INDIANAPOLIS (WISH) - More than 187,000 Hoosiers are being notified that their personal information may have been shared by the Indiana Family and Social Services Administration.
The agency said on Monday that a programming error in April sent personal information to other FSSA clients, though FSSA doesn't know which clients were directly affected.
FSSA officials said the error was originally made on April 6 and affected correspondence between April 6 and May 21. The error was discovered more than a month later – on May 10, and fixed on May 21. The problem was with RCR Technology Corporation, which FSSA contracts for document management.
"Let's say that 'person A' had a document sent to them. It's possible that document could have been duplicated, and then also enclosed in somebody else's envelope by mistake," said Jim Gavin, Director of Communications for Indiana FSSA.
According to FSSA, the information accidentally disclosed to others includes "name, address, case number, date of birth, gender, race, telephone number, email address, types of benefits received, monthly benefit amount, employer information, some financial information such as monthly income and expenses, bank balances and other assets, and certain medical information such as provider name, whether the client receives disability benefits and medical status or condition, and certain information about the client's household members like name, gender and date of birth."
A smaller group of FSSA clients — 3,926 people — will receive a notice that their social security number may have been exposed to others.
"We do not believe this was a widespread disclosure," explained Gavin. "We know of 14 people so far that have come forward to say they've received someone else's information."
We asked Gavin why it took so long to notify clients about the potential breach. He said, "There's a process we've been following that led to today. Initially we had such a small tricking-in of information, we really didn't know what we were dealing with. So we had to set out, with RCR, to figure out, okay, why are certain people getting the wrong information."
"It was isolated to the computer programming error, then a fix had to be put in place, which happened," Gavin added. "From there, we had to identify clients that we needed to notify, so that took some time as well to figure out what types of documents may have been comingled… what FSSA clients would have received those documents during that time before the problem was fixed."
IU Privacy Law Expert Professor Fred Cate told 24-Hour News 8 Indiana's state law says an agency must disclose a potential privacy breach "without unreasonable delay." He says it may take longer if agencies are working with law enforcement, but added, "I think it's certainly troubling when you delay letting people know. The only way people can be vigilant, is if they know they should be vigilant."
The FSSA is advising anyone concerned about identity theft to put a fraud alert on their credit report by contacting the three credit agencies. Information on contacting the credit agencies is below.
- Equifax Security Freeze; 1-888-766-0008
P.O. Box 105788
Atlanta, GA 30348
- Experian Security Freeze; 1-888-397-3742
P.O. Box 9554
Allen, TX 75013
- Trans Union Security Freeze; 1-800-680-7289
P.O. Box 6790
Fullerton, CA 92834-6790
We also received a statement from the contractor involved in the mistake. It reads, "We at RCR Technology Corporation apologize that our actions may have caused some FSSA client information to be disclosed in error. We will do everything possible to prevent such an incident from happening again in the future. We value our relationship with the State of Indiana and our service to our fellow Hoosiers who are clients of the Indiana Family and Social Services Administration."
According to state records, RCR's contract with FSSA runs through December 2016.
Greenfield police officers are spending their Sunday giving 41 deserving children a day out on the town for the holidays.
A winter weather advisory was issued for Wayne, Union, Switzerland, Ripley, Ohio, Franklin, Fayette and Dearborn counties on Saturday night.
IMPD officials say a 3-year-old boy has died after he was shot in the head Saturday evening.