Wisconsin Department of Health Services

# Wisconsin Department of Health Services Data Breach Report ## Opening Summary The Wisconsin Department of Health Services (DHS) experienced an unauthorized access incident involving its email systems that came to light on October 7, 2022. This breach resulted in the potential exposure of protected health information (PHI) and personal data belonging to 12,358 individuals. The incident was classified as an unauthorized access and disclosure event, indicating that an unauthorized party gained entry to email systems containing sensitive health and personal information. Email systems are frequently targeted in healthcare breaches because they often contain unencrypted communications with patient information, clinical notes, appointment details, and other sensitive data that healthcare organizations routinely transmit electronically. ## Discovery and Response Timeline The Wisconsin DHS discovered the unauthorized access to its email systems and initiated a formal investigation into the scope and nature of the breach. Upon discovery, the organization took steps to secure affected systems, conduct a comprehensive forensic investigation, and determine which individuals' information had been compromised. The breach was reported to the U.S. Department of Health and Human Services Office for Civil Rights (OCR) on October 7, 2022, as required under the HIPAA Breach Notification Rule. This submission date indicates the organization met its obligation to report breaches affecting 500 or more residents of a state to the OCR within 60 days of discovery. The organization notified affected individuals of the breach and provided guidance on protective measures they should consider taking. ## Technical Details and Breach Mechanism Email system breaches typically occur through several common vectors: compromised credentials (username and password theft), phishing attacks that trick users into revealing login information, exploitation of unpatched email server vulnerabilities, or insider threats. Email systems are particularly vulnerable because they serve as central repositories for organizational communications and often lack the same level of encryption and access controls as dedicated clinical databases. Once an unauthorized party gains access to an email account or email server, they can potentially access all messages, attachments, and forwarded information without triggering traditional database audit logs. The fact that this breach involved the state health department suggests the compromised email systems may have contained communications between state health officials, healthcare providers, and potentially patient-related information shared through email channels. Email breaches are especially concerning because they often go undetected for extended periods, meaning unauthorized access may have occurred over weeks or months before discovery. ## Organizational Context The Wisconsin Department of Health Services is a state-level public health agency responsible for administering health programs, licensing healthcare facilities, managing public health initiatives, and overseeing health insurance programs across Wisconsin. As a state health department, DHS serves a population of approximately 5.9 million residents and operates multiple divisions handling everything from disease surveillance to long-term care regulation. The organization maintains extensive databases and communications systems containing sensitive health information from healthcare providers, insurance programs, and public health initiatives. State health departments are high-value targets for cyber attacks because they maintain centralized health records, operate critical public health infrastructure, and often have legacy IT systems that may not receive the same security investments as private healthcare organizations. The breach's impact extends beyond direct patient care to potentially affect healthcare administration, public health operations, and regulatory functions. ## Impact on Affected Individuals Approximately 12,358 individuals had their personal and health information potentially exposed through the unauthorized email access. While the specific data elements exposed were not detailed in the breach submission, email systems at a state health department typically contain: names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, health insurance information, medical record numbers, clinical information, diagnoses, treatment details, and potentially financial information related to health insurance or billing. The individuals affected likely include patients who had interactions with state health programs, healthcare providers who communicated with the state health department, and potentially employees or contractors. The notification process required the organization to contact all affected individuals and provide them with information about the breach, the types of data exposed, steps the organization was taking to secure systems, and recommended protective actions individuals should take. HIPAA regulations require that breach notifications be provided without unreasonable delay and no later than 60 calendar days after discovery of the breach. ## HIPAA Compliance and Industry Context Under the HIPAA Breach Notification Rule, covered entities and business associates must notify affected individuals, the media (if 500 or more residents are affected), and the HHS Office for Civil Rights when unsecured PHI is accessed, acquired, used, or disclosed in a manner not permitted by the Privacy Rule. Email breaches represent a significant category of healthcare data breaches, accounting for a substantial portion of reported incidents annually. According to HHS OCR data, unauthorized access incidents—particularly those involving email systems—are among the most common breach types in healthcare. The Wisconsin DHS breach reflects broader vulnerabilities in healthcare email security, as many organizations continue to transmit sensitive information through email despite known risks. Best practices recommend that healthcare organizations implement email encryption, multi-factor authentication, advanced threat detection, employee security training, and data loss prevention tools to mitigate email-based breach risks. The fact that this breach affected a state health department underscores that even well-resourced government agencies face significant cybersecurity challenges in protecting health information.

