CMS Response to Breaches and Medical Identity Theft

WHY WE DID THIS STUDY

CMS maintains the protected health information of millions of Medicare beneficiaries. If a breach occurs and the security or privacy of this information is compromised, CMS is required by the American Recovery and Reinvestment Act (the Recovery Act) to notify the affected beneficiaries. Such breaches can lead to medical identity theft. Medical identity theft is the appropriation or misuse of a patient's or a provider's medical identifying information (such as a Medicare identification number) to fraudulently obtain or bill for medical care. It can create patient safety risks and impose financial burdens on those affected. Medical identity theft may also lead to significant financial losses for the Medicare Trust Funds and taxpayers.

HOW WE DID THIS STUDY

We determined the extent to which CMS's response to breaches met the notification requirements in the Recovery Act. We also assessed CMS's response to medical identity theft involving beneficiary and provider Medicare identification numbers and the remedies it offers to beneficiaries and providers. We based this study on CMS data on breaches, CMS policies and procedures, CMS's compromised number database, and structured interviews with CMS staff and benefit integrity contractors.

WHAT WE FOUND

CMS reported that it had 14 breaches of protected health information requiring notification under the Recovery Act between September 23, 2009, and December 31, 2011. CMS notified the 13,775 Medicare beneficiaries affected by the breaches, but did not meet several Recovery Act requirements. CMS has made progress in responding to medical identity theft by developing a compromised number database for contractors. However, the database's usefulness could be improved. Further, contractors do not consistently develop edits to stop payments on compromised numbers. Lastly, CMS offers some remedies to providers but fewer to beneficiaries affected by medical identity theft.

WHAT WE RECOMMEND

We recommend that CMS: (1) ensure that breach notifications meet Recovery Act requirements, (2) improve the compromised number database, (3) provide guidance to contractors about using database information and implementing edits, (4) develop a method for ensuring that beneficiaries who are victims of medical identity theft retain access to needed services, and (5) develop a method for reissuing identification numbers to beneficiaries affected by medical identity theft. CMS concurred with all but the draft report's fourth recommendation, which we revised as stated above.