CareOregon and Health Share of Oregon warn of potential insurance fraud after data breach

CareOregon and Health Share of Oregon have notified certain patients about a data breach and potential insurance fraud. Andover Eye Associates has identified a breach of its email environment.

CareOregon and Health Share of Oregon have notified certain patients about unauthorized access to some of their protected health information. It is unclear from the phrasing of the notice whether this was an insider breach or if data was accessed by an external actor. The data breach notice states that, “On October 27, 2025, we learned that one or more people looked at your information without permission.” Social Security numbers and financial information were not accessed. The data viewed and potentially obtained was limited to first and last names, dates of birth, health plan information, Medicaid/Medicare numbers, and primary care provider office.

The notice states that there may have been data misuse, warning that the information may have been used to create fake insurance claims. CareOregon and Health Share of Oregon said they were unable to determine if any specific patient’s information had been misused. The affected individuals have been reminded that CareOregon and Health Share of Oregon do not bill for covered health care services, and informed the affected individuals that they will not receive a bill even if their data has been misused to file a fake insurance claim. Individuals who receive a letter detailing the services that they should have received should check the letter carefully and report back if there are any listed services that have not been provided.

Read more at HIPAA Journal