Timberline Billing Services, Inc.

Timberline Billing Services, Inc., also known as Timberline Billing Services, operates as a Medicaid billing contractor. The company processes Medicaid claims on behalf of school districts that serve students eligible for Medicaid benefits. Its core function involves preparing, submitting, and tracking billing documents to secure reimbursement for health‑related services provided in educational settings. By acting as an intermediary between schools and state Medicaid programs, it helps districts capture federal funding for eligible student health care. The organization is headquartered in the United States of America, though the specific city or state is not disclosed in the available sources.

Timberline Billing Services provides its services to multiple school districts within the state of Iowa. According to the reported incident, the contractor’s client base includes potentially hundreds of affiliated schools across those districts. This reach indicates that the firm handles billing data for a substantial number of Medicaid‑eligible students enrolled in Iowa’s public education system. The breadth of its client base means that any security event affecting the contractor could have wide‑ranging implications for student information. The contractor’s role is limited to billing administration; it does not operate educational institutions or health clinics directly.

Timberline Billing Services specializes in the intersection of education administration and Medicaid reimbursement, requiring familiarity with both FERPA‑protected student records and HIPAA‑related health information. This dual compliance focus distinguishes the firm from generic medical billing companies that serve only healthcare providers. The February 2020 cybersecurity incident, in which an unauthorized actor encrypted files and exfiltrated data over several weeks, highlighted the sensitivity of the information the contractor manages. Although the contractor asserted that its internal systems and student records were not directly accessed, the breach still exposed personal data of current and former Medicaid‑covered students. Notification to two affected districts occurred roughly six months after the intrusion period, while the broader impact across the contractor’s other clients remained under assessment at the time of reporting.