directing patients to verify receipt of notification letters by February 15 and report concerns to providers or Medicaid. While confirming no medical record exposure, OSUCHS acknowledged the incident might have compromised billing-related personal health information. The institution implemented enhanced security measures following the breach and emphasized its commitment to patient confidentiality through public statements. Patients were instructed to contact the call center at 1-844-551-1727 for incident-related inquiries or confirmation of potential impact.

Sources

Sources available to members: 1 source.