Identity Theft

IG recommends ways to prevent Medicare fraud

Image of Medicare cardThe Centers for Medicare & Medicaid Services (CMS) can reduce the risk of security breaches, and therefore reduce the risk of medical identity theft, by taking five corrective actions, according to an inspector general’s report released earlier this month.

Daniel R. Levinson, IG for the Department of Health and Human Services, issued the report, which had two objectives:  to determine how closely the CMS’s notification to beneficiaries of security breaches matched up with legal standards established by the 2009 Recovery Act, and to assess CMS’s response to medical identity theft involving Medicare identification numbers.

Between September 23, 2009 and December 31, 2011, there were 14 breaches of protected health information requiring notification under the Recovery Act. These breaches affected 13,775 beneficiaries, who were notified, but not to the extent the law requires. While CMS created a compromised-number database for contractors, the report found that the usefulness of the database could be improved.

The IG also found that contractors are inconsistent in developing edits to the database to prevent payments to people using numbers that have been compromised. CMS offers more remedies to providers than to beneficiaries who are affected by medical identity theft,  the IG found.
Among the report’s recommendations for CMS:

  • Ensure that security breach notifications meet the Recovery Act standards;
  • Improve the compromised number database;
  • Provide guidance to contractors using and making edits on the database;
  • Ensure victims of medical identity theft receive any services needed, and;
  • Develop a way to make sure beneficiaries affected by identity theft receive new identification numbers.

If CMS doesn’t follow the recommendations, the IG concludes,  “opportunities increase for medical identity theft and fraudulent billing of the Medicare program,” which will ultimately put providers, beneficiaries and the Medicare Trust Funds at risk.

Federal data breaches and how agencies disclose them has been a recurring topic in recent months. In September, the FBI had to publicly deny reports (ultimately proved false) that it had been breached by the hacker group Anonymous, resulting in the release of a million Apple user IDs.  And in August, the Environmental Protection Agency admitted its servers had been hacked in a breach that affected some 8,000 users – some five months after the incident had occurred. 

 

About the Author

Emily Cole is an editorial intern for FCW.

Featured

  • Telecommunications
    Stock photo ID: 658810513 By asharkyu

    GSA extends EIS deadline to 2023

    Agencies are getting up to three more years on existing telecom contracts before having to shift to the $50 billion Enterprise Infrastructure Solutions vehicle.

  • Workforce
    Shutterstock image ID: 569172169 By Zenzen

    OMB looks to retrain feds to fill cyber needs

    The federal government is taking steps to fill high-demand, skills-gap positions in tech by retraining employees already working within agencies without a cyber or IT background.

  • Acquisition
    GSA Headquarters (Photo by Rena Schild/Shutterstock)

    GSA to consolidate multiple award schedules

    The General Services Administration plans to consolidate dozens of its buying schedules across product areas including IT and services to reduce duplication.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.