CMS violated data breach notification requirements

The Centers for Medicare & Medicaid Services failed to meet federal notification requirements when its Medicare patient database was breached, or offer much help to beneficiaries whose protected health information was compromised, an audit by the Department of Health & Human Services' Inspector General found.

CMS had 14 breaches of protected health information (PHI) between Sept. 23, 2009, and Dec. 31, 2011, affecting 13,775 Medicare beneficiaries, according to the HHS Office of the Inspector General (OIG). The beneficiaries were notified, but CMS failed to meet several notification requirements detailed in the American Recovery and Reinvestment Act, OIG found.

CMS has since developed a database for contractors detailing compromised numbers, but OIG said in a summary of its report that the "usefulness could be improved," noting that "contractors do not consistently develop edits to stop payments on compromised [Medicare] numbers." And while CMS offers some remedies to providers, OIG says, fewer remedies are available to beneficiaries victimized by medical identity theft because of the breaches.

The OIG recommended that CMS:

  • Ensure that breach notifications meet Recovery Act requirements.
  • Improve the compromised number database
  • Provide guidance to contractors about using database information and implementing edits
  • Find a way to ensure that beneficiaries whose PHI is stolen have access to needed services
  • Develop a way to reissue identification numbers to beneficiaries whose medical identification is stolen

CMS last year took steps to help healthcare providers victimized by medical ID theft, launching its Provider Victim Validation / Remediation Initiative to help them exonerate themselves. Providers also can ask for help from the OIG or Medicare Administrative Contractors if they are victims of Medicare identity theft but have not sustained financial liability.

Data breaches are a major problem nationwide, with HHS's Office for Civil Rights (OCR) listing nearly 500 breaches since September 2009 affecting more than 500 people each. The number affected totaled nearly 21 million as of the end of July.

To learn more:
- read the OIG report
- check out the summary
- here's the OCR list of data breaches