(Correction: In an earlier version of this story RoseAnn Duplan of the Oklahoma Disability Law Center was listed as an attorney. Duplan is a policy and planning specialist.)
An effort to analyze and eventually clear the long list of people on the Oklahoma Department of Human Services’ waitlist for developmentally disabled services could come to fruition this legislative session, but it has also resulted in a data breach that exposed citizens’ personal information and created stress for an already vulnerable population.
The DHS waitlist, which is made up of developmentally disabled people waiting for a community-based services waiver from the state agency, still affects more than 5,000 people as of March. Liberty Medical, a Kansas-based firm, was awarded an $8.4 million contract to conduct assessments of those on the list. The assessments are intended to help DHS get a complete picture of the population’s needs and make an accurate request of the Oklahoma Legislature for funding to provide services to those on the waitlist.
Samantha Galloway, chief of staff at DHS, said Monday that the assessments helped the agency peg $21.3 million as this year’s necessary additional funding figure to clear the waitlist, which now sits at 5,068 people.
According to a Feb. 25 letter sent by Liberty to the families of those on the waitlist, the company became aware of a data breach Dec. 7, 2021. Liberty told those on the list that the breach was discovered after a spoofed email account attempted to steal a payment owed to the company.
That theft was prevented, but a more complete review found that an unauthorized party was able to gain access to a Liberty employee’s email account and a spreadsheet containing personal information, including Social Security numbers, birthdates, addresses and phone numbers.
As part of their contract with the state for assessing the needs of those on the list, Liberty had sent questionnaires containing at least 400 questions about each person’s individual situation.
“An email was compromised on the Liberty side that had everyone on the waiting list, their information,” Oklahoma DHS CFO Cathy Menefee said. “Liberty, in that letter, they talk about offering some remediation services in cases anybody feels like they need it.”
‘This is a whole other complication and burden on these families’
RoseAnn Duplan is a policy and planning specialist at the Oklahoma Disability Law Center, a legal protection and advocacy agency for people with disabilities in Oklahoma. She said while Liberty is at fault for the breach, DHS isn’t blame free either.
“It doesn’t appear that any of the typical HIPPA-required data protection measures were taken, and based on what they said [at a meeting for those on the DHS waiting list], it really looks like a DHS error,” Duplan said. “Samantha Galloway stated they were at fault for sending the spreadsheet unencrypted.”
Duplan said the information contained in the spreadsheet was more than enough to steal someone’s identity or use their personal information in other ways.
“It had names, addresses, Social Security and Medicaid numbers,” she said. “In addition to that, it would have had the name, address and phone number of their caretaker as well. They said it didn’t contain SSN numbers for caretakers, but it did have their name, address and phone number. And this was for anyone who applied for waiver services prior to July 2021, so it’s well over 5,000 people.”
Duplan said Liberty is providing one year of free identity theft protection through Experian, but she said that is not free of problems, either.
“Usually that’s an easy fix for you or me, but for this particular set of folks, this is a whole other complication and burden on these families,” Duplan said. “The code they were given by Liberty didn’t work for minor children. Experian wouldn’t set it up. So that was another delay. They’re working on getting a different code. And if you have an adult with a disability that’s not able to make the call themselves, Experian is refusing to talk to those families, too. They are saying they need power of attorney. We have families with guardianship being told by Experian guardianship isn’t good enough, that their company policy requires it to be power of attorney. Many of these folks don’t have the capacity to sign power of attorney documents.”
Duplan said that, to her knowledge, none of those on the waiting list have had their identity stolen, but she added it may be too soon to know for sure. She said many of those on the list don’t use credit or check their credit scores regularly and may not know for some time if the compromised information was used for nefarious purposes.
“These are families that have been waiting 13-plus years for the services they need to take care of their loved one, and they don’t have the support in place now, and now we’re adding the extra layer of burden to now have to deal with this data breach,” she said. “DHS has a contract with Liberty, and there are extensive conditions within that contract as far as how data is supposed to be handled, and now they’re asking these families to turn around and trust Liberty with even more information. Many of these families are finding it difficult to move forward with that.”
‘Families are actually panicking’
Wanda Felty has been involved in the wait list for more than a decade. She began coordinating meetings among waitlist families in 2005. Those meetings have become a lifeline for some of the families with loved ones on the list.
“It’s not a formal meeting, but we often have legislators and other people involved in the process,” she said. “The purpose is for families to hear what’s going on with the list and the system and to share issues that are going on with their family, and to hear and see they aren’t the only ones in that boat.”
That’s how Felty saw it when she started going to the meetings in 1999, before she began coordinating them.
“We used to live in Spiro, and my daughter was on the list,” she said. “I thought nobody knew or nobody cared about the waiting list. I went to the first meeting, and I thought, ‘Oh my God, there are people actually talking about the waiting list,'” she said.
These days, the meetings are held on Zoom because of the pandemic, though that has actually increased participation. When the meetings were in person, Felty said about 35 to 40 people attended. When they’ve been held virtually, that number has more than doubled at times.
Felty said she has heard from a number of parents on the waitlist who are concerned about private information getting out and into the hands of people who could use it to steal an identity.
“From what I am hearing, the families are actually panicking,” she said.
Felty said in many cases the guardians and parents of those on the list wouldn’t typically check credit ratings of their loved ones.
“In any other circumstance, none of us would be monitoring kids’ credit ever,” she said. “Very few on the list will ever own a home or buy their own car. I had no reason to check my daughter’s credit, but this changes everything. Next year, and forever, we know how to keep an eye on it because someone could use the information and take advantage. The families I am hearing from are hitting the panic button because it’s a life-long situation, and they trusted DHS to make sure their information is handled.”
