NC's biggest Medicaid MCO mails teen's health info to wrong parent

by: Jason Stoogenke Updated:

North Carolina's biggest Medicaid managed care organization has come under fire for a privacy violation.

Cardinal Innovations Healthcare Solutions receives more than $500 million in Medicaid money each year.  It's been criticized in the past for spending on big salaries, lavish parties and private flights. 

[READ: Medicaid insurance company under fire for big salaries, lavish parties]

Now, the organization has breached the privacy of a Charlotte teenager. Cardinal accidentally sent that teen's private information to a stranger, including her name, member number, date of birth and treatment information.

Jessica has a daughter who's a Cardinal member, so she wasn't surprised when Cardinal mailed her paperwork. But she was surprised when she opened it. 

"I see half of the information is my daughter's and half of the information is another child's information," Jessica said.

 That other child is Holly's daughter. 

"She's a minor, so it's serious. It's very serious to me," Holly said.  "And, for this ... complete strangers to know information they shouldn't know, it's not OK."

"It's nauseating. Like, these are kids' lives," Jessica said.  "Disgusting. Really disgusting."

Holly said she didn't know about the mistake until Jessica tracked her down on Facebook to tell her.

"I was just totally shocked. I was just totally blindsided. I didn't know... I didn't know, I had just never experienced that," Holly said.

Action 9 emailed Cardinal. Its lawyer sent a letter saying, "We deeply regret this incident and accept your intent to hold Cardinal Innovations accountable by running this story." 

The letter went on to say, "It is not acceptable that the release of information occurred, and we have done everything in our power to rectify the situation." 

It also said, "We have retrained the staff involved, are rolling out additional, robust HIPAA trainings to all our staff, and are seeking technology solutions to mitigate the risk of human error."

Cardinal officials said this was an isolated incident.

Both mothers complained to Cardinal. They said -- after some back and forth -- that the organization sent them letters acknowledging the mistake. But to them, the apology isn't enough. 

"It's totally unacceptable," Holly said. "If you had a family member with cancer or a disease, would you want a complete stranger knowing their information?  No."

In May, the North Carolina state auditor found Cardinal spent money on meetings and Christmas parties at upscale venues. The audit said one event cost $55,000 and that another topped $78,000. It also said the organization spent more than $3,000 on alcohol.

Then, last month, the North Carolina Department of Health and Human Services -- which oversees Cardinal's operations -- released a report on the company. The report notes that in 2016, compensation for Cardinal's CEO was more than $600,000. The report went on to say that's "three times higher than the maximum allowable for the position."

YOUR MEDICAL PRIVACY RIGHTS

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) spells out your rights involving your health information.

You have a right to get your information and a right to know who it’s been shared with.

Getting your information:

You may have to ask for it in writing and pay for copying or mailing.  In most cases, the provider has 30 days to provide the information.

You also have the right to know who it’s been shared with.

A federal government official said, “Generally, your health information cannot be used for purposes not directly related to your care without your permission. For example, your doctor cannot give it to your employer, or share it for things like marketing and advertising, without your written authorization. You probably received a notice telling you how your health information may be used on your first visit to a new health care provider or when you got new health insurance, but you can ask for another copy anytime. Let your providers or health insurance companies know if there is information you do not want to share. You can ask that your health information not be shared with certain people, groups, or companies.”

“If you think your rights are being denied or your health information is not being protected, you have the right to file a complaint with your provider, health insurer, or the U.S. Department of Health and Human Services.” 

Next Up: