CorrectCare Integrated Health, Inc.

CorrectCare Integrated Health, Inc. disclosed a data breach involving the inadvertent public exposure of a misconfigured web server containing Protected Health Information (PHI) and government identifiers (SSN, DOB, CDCR number) of incarcerated individuals. The exposure occurred from January 22, 2022, to July 6, 2022. CorrectCare secured the server within 9 hours, engaged forensic investigators, and offered 12 months of Experian IdentityWorks to affected individuals.

CorrectCare Integrated Health, LLC, a third-party health administrator, notified the New Hampshire Attorney General of a data security incident. On July 6, 2022, the company discovered that two file directories on a web server were inadvertently exposed to the public internet due to a misconfiguration. Investigation revealed patient information may have been accessible since January 22, 2022. The incident affected 391 New Hampshire residents, exposing PHI and PII. CorrectCare secured the server within nine hours, engaged forensic investigators, and offered 12 months of identity protection services. No misuse of information was detected.