CMS Found to Have Leaked Providers’ SSNs
A database created by the Centers for Medicare and Medicaid Services (CMS) has been exposed online, exposing providers’ Social Security numbers. The database can be downloaded, as it was by reporters at the Washington Post. The CMS created a new directory last year to help seniors find healthcare providers covered by insurance plans. The directory lists doctors and other healthcare providers who accept certain insurance plans, in an effort to improve transparency and access to care.
The database created by the CMS to power the provider directory has been found to be leaking some sensitive data. The data that populated the directory was found to contain the Social Security numbers of certain providers, which were linked to their names and other identifying information. The database was publicly accessible for several weeks, and while not immediately visible to individuals who visit the provider directory, it was possible to download the database.
The reporters searched the database and identified dozens of Social Security numbers by reviewing just a sample of rows. The CMS has notified and responded, saying it is working on a fix to resolve the issue that led to the data exposure. “[The problem] stems from incorrect entries of provider or provider-representative-supplied information in the wrong places,” explained the CMS. “The agency has taken steps to address it promptly and reinforce safeguards around data submission and validation”.
The explanation suggests that the exposed Social Security numbers are included in the database due to providers entering Social Security numbers into incorrect fields. The CMS did not confirm how many individuals have had their Social Security numbers exposed. Critics suggest that the rollout of the directory was rushed and that the project did not have sufficient oversight. Initially, when the directory was launched, providers were associated with incorrect health plans, with some pages confirming that a provider was covered by an insurance plan, while other pages said they were out of network.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
