Update 1:30 p.m.: The S.C. Law Enforcement Division has identified the employee behind the breach as 36-year-old Christopher Lykes of Swansea. He was arrested this afternoon and booked at the Richland County Detention Center on five counts of violating the Medically Indigent Act and one count of disclosure of confidential information. SLED has confirmed that at least one other party received the information Lykes transferred to his email.
COLUMBIA — The S.C. Department of Health and Human Services announced this morning that an employee working for the Medicaid program inappropriately transferred some personal information of more than 228,000 beneficiaries to his personal email.
The breach is the largest of its kind in the history of the agency, a spokesman confirmed.
The agency says the transfer was discovered last week during an agency performance review, and the employee has been fired.
The S.C. Law Enforcement Division is investigating the incident, and other state and federal agencies also have been alerted.
DHHS says the transferred information dates back to January and included names, phone numbers, addresses, birth dates and Medicaid ID numbers.
However, the agency says no private medical records or financial information was transmitted.
In 22,604 of the cases, Medicare numbers, which contain Social Security numbers, were also linked to beneficiaries’ names, according to the agency.
More than 90 percent of the affected beneficiaries live in six counties: Allendale, Bamberg, Barnwell, Lexington, Orangeburg and Richland.
“Our department is entrusted with personal information for hundreds of thousands of individuals, and it is our duty to secure that information,” DHHS Director Anthony Keck said in a statement from the agency.
“We are disappointed that one of our own would violate that trust and are deeply apologetic for not preventing the inappropriate release of this information.”
The agency is sending letters to all affected beneficiaries, who can also find more information at www.myscmedicaid.org. Individuals who receive letters are advised to call 1-888-829-6561.
DHHS will provide a year of free identity protection services to affected beneficiaries who want it.
Agency spokesman Jeff Stensland said notifying those affected and providing the protection services could cost the the state upwards of $1 million.
Over the course of a year, more than one million South Carolinians receive Medicaid benefits, according to DHHS.
Check back at postandcourier.com for more on this developing story. Reach Stephen Largen at 864-641-8172 and follow him on Twitter at @stephenlargen