FOR IMMEDIATE RELEASE
February 20, 2024
Media Contact
Trish Grodzicki
Department of Health Care Policy & Financing
trish.grodzicki@state.co.us
Denver, CO - The Colorado Department of Health Care Policy and Financing (HCPF) is notifying additional individuals regarding the previously reported May 2023 MOVEit data security incident that involves certain of their personal information and/or protected health information. HCPF oversees Health First Colorado (Colorado’s Medicaid program), Child Health Plan Plus (CHP+), and other health care programs for Coloradans who qualify.
What Happened? On May 31, 2023, Progress Software discovered a problem affecting its MOVEit® Transfer application. IBM, a third-party vendor contracted with HCPF, uses the MOVEit application to move HCPF data files in the normal course of business. Progress Software publicly announced that the MOVEit problem was the result of a cybersecurity incident, which impacted many users around the world, including IBM. No HCPF or State of Colorado systems were affected by this issue.
After IBM notified HCPF that it was impacted by the MOVEit incident, HCPF promptly launched an investigation to understand whether the incident impacted HCPF’s own systems, and to determine whether Health First Colorado or CHP+ members’ protected health information was accessed by an unauthorized party. While HCPF confirmed that no other HCPF systems or databases were impacted, on June 13, 2023, the investigation identified that certain HCPF files on the MOVEit application used by IBM were accessed by the unauthorized actor on or about May 28, 2023. These files contained certain individuals’ information including Health First Colorado and CHP+ members and applicants, providers, and provider and member-affiliated individuals as well as information for individuals who may provide additional coverage to Health First Colorado and CHP+ members.
As a result of HCPF’s continued review of the impacted information, HCPF confirmed on January 17, 2024 that information pertaining to additional individuals was included in the files accessed by the unauthorized actor. HCPF has since taken steps to notify and provide resources to the additional individuals identified as being potentially affected by this incident.
What Information Was Involved? The information may have included one or more of the following pieces of information for certain individuals: full name, Social Security number, Medicaid ID number, Medicare ID number, date of birth, address and other contact information, demographic information, income and expense information, clinical and medical information (such as diagnosis/condition, lab results, medication, or other treatment information), health insurance information, and asset information.
What HCPF is Doing. HCPF takes information security seriously and apologizes for any inconvenience this incident may cause. HCPF and its vendors are reviewing their policies, procedures and cybersecurity safeguards to further protect their systems. As an added precaution, HCPF is offering potentially impacted individuals two years of free credit monitoring and identity restoration services provided through Experian. If individuals did not receive written notice of this incident but believe they may be affected, they can call 833-918-1099, Monday through Friday, 7:00 a.m. – 9:00 p.m. Mountain Time (excluding major holidays) and provide engagement number B115237.
What Individuals Can Do. Individuals can find out more about how to protect themselves generally against the potential misuse of information by reviewing the guidance on HCPF’s website, entitled Steps You Can Take to Protect Personal Information.
About the Colorado Department of Health Care Policy & Financing: The Department administers Health First Colorado (Colorado's Medicaid program), Child Health Plan Plus, and other programs for Coloradans who qualify. These health care programs now cover about one in four Coloradans. For more information about the Department, please visit hcpf.colorado.gov.