Identity Theft

IG recommends ways to prevent Medicare fraud

Image of Medicare cardThe Centers for Medicare & Medicaid Services (CMS) can reduce the risk of security breaches, and therefore reduce the risk of medical identity theft, by taking five corrective actions, according to an inspector general’s report released earlier this month.

Daniel R. Levinson, IG for the Department of Health and Human Services, issued the report, which had two objectives:  to determine how closely the CMS’s notification to beneficiaries of security breaches matched up with legal standards established by the 2009 Recovery Act, and to assess CMS’s response to medical identity theft involving Medicare identification numbers.

Between September 23, 2009 and December 31, 2011, there were 14 breaches of protected health information requiring notification under the Recovery Act. These breaches affected 13,775 beneficiaries, who were notified, but not to the extent the law requires. While CMS created a compromised-number database for contractors, the report found that the usefulness of the database could be improved.

The IG also found that contractors are inconsistent in developing edits to the database to prevent payments to people using numbers that have been compromised. CMS offers more remedies to providers than to beneficiaries who are affected by medical identity theft,  the IG found.
Among the report’s recommendations for CMS:

  • Ensure that security breach notifications meet the Recovery Act standards;
  • Improve the compromised number database;
  • Provide guidance to contractors using and making edits on the database;
  • Ensure victims of medical identity theft receive any services needed, and;
  • Develop a way to make sure beneficiaries affected by identity theft receive new identification numbers.

If CMS doesn’t follow the recommendations, the IG concludes,  “opportunities increase for medical identity theft and fraudulent billing of the Medicare program,” which will ultimately put providers, beneficiaries and the Medicare Trust Funds at risk.

Federal data breaches and how agencies disclose them has been a recurring topic in recent months. In September, the FBI had to publicly deny reports (ultimately proved false) that it had been breached by the hacker group Anonymous, resulting in the release of a million Apple user IDs.  And in August, the Environmental Protection Agency admitted its servers had been hacked in a breach that affected some 8,000 users – some five months after the incident had occurred. 

 

About the Author

Emily Cole is an editorial intern for FCW.

Rising Stars

Meet 21 early-career leaders who are doing great things in federal IT.

Featured

  • SEC Chairman Jay Clayton

    SEC owns up to 2016 breach

    A key database of financial information was breached in 2016, possibly in support of insider trading, said the Securities and Exchange Commission.

  • Image from Shutterstock.com

    DOD looks to get aggressive about cloud adoption

    Defense leaders and Congress are looking to encourage more aggressive cloud policies and prod reluctant agencies to embrace experimentation and risk-taking.

  • Shutterstock / Pictofigo

    The next big thing in IT procurement

    Steve Kelman talks to the agencies that have embraced tech demos in their acquisition efforts -- and urges others in government to give it a try.

  • broken lock

    DHS bans Kaspersky from federal systems

    The Department of Homeland Security banned the Russian cybersecurity company Kaspersky Lab’s products from federal agencies in a new binding operational directive.

  • man planning layoffs

    USDA looks to cut CIOs as part of reorg

    The Department of Agriculture is looking to cut down on the number of agency CIOs in the name of efficiency and better communication across mission areas.

  • What's next for agency cyber efforts?

    Ninety days after the Trump administration's executive order, FCW sat down with agency cyber leaders to discuss what’s changing.

Reader comments

Tue, Oct 16, 2012 Kevin United States

From my understanding, victims of breaches and/or identity fraud will NOT receive a new Social Security number. Either way, the SSN should never have been used for identification in the first place because once that number is compromised, identity fraud is easy to commit. The Standard Patient Number (SPN) from TASCET is a much more effective approach to preventing identity fraud and the financial crimes that often result.

Tue, Oct 16, 2012 Bill

The government needs to learn to write better contracts. The statement in the article, "The IG also found that contractors are inconsistent in developing edits to the database..." is a dead give away that the government could do a better job. Agencies historically do not do a good job writing contracts. They leave too much to the contractor in the interest of saving money, then are amazed when they get what they pay for.

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group