Skip to content
RuleResource Intelligence

← All developments

Kentucky CHFS Medicaid · October 24, 2026 · Primary source

Public Notice Regarding Kentucky Cabinet for Health and Family Services and Gainwell Technologies Notice of Data Security Incident

Score 60PRIMARYregulatoryState MedicaidKY

Summary

The Kentucky Cabinet for Health and Family Services and Gainwell Technologies issued a joint public notice disclosing a data security incident affecting the KY Health-Net Provider Portal, through which an unauthorized third party accessed payment accounts and downloaded files containing Kentucky Medicaid member information on three dates in March and April 2026. Gainwell Technologies, the fiscal agent for Kentucky Medicaid, completed an investigation determining that information for approximately 3,816 individuals was exposed, including names, Medicaid identification numbers, dates and descriptions of medical services, billing information, payment amounts, and non-Medicaid insurance details. Social Security numbers, financial account information, and electronic health records were not compromised. Notification to affected individuals began October 16, 2026, with an offer of one year of free identity protection and credit monitoring through IDX.

What this may mean

The incident affects Gainwell Technologies as Kentucky Medicaid's fiscal agent and CHFS, implicating state Medicaid data security obligations and HIPAA breach notification requirements for a covered entity and its business associate. The breach involved Medicaid claim and payment data for approximately 3,816 individuals, triggering individual notification and credit monitoring obligations. The incident has been reported to law enforcement, and the unauthorized access has been contained.

Informational only. Not legal, medical, financial, or other professional advice. Always consult a qualified professional familiar with your specific facts before relying on any item.

Related items