49,000 N.C. Medicaid cards mailed to wrong addresses

North Carolina health officials said Friday that they had inadvertently disclosed the personal information of tens of thousands of children receiving Medicaid coverage, but were tight-lipped about precisely what caused the massive privacy breach.

The state Department of Health and Human Services issued a written release saying that new Medicaid cards for nearly 49,000 children were mailed on Dec. 30 to the wrong people. The information on the cards includes the children's names, Medicaid identification numbers, dates of birth and the names of their primary care doctors — personal medical data that is supposed to be tightly protected under federal law.

"The department has begun a careful review of this incident to determine how it occurred and to ensure personal information is protected," said Sandra Terrell, the state's acting Medicaid director. "DHHS knows exactly which Medicaid cards were sent to which addresses, and is rapidly working to issue correct Medicaid cards."

Agency spokesman Ricky Diaz said state officials were first informed of the problem on Thursday by county officials. The release publicly disclosing the breach was emailed Friday at 5:20 p.m., shortly after WSOC-TV in Charlotte posted a story about the error.

Diaz insisted that the agency disclosed the information to the public "as quickly as possible."

New federal eligibility rules starting Jan. 1 under the Affordable Care Act allowed the agency to shift medical coverage for more than 70,000 children of low-income families from the state-paid NC Health Choice program to Medicaid.

Diaz said the agency is investigating how the cards were addressed to the wrong people. He said the mistake did not involve either NCTracks or NC FAST, a pair of new problem-plagued computer systems that handle Medicaid enrollments and payments.

Diaz refused to say what the agency's internal investigation had determined so far about the source of the error, responding to questions by repeating the same prepared talking points.

"We are investigating the matter thoroughly," Diaz said when pressed for details. "The review is not complete."

Diaz also said he could provide no information about when that review might be complete or when the results would be made public.

Diaz said children who were supposed to receive Medicaid cards but didn't can still use their old NC Health Choice cards in the meantime. Those who were mistakenly sent the cards will be receiving instructions about what to do with them, he said.

Diaz said the affected Medicaid accounts will be monitored for potential fraud.

Sen. Tommy Tucker, a Union County Republican who serves on the state oversight committee for healthcare, said he and other legislators learned about the breach from news reports. He said a subcommittee looking into information technology issues at DHHS was already scheduled to meet next week.

"We'll be trying to figure out how much damage has been done," Tucker said. "We will certainly want some answers."