CMS not Compliant on Breach Notification

CMS not Compliant on Data Breach Notification

CMS did not meet several Recovery Act requirements in reporting 14 breaches of PHI, according to an OIG report.

CMS reported that it had 14 breaches of PHI requiring notification under the Recovery Act between September 23, 2009, and December 31, 2011, according to an OIG email release. CMS notified the 13,755 Medicare beneficiaries affected by the breaches, but did not meet several Recovery Act requirements, OIG reports.

"CMS has made progress in responding to medical identity theft by developing a compromised number database for contractors," according to the email. "However, the database's usefulness could be improved. Further, contractors do not consistently develop edits to stop payments on compromised numbers. Lastly, CMS offers some remedies to providers but fewer to beneficiaries affected by medical identity theft."

OIG said it did this report because of its concerns with medical identity theft. CMS maintains the PHI of millions of Medicare beneficiaries, and any such breaches can lead to medical identity theft, the OIG reports.

In its study, OIG assessed CMS' response to medical identity theft involving beneficiary and provider Medicare identification numbers and the remedies it offers to beneficiaries and providers. It based this study on CMS data on breaches, CMS policies and procedures, CMS's compromised number database, and structured interviews with CMS staff and benefit integrity contractors.

The OIG recommends that CMS:

  • Ensure that breach notifications meet Recovery Act requirements
  • Improve the compromised number database
  • Provide guidance to contractors about using database information and implementing edits
  • Develop a method for ensuring that beneficiaries who are victims of medical identity theft retain access to needed services
  • Develop a method for reissuing identification numbers to beneficiaries affected by medical identity theft