Valley Mountain Regional Center (VMRC) is required by California Welfare and Institutions Code section 4629.5 to post the names, service types, and contact information of its vendors on its public website, as part of an effort to promote transparency. When VMRC reviewed this posted list, it discovered that individual consumers who were vendored under service code 065 (SSP Restoration) had been included alongside legitimate business vendors. This was not the result of hacking or malicious intrusion — it was an accidental disclosure, where personal information that should have been excluded from the public list was posted online along with everyone else’s vendor details.
The people affected are consumers who receive services from VMRC under the SSP Restoration service code and who were mistakenly listed on the public vendor page, rather than being excluded as consumers or family members should have been under the statute. VMRC has not stated how many individuals total were affected.
What information was exposed?
- Full name
- Home address
- Phone number
- Service description (which identifies the person as receiving a specific developmental disability service through VMRC)
VMRC states clearly that no Social Security numbers, driver’s license numbers, or financial account numbers were involved in this incident, which limits the risk of direct identity theft or fraudulent account opening.
What should you do now?
- Keep this notice for your records in case questions come up later about your information or your relationship with VMRC.
- Be alert for unsolicited calls, texts, or mail referencing your address or the type of service you receive — scammers sometimes use small details like this to sound credible when phishing for more information.
- Consider requesting a copy of your records from VMRC or your provider to have a baseline for comparison if any discrepancies show up later.
- Watch your mail and phone for anything unexpected, since even limited contact information can be combined with other data by scammers over time; consider signing up for a service like Aura or LifeLock, which can alert you if your information appears elsewhere.
- If you ever notice suspicious activity tied to your name or address, report it promptly to VMRC and to your local consumer protection resources.
If you have questions, Valley Mountain Regional Center can be reached through Cindy Strawderman, HIPAA Compliance Officer, at 209-473-0951. This notice was issued under California Welfare and Institutions Code section 4629.5.