DHCF Reports Data Exposure Affecting Nearly 400,000 Health Care Beneficiaries
Washington’s Department of Health Care Finance (DHCF) removed two reports from its website after discovering hidden personal data. HHS lists 399,086 potentially affected people.
Data exposure affects 399,086 beneficiaries of the Medicaid and DC Healthcare Alliance programs in the U.S. federal district of the District of Columbia. The Department of Health Care Finance (DHCF) said it discovered hidden personal data in two web reports that may have been accessible to unauthorized individuals.
The agency identified the issue on July 21, 2026. It subsequently reported the case to the U.S. Department of Health and Human Services (HHS), whose Office for Civil Rights lists it in its health data breach portal as an unauthorized disclosure of electronic health records. The report was filed on September 3, 2026.
Data exposure: What the reports may have contained
According to DHCF, the reports’ underlying data may have included Medicaid identifiers, dates of birth, health care provider names, race, sex, ward, and ethnicity. The agency also said the reports did not contain beneficiaries’ names, Social Security numbers, or financial account information.
This was not a confirmed hacking attack. The available findings describe the erroneous exposure of underlying data in web reports. DHCF says it has no information indicating that an unauthorized person actually viewed, copied, or misused the data.
The figure of 399,086 people comes from the HHS record. The regulator lists the case as under investigation and uses the classification “Unauthorized Access/Disclosure” in the record.
Reports removed, notifications being sent
DHCF said it removed the affected reports from its website and conducted checks of its systems. It is also sending notifications to beneficiaries who may be affected by the incident.
Although the published categories do not include names, Social Security numbers, or financial account information, the incident involves a Medicaid health identifier and a set of demographic data. The combination of these data may increase the risk of fraud or identity misuse.
What remains unclear
It has not been confirmed whether anyone accessed the data during the period when it may have been available online.
Further information may come from the results of DHCF’s internal review and the progress of the Office for Civil Rights investigation at HHS. Additional technical details, information about the scope of the affected reports, or further protective measures may also emerge.
Sources
- DC Department of Health Care Finance – DHCF Data Incident – Confirms the circumstances of the incident, the period of possible data availability, the data categories, and the removal of the reports.
- DHCF – Data Breach Notice Letter Sample – Confirms that notifications are being sent, the affected beneficiary groups, and the steps taken by the agency.
- HHS Office for Civil Rights – Breach Portal – Lists the District of Columbia Department of Health Care Finance with 399,086 affected individuals, the incident type “Unauthorized Access/Disclosure,” and the reporting date of September 3, 2026.
- SecurityWeek – Corroborates the recent publication of the case and the number of affected individuals according to the HHS record.
Verified and updated: September 28, 2026 15:29
