OIG critiques Medicare approach to data breaches
Growing concerns about medical identity theft led the Centers for Medicare & Medicaid Services' (CMS) Office of Inspector General to publish a report, CMS Response to Breaches and Medical Identity Theft, about the current rate of data breaches in healthcare.
The study had two objectives:
1. Determine the extent to which the Centers for Medicare & Medicaid Services’ (CMS) response to breaches of beneficiaries’ protected health information met the notification requirements in the American Recovery and Reinvestment Act of 2009 (the Recovery Act).
2. Assess CMS’s response to medical identity theft involving beneficiary and provider Medicare identification numbers and the remedies it offers to beneficiaries and providers.
The study is based on CMS data on breaches, CMS policies and procedures, CMS’s compromised number database and structured interviews with CMS staff and benefit integrity contractors.
The agency had 14 breaches of protected health information requiring notification under the Recovery Act between Sept. 23, 2009, and Dec. 31, 2011. CMS notified the 13,775 Medicare beneficiaries affected by the breaches, but did not meet several Recovery Act requirements.
“CMS has made progress in responding to medical identity theft by developing a compromised number database for contractors,” the report says. “However, the database’s usefulness could be improved. Further, contractors do not consistently develop edits to stop payments on compromised numbers.”
The report makes the following recommendations to CMS:
1. Ensure that breach notifications meet Recovery Act requirements,
2. Improve the compromised number database,
3. Provide guidance to contractors about using database information and implementing edits,
4. Develop a method for ensuring that beneficiaries who are victims of medical identity theft retain access to needed services, and
5. Develop a method for reissuing identification numbers to beneficiaries affected by medical identity theft.
The complete report is available online.
Editor
Editor Beth earned a bachelor’s degree in journalism and master’s in health communication. She has worked in hospital, academic and publishing settings over the past 20 years. Beth joined TriMed in 2005, as editor of CMIO and Clinical Innovation + Technology. When not covering all things related to health IT, she spends time with her husband and three children.