Wisconsin Department of Health Services

Wisconsin Department of Health Services reported an unauthorized access/disclosure involving 8,157 individuals. The breach involved paper/films and did not involve a business associate. The incident was submitted to HHS on July 1, 2026.

Wisconsin Department of Health Services reported a data breach to the Wisconsin DATCP. The public was notified on 2026-06-30. The incident occurred on April 30, 2026. Data accessed: Unknown. 8,157 individuals were affected. 8,157 Wisconsin residents were affected.

Wisconsin Department of Health Services reported to HHS on 2024-06-21 a Hacking/IT Incident affecting 19150 individuals. Breached information located on Network Server. A business associate experienced a cyberattack compromising PHI (names, DOB, SSN, diagnoses). CE provided credit monitoring and call center; BA implemented safeguards.

Wisconsin Department of Health Services reported to HHS on 2022-10-07 a Unauthorized Access/Disclosure affecting 12,358 individuals. Breached information located on Email. An employee emailed PHI (names, DOB, SSN, gender) to other employees and it was posted to the Internet. The CE provided complimentary identity protection services.

Wisconsin Department of Health Services reported to HHS on 2022-07-08 a Hacking/IT Incident affecting 1698 individuals. Breached information located on Network Server. A business associate experienced a malicious attack compromising PHI including names, member IDs, and diagnoses. The CE provided credit monitoring and implemented additional safeguards.

Wisconsin Department of Health Services reported to HHS on 2021-01-15 a Hacking/IT Incident affecting 1281 individuals. Breached information located on Network Server. A business associate experienced a social engineering attack compromising PHI including names and treatment information. The CE and BA implemented safeguards and provided credit monitoring.

On February 5, 2018, a laptop belonging to a business associate (The Management Group's IRIS Consultant) was stolen from her car. The bag also contained a notebook with the laptop's password, rendering the encryption potentially compromised. The laptop may have contained PHI for ~779 individuals enrolled in Wisconsin's IRIS program, including demographic and financial information. The BA reported theft to police, disabled network access, and sanctioned the employee. The CE notified HHS, affected individuals, and media, and offered 12 months of identity theft protection. OCR obtained documented corrective-action assurances.