Consumers, providers, vendors, health 2.0 companies, public health, and others who are working to bring gov2.0 concepts to the health care industry.
Data Breaches and Medicare
October 12, 2012 at 12:36 pm #170885
Response by the HHS IG
Title: CMS RESPONSE TO BREACHES AND MEDICAL IDENTITY THEFT
WHY WE DID THIS STUDY
The Centers for Medicare & Medicaid Services (CMS) maintains the protected health information of millions of Medicare beneficiaries. If a breach occurs and the security or privacy of this information is compromised, CMS is required by the American Recovery and Reinvestment Act (the Recovery Act) to notify the affected beneficiaries. Such breaches can lead to medical identity theft. Medical identity theft is the appropriation or misuse of a patient’s or a provider’s medical identifying information (such as a Medicare identification number) to fraudulently obtain or bill for medical care. It can create patient safety risks and impose financial burdens on those affected. Medical identity theft may also lead to significant financial losses for the Medicare Trust Funds and taxpayers.
WHAT WE FOUND
CMS reported that it had 14 breaches of protected health information requiring notification under the Recovery Act between September 23, 2009, and December 31, 2011. CMS notified the 13,775 Medicare beneficiaries affected by the breaches, but did not meet several Recovery Act requirements. CMS has made progress in responding to medical identity theft by developing a compromised number database for contractors. However, the database’s usefulness could be improved. Further, contractors do not consistently develop edits to stop payments on compromised numbers. Lastly, CMS offers some remedies to providers but fewer to beneficiaries affected by medical identity theft.
WHAT WE RECOMMEND
We recommend that CMS: (1) ensure that breach notifications meet Recovery Act requirements, (2) improve the compromised number database, (3) provide guidance to contractors about using database information and implementing edits, (4) develop a method for ensuring that beneficiaries who are victims of medical identity theft retain access to needed services, and (5) develop a method for reissuing identification numbers to beneficiaries affected by medical identity theft. CMS concurred with all but the draft report’s fourth recommendation, which we revised as stated above.
October 12, 2012 at 12:38 pm #170888
additional information and commentary from FierceHealthIT
CMS violated data breach notification requirements
Compromised number database for contractors should be improved, OIG says
October 11, 2012 | By Julie Bird
The Centers for Medicare & Medicaid Services failed to meet federal notification requirements when its Medicare patient database was breached, or offer much help to beneficiaries whose protected health information was compromised, an audit by the Department of Health & Human Services’ Inspector General found.
CMS had 14 breaches of protected health information (PHI) between Sept. 23, 2009, and Dec. 31, 2011, affecting 13,775 Medicare beneficiaries, according to the HHS Office of the Inspector General (OIG). The beneficiaries were notified, but CMS failed to meet several notification requirements detailed in the American Recovery and Reinvestment Act, OIG found.
CMS has since developed a database for contractors detailing compromised numbers, but OIG said in a summary of its report that the “usefulness could be improved,” noting that “contractors do not consistently develop edits to stop payments on compromised [Medicare] numbers.” And while CMS offers some remedies to providers, OIG says, fewer remedies are available to beneficiaries victimized by medical identity theft because of the breaches.
You must be logged in to reply to this topic.