Rhode Island: Yikes! RIBridges security breach worse than I thought; HealthSourceRI extends deadline & announces stopgap measures for HSRI enrollees

Last week I reposted a press release & video from the Rhode Island Dept. of Administration explaining the details of a major security breach of the state's social services system.

Today it looks like the issue was a lot worse than I thought. via WPRI:

On Monday, Gov. Dan McKee said his team has identified 650,000 people whose personal information was stolen in the recent cyberattack on the state’s IT system for social services.

Yikes. FWIW, Rhode Island only has around 1.1 million people, so this basically means that 60% of the entire state population has had their personal info compromised. 

...Earlier this month, the cyberattack shut down the state’s IT system known as RIBridges, which serves as an eligibility database for a host of social services, such as SNAP and Medicaid, along with subsidized health insurance through HealthSourceRI.

...According to McKee, the state aims to turn the system back on in January. In the meantime, R.I. Human Services Director Kim Merolla-Brito said people will still receive benefits through SNAP, Medicaid and other cash-assistance programs. She said EBT cards should be refilled for January under normal distribution methods.

She added that nobody will be terminated from Medicaid while the system is down.

...HealthSourceRI, however, heavily relies on RIBbridges to determine eligibility for coverage, and state officials said last week they’ve decided against trying to use a paper-based system for new applications.

...HealthSourceRI Director Lindsay Lang said they will extend their open-enrollment period through February and back-date coverage to Jan. 1 for people who sign up after the system returns online.

Here's today's update from the official RI Dept. of Admin:

Update 12/23/2024: Governor McKee and HealthSource RI Announce New Flexibilities for Plan Selection

Governor Dan McKee and HealthSource RI, the state’s marketplace for affordable health coverage, announced new flexibilities in place to help keep Rhode Islanders connected to coverage for 2025 while the RIBridges system, managed by Deloitte, is temporarily unavailable.

Today HSRI is pleased to announce several flexible options to make sure its customers are covered from January 1st.

• We have extended Open Enrollment through February 28, so Rhode Islanders will be able pick a plan of their choice through HSRI for an extra month this year, once enrollment through the RIBridges system becomes available. Any plan chosen can be made retroactive to January 1st.

• We have arranged for customers with an urgent need for January 1st coverage to enroll directly for January and February coverage with HSRI’s longtime insurance carriers, Blue Cross & Blue Shield of Rhode Island and Neighborhood Health Plan of Rhode Island.

• Once the system becomes available to HSRI customers again, customers will receive information about how to apply for coverage for the remainder of the year through HSRI. This will ensure customers are connected with federal financial assistance in the form of advance premium tax credits for March and beyond.

• For more information on which customers may benefit from this stopgap option, details on how to enroll, plan options, and how to find assistance, visit here.

HSRI’s customer service team at 1-855-840-4774 will be able to assist customers with questions beginning Thursday, December 26 at 12 noon, as we will be closed Thursday morning to ensure all of our team have completed training on new special coverage rules. Extended customer service hours will also be announced shortly here.

Aside from these new options for those not yet enrolled, here’s what certain groups of HSRI customers in various stages of the enrollment process should know and can do to keep their coverage:

• Coverage will be active for customers whose plan selections for 2025 were already made (through automatic renewal or by taking action to select a plan) and who have either already made a payment or set up auto-payment. They do not need to take any action.

• Customers in 2024 plans who previously received notice that they were not automatically renewed but needed to take action to select a 2025 plan will be held in the same plans with the same insurance carriers they had been with in 2024. Once RIBridges is restored, they will have an opportunity to adjust their plan if better suited to changes in their income or other. Such changes may be allowed retroactively to January 1 if needed

• Customers who were automatically renewed but not enrolled in auto-payments or made a manual payment simply need to pay their premium. This guidance is the same for customers who selected a plan by Thursday, December 12 but had not yet paid. They can do so:
  • in person by bringing their barcoded invoice to any CVS except those in Target locations.
  • in person by depositing a check or money order in a 24/7 drop-box at the HealthSource RI East Providence walk-in center, 401 Wampanoag Trail.
  • by phone through our call center at 1-855-840-4774.