RIBridges Alert – FAQ
On December 13, 2024, the State was informed by its vendor, Deloitte, that there was a major security threat to the RIBridges system. In response, the State has proactively taken the system offline so that the State and Deloitte can work to address the threat and restore the system as quickly as possible. RI Bridges is the State’s computer system that supports online applications and eligibility processing for Medicaid, SNAP, TANF, RI Works, Child Care Assistance Program (CCAP), HealthSource RI, Long-Term Supports and Services (LTSS), AT HOME cost-sharing, and General Public Assistance (GPA). Additionally, Deloitte confirmed that there is a high probability that a cybercriminal has obtained files with personally identifiable information from RIBridges.
RIPIN is here to support you as best we can. However, we only have access to the information that the State has made publicly available, and there is also a lot that we don’t know. We will continue to provide updated information as it becomes available.
Three immediate actions Rhode Islanders receiving benefits through RIBridges can take:
- Change the passwords on all related accounts.
- Enable two-factor authentication for any of your accounts that support it.
- Review options to protect yourself from identity theft listed on the State’s data breach website, http://cyberalert.ri.gov, or call the State’s call center at 833-918-6603 referencing B137035.
In response to the RIBridges data breach, Deloitte has contracted with Experian to run a multilingual call center to provide guidance on identity theft protection. A toll-free hotline will be open Mondays through Fridays at 833-918-6603. The reference number for the Rhode Island incident is B137035.
RIPIN’s current understanding is that this call center is limited to providing general options for identity theft prevention. We do not expect that this call center will have access to DHS systems or be able to answer questions about Medicaid, SNAP, or other benefits provided through the RI Bridges.
Frequently Asked Questions
- What does this mean for me? What should I do?
Those with questions about preventing identity theft that might result from the cyberattack should read the information at http://cyberalert.ri.gov.
Those with questions can also call the State’s new dedicated call center at 833-918-6603. This call center will not have access to DHS systems or be able to answer questions about Medicaid, SNAP, or other benefits provided through the RI Bridges.
This call center is also not yet able to confirm whether any particular individual’s personal information has been compromised or not. - When will I (and how can I) find out if my personal information was exposed in this cyberattack?
There is no way for any individual to confirm whether their information was or might be exposed in this incident, even through the special dedicated call center. The State is still assessing exactly what information might be in the hands of the cyber attackers, and has stated that at least 650,000 people were affected.
The State is advising everyone who has used RI Bridges to assume their data is part of the breach and take immediate steps to protect against identity theft.
Eventually, those impacted by this incident will receive personalized notifications. The State has indicated that these notifications will begin to be sent in January 2025, including information on how to sign up for free credit monitoring. - Can I still use my Medicaid, SNAP, or other benefits?
The State has confirmed that December SNAP benefits were already distributed. SNAP and RI Works beneficiaries are being urged to learn how they can freeze and unfreeze their EBT cards to ensure their benefit payments aren’t stolen. That can be done through the company that manages the cards, FIS, either online or using its mobile app. Detailed instructions are in a PDF on the state’s website.
The State has also confirmed that January SNAP benefits have been distributed as normal.
Our current expectation is that those who had active Medicaid benefits prior to the this cyberattack will continue to be able to use those benefits to visit providers or pick up prescriptions. This would include those with coverage through a Medicaid Managed Care Organization (NHPRI, Tufts, or United) and also those who access Medicaid benefits through the Anchor Card.
Additionally, the State has confirmed that they have begun processing paper applications for Medicaid, SNAP, and other benefits, though processing times are longer than they were before the attack. Paper applications are being processed in the order received (with some exceptions for expedited SNAP applications), and DHS is working through a backlog of applications submitted since the system was taken offline.
Medicaid applicants who are found eligible once their paper applications are processed are expected to have their eligibility reflect in MMIS (the State’s Medicaid eligibility portal) and to be enrolled into a Medicaid Managed Care Plan (if applicable) as it did before the cyberattack. MMIS and Medicaid Managed Care Organization systems are not believed to have been affected by the cyberattack. - How can I apply for Medicaid, SNAP, CCAP, or other benefits now?
The State’s online system for benefit applications is currently shut down. The State is directing new applicants to apply using paper-based processes, as described in the “Apply by Mail” section of this site – https://dhs.ri.gov/apply-now.
While the State has confirmed that paper applications are now being processed, RIPIN does not know how this cyberattack will impact application processing times. We advise all consumers using paper-based application processes to make copies of everything submitted, use return-receipt mailing, get receipts if possible when delivering papers to DHS offices or drop-boxes in person, and keep careful notes of submission dates. - When will the RI Bridges become available again? How long will this take?
