Hamilton County officials were notified more than 240 days ago about a data breach potentially compromising financial information for more than 14,000 people, according to an internal memo this month.
According to the memo from the county attorney’s office, affected parties and the public were supposed to be notified within 60 days, but that does not appear to have happened.
The memo focuses on Nationwide Recovery Services, which the county contracted with for debt collection service for past due receivables across several county departments, including the criminal court clerk’s office, ambulance billing, the health department and the Water and Wastewater Treatment Authority.
According to the memo, the firm sent a letter on Feb. 17 saying that it had reported a “cyber incident” to Hamilton County on July 14, 2024.
(READ MORE: Hackers have stolen your personal information in a data breach. Now what?)
“This notice was sent by email to various individuals at Accounting and Finance,” the March 11 memo said.
The confidential memo was sent by Dana Beltramo of the county attorney’s office to County Attorney Rheubin Taylor, Hamilton County Mayor Weston Wamp, special adviser Janie Varnell, privacy officer Angela Duncan, risk manager Judith Barron-Songy and all 11 Hamilton County commissioners. It was obtained by the Chattanooga Times Free Press.
Wamp, his communications director and his press secretary did not respond to a request for comment Tuesday evening.
Nationwide Recovery Services determined that data Hamilton County provided was potentially impacted, according to the memo.
“This includes both personally identifiable information,” the memo said, “such as financial account information and addresses, and protected health information … such as medical related information and names.”
The memo said further correspondence with Nationwide showed the breach potentially compromised information for 14,084 individuals within the Hamilton County Emergency Medical Service system.
According to the federal law governing health privacy, affected individuals must be notified of such a breach, the memo said, and for breaches involving more than 500 people, notices must be given to prominent media outlets serving the jurisdiction — and to the secretary of Health and Human Services for its website.
Mailings and the media release must also contain a toll-free number that must remain active for 90 days from the date of the publication that allows affected individuals to reach a representative to make inquiry regarding whether their information was included in the breach, according to the memo.
(READ MORE: Will the Social Security data breach affect my Medicare?)
“All of the foregoing notices and reports are required to be completed within 60 days of the covered entity’s knowledge or discovery of the breach,” the memo said. “As of today, it has been 240 calendar days since Hamilton County first had knowledge of the breach (July 14, 2024) and 180 days past the 60-day notice period.”
The memo placed the phrases containing the 60-day, 180-day and 240-day periods in bold, underlined text.
The memo said it didn’t appear that the firm had notified the affected individuals, and a review of the contract reflected no specific terms addressing which party is responsible for the cost and coordination of the required notifications when the breach is through the company’s system but involves Hamilton County’s data.
“To the extent responsibility for such notification falls to Hamilton County,” Beltramo wrote, “Ms. Duncan and I would struggle to complete these tasks in a timely manner without appropriate support, access to data and resources.”
The memo said that Beltramo and Duncan were not involved in drafting the bid documents or the contract with the collection agency.
Contact Joan McClane at jmcclane@timesfreepress.com or 423-757-6601.