For IU Health Medicare Advantage only: IU Health Plans reports notice of MOVEit data security incident involving its vendor, TMG Health

IU Health Plans announced today that its claims processing vendor, TMG Health, Inc. (TMG), discovered a security incident involving TMG’s use of a third-party service, MOVEit Transfer, which recently reported a security vulnerability.

It is noteworthy that IU Health Plans is among more than 500 companies affected by the MOVEit security incident. In response to this situation, we want to assure all our members that safeguarding data privacy remains our top priority.

This security incident impacted IU Health Plans Medicare Advantage members only. Other IU Health Plans products lines (including IU Health Plans fully insured commercial products and the IU Health Team Member Plan) were not impacted.

On June 22, 2023, IU Health Plans was notified of the security incident by TMG who immediately initiated an investigation confirming downloads had been made by an unauthorized party between May 30, 2023 and June 2, 2023. The downloaded data included IU Health Plans Medicare Advantage member names, member identification numbers, and effective dates of plans, and in limited circumstances, banking account and routing numbers.

IU Health Plans began notifying affected Medicare Advantage members on Aug. 4, 2023. All IU Health Plans Medicare Advantage members impacted are being provided free credit monitoring by TMG. Additionally, TMG deployed the requisite security measures to ensure its systems are updated to block these activities from occurring in the future.

Moving forward

In the dynamic field of digital advancements, the challenge of preventing unauthorized access to data is an ongoing and pressing concern for all healthcare organizations, and IU Health Plans is no exception. IU Health Plans has taken steps to collaborate closely with our vendor, TMG. Together, we are strengthening our systems to prevent unauthorized activities, and continuing to set up strong defenses to stop any potential breaches in the future.

Since June 2, 2023, there has been no observed unauthorized activity, signifying a successful containment of the breach.

If you have any questions, please call toll-free 1.888.727.2311 or visit the TMG website at https://response.idx.us/notice-info. A list of frequently asked questions is also available online at https://response.idx.us/notice-info.