Although the CMS managed to notify the nearly 14,000 Medicare beneficiaries whose medical identities were stolen in a recent two-year period, the agency failed to meet legal requirements designed to minimize financial losses to the program, a government watchdog found.
The HHS inspector general's report (PDF)
issued Wednesday examined the 14 reported CMS security breaches from Sept. 23, 2009, to Dec. 31, 2011, resulting in the stolen medical identities of 13,775 Medicare beneficiaries. It found the agency failed to meet several legal requirements, including steps designed to stop payment for services linked to the stolen beneficiary numbers.
“If CMS does not follow the requirements for handling breaches, opportunities increase for medical identity theft and fraudulent billing of the Medicare program,” the report said.
In response, the agency promised to take several of the recommended steps to stem Medicare's losses.
Additionally, the CMS was found to offer some assistance to affected providers but less help to beneficiaries affected by medical identity theft. Provider assistance includes a program that helps them with financial liabilities incurred through beneficiary identity theft, such as overpayment demands and tax liabilities.
In addition to ensuring it meets statutory requirements designed to prevent payments to identity thieves, the report urged steps to reissue identification numbers and ensure identity theft victims continue to receive Medicare coverage. In response, the agency said it is “reviewing options and cost estimates for developing an identification number that is not based on the Social Security number.”
Although removal of Social Security numbers was required several years ago, Tony Trenkle, director of the Office of Information Services at the CMS said at an Aug. 1 House Ways and Means Health Subcommittee hearing
that a replacement was not expected until early 2013.
The Government Accountability Office reported
that 48 million Medicare beneficiaries are at risk for identity theft because their cards include their Social Security numbers.