Share this article and save a life!
700,000 Medicaid patients just learned their data was public for 3 years.
Illinois Department of Human Services accidentally published internal planning maps with patient data to a public website. The breach ran from 2021 to 2025 before anyone noticed.
Think about that: 3+ years of exposed addresses, case numbers, medical assistance plans, and demographic data. All because someone clicked the wrong privacy setting.
📊 The damage:
• 672,616 Medicaid/Medicare recipients exposed
• 32,401 rehabilitation services patients compromised
• Data included addresses, case details, referral sources
• Breach discovered September 2025, announced January 2026 (102 days later)
Here’s what keeps me up at night:
This wasn’t sophisticated hackers. This wasn’t ransomware. This was human error with privacy settings on a mapping tool.
How many other state health systems are unknowingly exposing data right now? How many misconfigured databases, forgotten test servers, or public cloud storage buckets contain PHI?
The scariest part: IDHS can’t tell who accessed this data during those 3 years. They say there’s no evidence of misuse, but how would they know?
This breach reveals three uncomfortable truths about healthcare cybersecurity:
1. We’re terrible at detecting long-term exposures
2. Government health systems often lack basic security hygiene
3. The 60-day breach notification rule isn’t being enforced (they took 102 days)
Every FQHC, hospital, and health system should ask themselves: When did we last audit our public-facing systems? Who’s checking that our “internal” tools are actually internal?
Because if a state health department can accidentally publish 700,000 records for 3 years without noticing, what are the odds smaller organizations are doing better?
The real tragedy here isn’t just the breach. It’s that these were Medicaid patients, our most vulnerable populations, who trusted the state with their data.
We owe them better than “oops, wrong setting.”
♻️ Repost if healthcare needs mandatory security audits for public systems.
👉 Follow me, Jonathan Govette, for daily, real-time updates on healthcare technology and business news. LinkedIn Profile: https://www.linkedin.com/in/jonathangovette/
Share this article and save a life!
Author:
CEO/Co-Founder @ Oatmeal Health | AI Lung Cancer Screening | Almost Became a Doctor | Engineer | Follow to Share What I’ve Learned Along the Way
I help patients get the care they need earlier, preventing late-stage cancer.
That’s been the throughline across three companies and almost 20 years in healthcare. At ReferralMD, we fixed broken referral networks so patients didn’t fall through the cracks. At Oatmeal Health, it’s lung cancer: building the diagnostic and screening infrastructure so the 85% of cases caught too late get caught early instead.
Today as CEO of Oatmeal Health, I lead a team embedding AI into radiology workflows to turn routine lung CT scans into reimbursable cancer risk assessments. We partner with FQHCs to reach underserved communities, and with health systems and payers to make early detection economically sustainable. Think HeartFlow or Cleerly, but for lungs.
Between companies, I advised at Techstars and Plug and Play, mentoring founders building in digital health. That experience shaped how I think about what separates companies that ship from companies that stall: distribution, reimbursement, and clinical trust, not just technology.
I’m a CancerX alumnus, a 3x healthcare founder, and someone who believes the biggest problems in cancer aren’t scientific. They’re operational.
We’re hiring mission-driven builders at Oatmeal Health. If you want to work on something that matters, reach out.
When I’m not working, I’m traveling, mentoring, and keeping up with one very energetic husky. 🐾
Substack – The Oatmeal Bite:
Millions of patients get less care because of who they are, where they live, or how they look. I’m fighting to change that. CEO @OatmealHealth, a startup built for the underserved. The Oatmeal Bite: intel for clinicians, investors, and advocates.
Jonathan Govette
CEO of Oatmeal Health
Substack:
https://oatmealhealthjonathangovette.substack.com/
