Optum Idaho Data Breach (2014)

Optum Idaho, a unit of United Behavioral Health, took over insurance management for Idaho Medicaid's mental-health and substance-abuse patients last fall. Local health care providers who treat those patients say Optum has erroneously sent them reports meant for other providers. The reports show patient names and mental-health or substance-abuse services the patients received or were authorized by Optum to receive. Emails obtained by the Idaho Statesman through a request under the Idaho Public Records Act show that providers have complained to Optum Idaho, the Idaho Department of Health and Welfare, the Idaho attorney general and the U.S. Department of Health and Human Services since October 2013 and as recently as last month. "We have received multiple authorizations for clients that are not ours (were never ours)," a provider, whose identity was redacted by the Department of Health and Welfare, wrote in January. Optum says the violations amount to about one-hundredth of 1 percent of the 1.3 million claims it has processed so far in Idaho, and that none has resulted in disclosure of patient information outside the network of providers, who also are prohibited by law from disclosing it. Idaho contracts with local mental-health and substance-abuse treatment businesses to provide counseling, psychiatric care and other services to its Medicaid patients. Idaho hired Optum last fall to better manage the program's rising costs. The patient-information errors are the latest in a series of actions by Optum that have angered some mental health care providers who must now have their services and payments approved by Optum. Some providers say Optum has created red tape and cut services needed by at-risk patients. Some say Optum hasn't paid them promptly, putting their businesses' survival, employees' jobs and patients' ongoing care at risk. Providers said in complaints and interviews that, while they can destroy information on a document they can hold in their hands, they can only view much of Optum's misdirected information online and lack the access to destroy it. One provider's owner called Idaho Health and Welfare in October reporting that "one of his competitors (said) they received five pages of patients' information and a sizable check from Optum," according to an internal departmental email from October. Health and Welfare said in July that it had received six complaints related to the Health Insurance Portability and Accountability Act - the federal law more often known as HIPAA, that governs privacy for patient information. The department's privacy officer reviewed the complaints and decided they weren't "reportable" breaches of the privacy law.