Unlike ransomware attacks or system hacks, the Minnesota incident did not involve an outside cyber attack or service disruption. Instead, it stemmed from access by a user who had legitimate credentials, a type of incident that appears in federal breach disclosures, which under the Health Insurance Portability and Accountability Act (HIPAA) must be reported to the U.S. Department of Health and Human Services within 60 days of discovery. DHS reported this incident on Jan. 16.
In Minnesota’s case, a user who was affiliated with a licensed health-care provider accessed data in the MnCHOICES system without authorization from Aug. 28 to Sept. 21, according to the agency website. MnCHOICES is used by counties, tribal nations, managed care organizations and consultation services providers to support their assessment and planning work for residents who need long-term services and support. The unnamed service provider has been terminated from using the system.
The HIPAA Journal reports that hacking and similar IT incidents account for most health-care security breaches, while unauthorized access and disclosure are also on the rise. These include errors, negligence, snooping and data theft, according to the report, with 112 reported to the federal government in 2025.
One specific example of the federal breach reports is an instance involving Jackson Health System, a county-owned public health system in Florida, which fired an employee for accessing patient information to promote a personal health-care business, according to a news release. The access occurred from July 2020 to May 2025.
In Minnesota, DHS confirmed that the user’s access to the MnCHOICES system was terminated Oct. 30. The system’s vendor hired a cybersecurity firm to investigate. The agency reported that there is no evidence that the accessed information has been misused, and its Office of Inspector General is monitoring billing data to identify potential fraudulent or inappropriate activity.
DHS has posted notifications to affected individuals and asked that they review health-care statements and look for anything suspicious.
