Montana Department of Public Health & Human Services

Montana Department of Public Health and Human Services, the covered entity (CE), experienced a server hacking incident due to an undetected and unpatched application code vulnerability, which allowed misuse of its information system resources for about 9 months. The incident affected over 1 million individuals’ demographic, clinical, and/or financial information. Upon discovery, the CE immediately took the affected server offline, reported the incident to state and federal law enforcement, and conducted an investigation with assistance from an independent forensics firm. The CE provided breach notification to HHS, affected individuals, and the media. It also set up a call center and offered credit monitoring and identity theft services for all eligible individuals. OCR confirmed that the CE implemented a number of corrective actions as a result of this incident, including technical enhancements and safeguards to protect its information systems and network resources. OCR provided substantial technical assistance, and the CE implemented alternate safeguards, policies, and procedures to more effectively identify and remediate potential vulnerabilities in its server-hosted applications.