OIG Report: CMS Not Perfect with Breach Notification Rules | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

OIG Report: CMS Not Perfect with Breach Notification Rules

October 12, 2012
by Gabriel Perna
| Reprints

According to a recent audit by the Department of Health & Human Services' Office of the Inspector General (OIG), the Centers for Medicare and Medicaid Services (CMS) could improve the database in which it lists all of the breaches of protected health information is has had since 2009. Also, while CMS did notify 13,775 Medicare beneficiaries affected by the breaches, it did not meet several American Recovery and Reinvestment Act (ARRA) requirements.

The study, from OIG, looked at how effective CMS has been in notifying the affected Medicare beneficiaries when their protected health information has been breached, as required by the ARRA. The audit looked to determine the extent to which CMS’ response met the notification requirements in the ARRA by looking at its response to medical identity theft involving beneficiary and provider Medicare identification numbers and the remedies it offers to beneficiaries and providers.

The audit found that between Sept. 23, 2009 and Dec. 31, 2011, CMS reported 14 breaches. While it did make progress in responding to medical identity theft by developing a compromised number database for contractors, it failed on several requirements. Along with the database, it did not consistently develop edits to stop payments on compromised numbers. Also, the audit’s authors say CMS offers some remedies to providers but fewer to beneficiaries affected by medical identity theft.

For its recommendations, OIG recommended CMS ensure that breach notifications meet Recovery Act requirements, improve the compromised number database, and provide guidance to contractors about using database information and implementing edits. It also recommended CMS develop a method for ensuring that beneficiaries who are victims of medical identity theft retain access to needed services and one for reissuing identification numbers to beneficiaries affected by medical identity theft.



Dignity Health, CHI Merging to Form New Catholic Health System

Catholic Health Initiatives (CHI), based in Englewood, Colorado, and San Francisco-based Dignity Health officially announced they are merging and have signed a definitive agreement to combine ministries and create a new, nonprofit Catholic health system.

HHS Announces Winning Solutions in Opioid Code-a-Thon

The U.S. Department of Health and Human Services (HHS) hosted this week a first-of-its-kind two-day Code-a-Thon to use data and technology to develop new solutions to address the opioid epidemic.

In GAO Report, More Concern over VA VistA Modernization Project

A recent Government Accountability Office (GAO) report is calling into question the more than $1 billion that has been spent to modernize the Department of Veterans Affairs' (VA) health IT system.

Lawmakers Introduce Legislation Aimed at Improving Medicare ACO Program

U.S. Representatives Peter Welch (D-VT) and Rep. Diane Black (R-TN) have introduced H.R. 4580, the ACO Improvement Act of 2017 that makes changes to the Medicare accountable care organization (ACO) program.

Humana Develops Medication Management Tool

A new tool developed by Humana enables the company’s members to keep a list of their medications in one place.

Four Hospitals Piloting OurNotes Initiative in 2018

Beginning in January, four academic hospitals—Beth Israel Deaconess Medical Center in Boston, University of Washington in Seattle, Dartmouth-Hitchcock Medical Center in Lebanon, New Hampshire and University of Colorado in Boulder—will begin piloting a new digital tool called OurNotes that enables patients to contribute to their clinical notes.