Security breach reveals some healthcare data of Kentuckians
Oct 19, 2026 | 3:33 pm ET
Description
Technology is making it easier to pull off financial crimes, and the U.S. is lacking a central agency to track them, experts say. (Getty Images)
Kentucky’s Cabinet for Health and Family Services says a vendor’s recent security breach exposed some health plan information for nearly 4,000 people.
According to a Monday notice, Gainwell Technologies experienced security breaches on March 26, April 16 and April 21 and learned about them in August.
During the breaches, “an unauthorized third party had gained access to some provider payment accounts on the KY Health-Net Provider Portal and downloaded files containing Kentucky Medicaid member information.” the cabinet said.
Notifications to the estimated 3,816 “potentially impacted individuals” started on Oct. 16, the cabinet said.
The breach did not expose electronic health records, Social Security Numbers or financial account information, according to the cabinet.
Other information that may have been exposed, according to the cabinet’s notice, include:
- Full names
- Identification numbers associated with the provider’s account or Medicaid claims
- Dates of medical services
- Information about services received and how they were billed
- Payment information, including amounts paid
- Information about applicable non-Medicaid health insurance, including policy and group numbers.
“Immediate action took place upon discovery and steps were taken to secure the information portal,” the cabinet said in its Monday notice. “Law enforcement was notified and a thorough investigation was completed. It is believed the unauthorized caller was seeking access to provider payment information rather than patient information.”
Gainwell has a nearly $34 million, two-year contract with the state to perform various reviews for the Medicaid program.
According to the cabinet, the company “has implemented specialized training for call center staff on validating individuals requesting new or revised provider portal access” and “is implementing security enhancements while coordinating with the Department for Medicaid Services, Division of Program Integrity on suspected bad-actor investigations.”
Frankfort