Felty said what Liberty is offering in the form of free credit monitoring for a year is not enough. She compared that with what happened when she was the victim of a data breach with a department store credit card.
“You would have thought the sky was falling,” she said. “Kohls wanted to compensate me for credit monitoring and store discounts, and they really went out of their way to make sure I was satisfied. That hasn’t been the case in this situation with DHS and Liberty, and it’s concerning to me. I also believe there is a whole set of families who don’t understand to what degree this information could be used to harm them, which is also a concern. So we have people who are panicking, and others who don’t understand the problem, which is in itself a big problem.”
Brown: Progress made with list
Department of Human Services director Justin Brown said progress analyzing the list has been significant since Liberty took over managing the assessments.
“We’re probably close to 50 percent through the wait list at this point,” Brown said March 1. “So we’ve got sufficient data. The strategy we laid out started with a full assessment for everyone on the waitlist. It’s never been done in the history of the waitlist. It’s always been a very sort of superficial understanding of who was on it. It’s always been managed on Excel, which is not the right way to handle a 5,000-plus person waitlist. So Liberty does full assessments, about 400 questions per person. It’s a deep understanding of what the needs are of the people who are waiting.”
Brown said the agency has gained a clearer picture of the state funding necessary to serve those on the list.
“We’re working with our partners here in the Legislature trying to figure out the right way to get the appropriations,” Brown said. “So it’s assessment, but it’s also important to note that not only do they do assessments, they’re also working navigation services. To the extent someone continues to wait, they will help them connect to community resources that allow for their families to be served while they’re waiting.”
On March 1, Brown said DHS was estimating that $20 million would be required to clear the waiting list, but that more funding would be required down the road for other services. (On April 11, Galloway said DHS had adjusted the number to $21.3 million.)
“It’s also important to note the industry needs to be supported as they bring people off the waitlist to make sure they have the direct-care staff necessary to serve those folks,” he said. “We put a place holder in for about $50 million for that. So it’s a $70 million total number. It’s important to note that it’s not just developmental disability services for that direct care staff. It also includes our aging and advantage waiver programs, so it’s pretty complex.”
LOFT report casts doubts on list management
Oklahoma’s Legislative Office of Fiscal Transparency, commonly known as LOFT, is tasked with reviewing the use of legislative appropriations to analyze performance outcomes, identify areas where operations can be improved and identify duplications across state agencies in a non-partisan and factual manner.
LOFT’s November 2021 analysis of past DHS efforts to reduce the waitlist found plenty of room for improvement. In its analysis of the waiting list, LOFT said “DHS’ management of the waiver program has not led to significant progress toward the state’s goal of providing services to all those waiting.”
The analysis also found available slots the ratio of budgeted community-based and in-home services waiver slots to members served is declining, despite increases in state and federal funding and that there are both immediate and long-term opportunities to increase the number of people served by community and home-based services waivers.
The report also found no real difference in the past assessments conducted by DHS and those conducted by Liberty Medical, which has a contract for more than $8 million from the state.
“DHS recently contracted for an independent assessment of the needs of those waiting for waivers; the sixth assessment to be conducted in approximately a decade,” the report states. “LOFT did not observe key differences in the type of data collected between the current and past assessments, nor a strategic plan for how this new information would be used to move those waiting into waivers.”
Moreover, the report found that additional money appropriated by the Legislature in recent years to reduce the number of people on the waitlist has had almost no noticeable impact.
“The two key drivers of waiting lists are high demand and program limitations, which can include a program’s structural design or resources,” the report states. “LOFT found that the number of people moved from Oklahoma’s Waiting List into waiver services over the past decade has remained relatively flat, despite the Oklahoma Legislature dedicating almost $9 million over the past eight years to the Department of Human Services for this purpose. LOFT observed no direct correlation between the additional appropriated funds and the actual transition of people moving from the Waiting List into a waiver.”
Brown, the DHS director who also serves as Gov. Kevin Stitt’s secretary of human services, was critical of the November 2021 report, saying it was not a “worthwhile use of time and resources” and that he objected to LOFT’s findings.
Thompson: ‘It is our desire that we fund that.’
Sen. Roger Thompson (R-Okemah) chairs the Senate Appropriations and Budget Committee. In March, Thompson said the Legislature wants to fund the elimination of the waitlist but also needs to know exactly the size of the problem they’re faced with when it comes to financial obligations.
“I have met personally with [staff] from DHS,” Thompson said. “We want those numbers as quickly as possible. It is our desire that we fund that. (…) We’re prepared in the Senate side to put that on our side of the ledger to fully fund the waiting list. Let’s get it done.”
When he made his remarks in March, Thompson said more information is needed.
“We want the data, and we want to look it all over to make sure we are putting money where it will truly make a difference,” he said.
House Appropriations Chairman Rep. Kevin Wallace (R-Wellston) chairs the House Appropriations and Budget Committee. He signaled his support for fixing the waitlist issue.
“I believe the plan is still there,” he said. “I am an advocate for reducing the waiting list, and I believe we will be successful. (…) It will take 18 to 24 months to accomplish.”
Wallace said he has not been frustrated by the slow pace of the process.
“No, I don’t want to rush and have something that is misleading or unachievable,” Wallace said. “And then the other thing I am looking for is what the cost is going to be for the [the subsequent fiscal year budget].”
(Editor’s note: Tres Savage contributed to this story.)