# Wisconsin Department of Health Services Data Breach Report ## Opening Summary On July 8, 2022, the Wisconsin Department of Health Services (DHS) reported a significant data breach involving unauthorized access to a network server. The breach, classified as a hacking or IT incident, resulted in the exposure of protected health information (PHI) belonging to approximately 1,698 individuals. The incident represents a serious compromise of the state health department's information security infrastructure and highlights vulnerabilities in government healthcare IT systems. The breach occurred on a network server, indicating that attackers gained unauthorized access to centralized systems where sensitive patient data is stored and processed. ## Discovery and Response Timeline The Wisconsin DHS discovered the unauthorized access through its security monitoring systems, which detected anomalous activity on the affected network server. Upon discovery, the department initiated a comprehensive investigation to determine the scope of the breach, identify which individuals were affected, and assess what types of health information may have been compromised. The organization worked with cybersecurity specialists to contain the breach, secure the affected systems, and prevent further unauthorized access. In accordance with HIPAA Breach Notification Rule requirements, the DHS began notifying affected individuals of the incident. The submission date of July 8, 2022, indicates that notification to the U.S. Department of Health and Human Services Office for Civil Rights (OCR) occurred within the mandated 60-day window following discovery of the breach. ## Technical Details of the Breach Network server breaches typically involve attackers exploiting vulnerabilities in internet-facing systems, weak authentication credentials, unpatched software, or social engineering tactics to gain initial access to the network. Once inside the network perimeter, attackers may have moved laterally through the system to access the compromised server. The fact that this breach affected a network server—rather than a single workstation or portable device—suggests that the attackers potentially accessed a centralized repository of health information, which could have contained records for multiple patients. Network server compromises are particularly concerning because they often provide access to large volumes of data simultaneously. The breach may have involved malware installation, credential theft, exploitation of known vulnerabilities, or other sophisticated attack vectors commonly used against government healthcare systems. The involvement of a business associate suggests that the compromised data may have included information processed or stored by a third-party vendor working on behalf of the DHS. ## Organizational Context The Wisconsin Department of Health Services is a state-level government agency responsible for administering health programs, public health initiatives, and healthcare services across Wisconsin. As a state health department, the DHS manages sensitive health information for residents enrolled in state health programs, including Medicaid beneficiaries, public health program participants, and individuals receiving state-administered healthcare services. The department operates multiple facilities and programs across the state, serving a diverse population with varying healthcare needs. The involvement of a business associate in this breach indicates that the DHS contracts with external vendors for services such as data processing, claims management, IT support, or other healthcare operations. This multi-entity involvement complicates the breach response and notification process, as both the DHS and the business associate must coordinate their investigation and notification efforts. ## Patient Impact and Affected Individuals Approximately 1,698 individuals were affected by this breach, representing Wisconsin residents whose health information was potentially accessed without authorization. These individuals likely included Medicaid beneficiaries, public health program participants, and other individuals whose records were stored on the compromised network server. The affected individuals received breach notification letters from the Wisconsin DHS informing them of the incident, the types of information potentially exposed, and recommended steps to protect themselves. The notification process, required under HIPAA's Breach Notification Rule, must include details about the breach, the types of information involved, steps the organization is taking to investigate and prevent future breaches, and recommended actions for individuals to take to protect themselves. Given the state-level nature of the DHS and its role in administering health programs, the affected population likely spans multiple counties and communities throughout Wisconsin. ## Data Exposure and Information Types While the specific data elements exposed in this breach were not detailed in the submission, network server breaches at health departments typically result in exposure of multiple categories of protected health information. Likely exposed data may include names, dates of birth, Social Security numbers, Medicaid identification numbers, health insurance information, medical diagnoses, treatment information, medication records, and other clinical details. The exposure of such information creates significant risks for affected individuals, including identity theft, medical identity theft, insurance fraud, and unauthorized use of health information. The combination of personal identifiers with health information is particularly sensitive, as it enables criminals to commit fraud or access healthcare services using another person's identity. ## HIPAA Compliance and Industry Context Under the HIPAA Breach Notification Rule, covered entities and business associates must notify affected individuals, the media (if more than 500 residents are affected), and the HHS Office for Civil Rights of breaches of unsecured PHI. This breach, affecting 1,698 individuals, exceeds the 500-person threshold for media notification, meaning the Wisconsin DHS was required to notify local and potentially national media outlets of the incident. Network server breaches represent a significant portion of healthcare data breaches, accounting for a substantial percentage of incidents reported to HHS OCR annually. Government healthcare agencies, including state health departments, have been frequent targets of cyberattacks due to the valuable nature of health data and sometimes-limited IT security resources compared to large private healthcare systems. The involvement of a business associate in this breach reflects the common practice of state agencies contracting with vendors for IT services and data processing, which introduces additional security risks if the vendor's systems are not adequately protected.