According to the audit, CMS had 14 breaches of protected health information between Sept. 23, 2009 and Dec. 31, 2011, affecting 13,775 Medicare beneficiaries. While the beneficiaries were notified, CMS failed to meet several notification requirements detailed in the American Recovery and Reinvestment Act. In response to these medical identity theft risks, CMS developed a compromised number database for contractors; however, the usefulness of the database could have be improved, according to the audit. In addition, contractors did not consistently develop edits to stop payments on compromised numbers.
In order to remedy these issues, OIG gave five recommendations to CMS:
1. Ensure that breach notifications meet Recovery Act requirements.
2. Improve the compromised number database.
3. Provide guidance to contractors about using database information and implementing edits.
4. Develop a method for ensuring that beneficiaries who are victims of medical identity theft retain access to needed services.
5. Develop a method for reissuing identification numbers to beneficiaries affected by medical identity theft.
More Articles on Data Breaches:
Kentucky Health Agency Notifies 2,500 of Potential HIPAA Breach
Anthem Blue Cross to Pay $150k Over Data Breach Allegations
2 University of Miami Hospital Employees May Have Stolen Patient Information
Becker’s 3rd Annual Fall Chief Pharmacy Officer Summit is the top tier event that the people leading the future of pharmacy convene. This 3-day event is built specifically for Chief Pharmacy Officers and senior pharmacy leaders. The sessions examine the workforce, financial and clinical priorities shaping pharmacy today. Becker’s is where candid discussions flourish and new ideas thrive. Becker's 3rd Annual Fall Chief Pharmacy Officer Summit
