RICHMOND, Va. — A Department of Behavioral Health and Developmental Services spokesperson says people applying for a state program to help loved ones with disabilities will be notified within 60 days if their personal information was exposed because of a technical issue on a state website.
Friday, Oct. 11 at 5 p.m. was the original application deadline for the Individual and Family Support Program which is overseen by DBHDS. The website went live on Oct. 1 at 9 a.m. to apply, but was shut down within 16 minutes after the agency noticed a technical issue that exposed personal information, like social security numbers and home addresses.
A department spokesperson says if an applicant’s information was impacted, they will be notified by Nov. 29.
The website has since been shut down as the department investigates what happened and determines specifically whose information was impacted. It’s being led by VITA’s Incident Response team as well as DBHDS’ Information Technology staff.
According to an email update sent to a listserv of people interested in IFSP, more than 2,300 applications were submitted while the website was live. More than 650 people were on the website when it was shut down.
Virginians who have loved ones with disabilities can apply to the IFSP if they are on a waitlist for a Medicaid waiver. If they are accepted, individuals can receive up to $1,000 in state funding to help cover costs for equipment, therapy and other specific needs. These applications are reviewed in the order they are received by DBHDS.
“There’s just so many unanswered questions,” Ebony Cunningham, a Chesterfield County mom, said.
Cunningham was waiting at her computer before 9 a.m. on Oct. 1 to apply for state assistance for her twin boys, Jaxson and Xavier. The 5-year-olds both have autism and are non-verbal. The state money would help her family cover the costs for communication devices and Applied Behavioral Analysis (ABA) therapy.
“Insurance only covers so much,” she said. “Knowing that the funds would be able to help my sons out, and now I don’t know where things stand.”
When she signed on, Cunningham was able to see other people’s personal information.
Emails from DBHDS have been sent out periodically over the past week including on Oct. 1, Oct. 2, Oct. 4 and then Oct. 10.
Maria Reppas, a department spokesperson, said their “priority is investigating” the technical issue and have been “updating applicants as often as they can.”
Families say they haven’t been hearing from the department enough.
The most recent update specifies that applications successfully submitted will receive a corrected confirmation email no later than Oct. 21. Those who did not get to complete their application will be reached out to in the coming weeks. The department is able to track what accounts logged on when the website went live.
Reppas says they are also working on a process for people to apply who haven’t been able to already.
As for the people whose information may have been exposed, DBHDS will contact them directly. They are working on options for credit protections to offer these individuals, Reppas said.
The latest email update also urged people who are concerned to check their credit report in the meantime. Credit reports can be checked on three bureaus, Experian, TransUnion and Equifax.
Families have been waiting for more answers. Cunningham says it would be reassuring to see the department come out “publicly” to talk about “where they are in the process.”
“So that families, and people like myself, are able to kind of see how important it is to the department as much as it is to us,” she added.
There were about 3,000 participants in the IFSP in Fiscal Year 2018 (July 1, 2017 – June 30, 2018). About 4,500 received IFSP funds in Fiscal Year 2019 (July 1 2018 – June 30, 2019).
Reppas said about 13,000 Virginians on the waitlist for a Medicaid waiver are eligible to apply. The General Assembly has allocated more than $6 million in the state budget for IFSP payments to families over the past two years.
To get updates on the program as well as the department’s investigation, you can join the program’s listserv.
We have repeatedly asked to do on-camera interviews while reporting on this developing news, and have been told each time that no one is available.