We do not know. The State has announced that they hope to restore RIBridges in January, but has not released a specific timeline. - I have a commercial Qualified Health Plan (QHP) through HSRI, how can I pay my monthly premiums?
The State has advised that HSRI premium payments can be processed over the phone through the HSRI Service Center at (855) 840-4774, in person at the HSRI walk-in center at 401 Wampanoag Trail, East Providence, RI 02915, or in person by visiting any standalone CVS location (not including those located in Target stores). This includes payments for 2024 plans, payments for people who applied for a 2025 plan on or before Thursday, December 12, 2024 and who were successfully enrolled, or people who have been automatically renewed into 2025 coverage after having a 2024 plan. If paying in person at a CVS location, enrollees must bring a copy of their HealthSourceRI invoice with them.
For more information about HealthSourceRI’s response to the cyberattack, please see https://healthsourceri.com/covered2025/ - I need to choose my HSRI plan for 2025. What should I do?
Currently, HealthSourceRI’s enrollment system is offline. While signing up through HSRI for full-year coverage is not currently possible, HSRI has announced measures to help ensure Rhode Islanders who haven’t yet chosen a plan for 2025 to access coverage.
First, HSRI will extend Open Enrollment until February 28, 2025, and has announced that they will allow enrollees to have coverage backdate to January 1, 2025, helping to ensure that health care costs incurred while the enrollment system is offline can be covered by insurance. Enrollment into these plans, with a retroactive start date, can take place once the RIBridges system is back online, which the State has announced will hopefully take place in January 2025.
Second, HSRI has announced that people with 2024 coverage will be automatically renewed into the same (or a similar) plan for 2025. These individuals will be able to make a new plan selection once the system is back online, but will keep the coverage they had in 2024 while the system remains offline.
Third, HSRI has announced that it has partnered with the two carriers offering plans on the individual market, Neighborhood Health Plan and Blue Cross Blue Shield of Rhode Island, to offer special stopgap plans for people who need coverage as of January. HSRI has announced that these plans will have no premium for January and February 2025, and will have reduced cost sharing (including deductibles and copays). Consumers can get support in enrolling into these plans by calling the HSRI Call Center at (855) 840-4774.
For more information about HealthSourceRI’s response to the cyberattack, please see https://healthsourceri.com/covered2025/ - I received a termination notice saying that I will lose my Medicaid (or other benefits) as of December 31st. What does this mean for me?
The State has announced that anyone who received a renewal notice due in December or January can ignore that renewal notice without losing benefits. People who were originally scheduled for a December or January renewal will receive a new renewal notice once the RIBridges system is fully back online.
We advise all consumers to apply using paper-based processes, as described in the “Apply by Mail” section of this site https://dhs.ri.gov/apply-now. We recommend you make copies of everything submitted and keep careful notes of submission dates. - I need to submit information to the State to renew my Medicaid or other benefits. How should I submit that information?
The State expects renewal information to be submitted in paper at a DHS office drop box or mailed to the address provided in the renewal notice. We advise all consumers to apply using paper-based processes, as described in the “Apply by Mail” section of this site https://dhs.ri.gov/apply-now. We recommend you make copies of everything submitted and keep careful notes of submission dates. - Will the MMIS provider portal work?
RIPIN’s understanding is that the Medicaid Management Information System (MMIS) provider portal is still functional and providing accurate information. The State believes this cyberattack does not impact MMIS. - Is the Community Supports Management (CSM) working?
The Community Supports Management (CSM) is the State’s system for pairing new Home- and Community-Based Service (HCBS) recipients with home care agencies and other providers, for allowing HCBS enrollees to switch agencies, for authorizing payment to home care agencies, and other similar tasks.
The CSM system seems to be up and functioning normally. There was a period during December where the CSM appeared to be down, but as of early January it seems to be working again. - Will the Health Information Exchange (CurrentCare) still work?
RIPIN’s understanding is that CurrentCare is not affected by this cyberattack and will still function as normal. - What about unemployment, TDI, and TCI benefits?
RIPIN’s understanding is that unemployment, TDI, and TCI benefits are administered by a separate system that is unaffected by the cyberattack. We anticipate that unemployment, TDI, and TCI benefits will continue to be paid as normal, and that new applicants can continue to apply as normal.
Again, RIPIN is here to support you as best we can, however, we do not have access to any information beyond that which is publicly available. We will continue to share additional information as it becomes available.
Last updated January 7, 2025