The CMS has temporarily shut down access to its Blue Button 2.0 data-sharing tool after discovering a bug that may have exposed some beneficiary information.
The CMS suspended access to the Blue Button 2.0 API, or application programming interface, after a third-party app developer reported a "data anomaly" on Dec. 4. It's unclear when the service, which allows Medicare beneficiaries to share their claims data with third-party apps, will be restored, the agency shared in a blog post this week.
"Access to BB2.0 remains closed while we conduct a full review. Restoration of service is pending resolution of the issue," the CMS wrote.
Earlier this year, the CMS said more than two dozen organizations had launched Blue Button 2.0 apps for Medicare beneficiaries to download, such as programs to help users organize their medication lists.
The bug—a coding error that was added last year—may have inadvertently shared some beneficiaries' protected health information with an incorrect user or to an incorrect Blue Button 2.0 app.
"The technical issue is contained to less than 10,000 Blue Button authorized users and 30 authorized apps," a CMS spokesperson wrote in an emailed statement.
The CMS said it will notify affected beneficiaries and app developers about the issue in the coming weeks.
The CMS linked the privacy issue to Blue Button 2.0's process for identifying beneficiaries.
An identity management system assigns beneficiaries randomly generated user IDs to connect claims data to the correct third-party app. However, the Blue Button 2.0 tool was truncating user IDs to be shorter in length, which made them "not sufficiently random to uniquely identify a single user, " according to the CMS' blog post, leading the same shorted user IDs being assigned to multiple people.
That means any data exposure from the bug was contained to Blue Button 2.0 beneficiaries and developers, and does not involve intrusions by outside entities, according to the CMS.
"This issue only impacts BB2.0, not Plan Finder, Medicare.gov, or any other system," the CMS wrote. "We have not detected any intrusion by unauthorized users and system integrity has not been compromised by any external source."
News of the bug comes as the CMS and HHS' Office of the National Coordinator for Health Information Technology are working to finalize their companion interoperability proposals. The rules would require healthcare providers and insurers to allow patients to request their health data via APIs and third-party apps, raising privacy concerns among some provider groups.
