DC’s Public Health Reports Carried Hidden Data on Nearly 400,000 People
Two reports on the District of Columbia’s Department of Health Care Finance website displayed summary figures, yet contained hidden personal information that may have been reachable by people without permission. The agency says the potential exposure ran from 2023 until July 2026. A federal breach filing lists 399,086 people affected. That is the reported population, not a count of people whose records were proved to have been opened or copied.
The reports concerned DC Medicaid and the DC Healthcare Alliance. DHCF says it learned of the problem on 21 July 2026 and removed both reports from its website. Its public notice says the pages were intended to show only group information, such as enrolment counts. Individual details were not visible in the displayed summary, but the underlying information could still have been reached.
The hidden layer mattered more than the visible chart
DHCF says the potentially accessible information included Medicaid ID numbers, dates of birth, provider names, race, gender, ward and ethnicity. It says beneficiary names, Social Security numbers and financial account information were not included. A sample notification letter also describes possible information about children or deceased family members. The agency has not published a per-person breakdown, so the federal total should not be read as a claim that every listed field belonged to every one of the 399,086 people.
The HHS Office for Civil Rights portal dates DHCF’s report to 3 September 2026 and classifies it as unauthorised access or disclosure. DHCF says it has no reason to believe the information was viewed or misused in the wrong way. Neither source establishes that someone actually retrieved the hidden records. The notice does not identify the report format, a technical route to the underlying data, access-log findings or a count of retrievals. Those gaps should not be filled with a story about hackers, scraping, missing logs or confirmed theft.
A public report needs a data-release test
The operational failure mode is broader than a visible table. A report may render only totals while its published file, page response or supporting service still contains more detail. DHCF has not said which of those paths applied here. The distinction matters because a visual check of the chart would not, by itself, prove that the material delivered to an unauthorised visitor was limited to aggregates.
HHS guidance on de-identification distinguishes an aggregate report that does not identify members from information that remains individually identifiable. OWASP’s excessive-data-exposure test guidance describes the related software pattern in which a client shows selected fields while an underlying response contains additional sensitive fields. That guidance is a useful test model, not evidence that DHCF used an API or a particular report technology.
Before publishing a health-data report, a team can make the release gate concrete:
- Build the public output from an approved aggregate dataset or an explicit list of permitted fields. Do not rely on hiding row-level information in the presentation layer.
- In a staging environment with synthetic records, inspect the entire public artefact and every supporting response as an unauthenticated visitor would receive them. Check downloads, embedded data and metadata as well as the visible page.
- Make the test fail if a synthetic beneficiary identifier or birth date appears anywhere in the public output. Record the approved field list and repeat the check after each report or template change.
- If a publication error is found, remove the exposed output, identify where copies may persist and preserve available access evidence for the incident review. A lack of public detail about logs is not proof that logs were absent.
This is the same boundary BlackTree examined in public SaaS guest access: a public interface is not automatically a public-data policy. The DHCF case adds a reporting lesson. The approved answer is not only what a reader sees, but everything the publication process makes retrievable.
What beneficiaries can do
DHCF says it will mail notices to affected people. Those enrolled in Medicaid or Alliance between 2023 and July 2026 who have questions, or think they should have received a notice, can use the phone number on DHCF’s own incident page: 1-833-687-5424. The agency advises watching for suspicious activity. The absence of names, Social Security numbers and financial accounts narrows the stated exposure; it does not make a Medicaid identifier or provider context unimportant. Verify unexpected calls or messages through the agency’s published contact route rather than a number supplied in the message.
Sources
- District of Columbia Department of Health Care Finance, Data Incident notice, public page with no displayed publication date, checked 29 September 2026.
- DHCF sample breach notification letter, undated sample, checked 29 September 2026.
- US Department of Health and Human Services Office for Civil Rights breach portal, DHCF filing dated 3 September 2026, checked 29 September 2026.
- HHS guidance on de-identification of protected health information, checked 29 September 2026.
- OWASP Web Security Testing Guide, Excessive Data Exposure, checked 29 September 2026.
