Department of Health and Human Services 
OFFICE OF 
 
INSPECTOR GENERAL 
 
 
 
 
 
 
 
 
CMS R
    ESPONSE TO 
 
B  
  REACHES AND 
 
M I T  
EDICAL  DENTITY  HEFT
 
Daniel R. Levinson  
Inspector General 
 
October 2012 
OEI-02-10-00040   
   
CMS RESPONSE TO BREACHES AND MEDICAL IDENTITY THEFT 
OEI-02-10-00040 
 
 
WHY WE DID THIS STUDY  
 
The Centers for Medicare & Medicaid Services (CMS) maintains the protected health 
information of millions of Medicare beneficiaries.  If a breach occurs and the security or 
privacy of this information is compromised, CMS is required by the American Recovery 
and Reinvestment Act (the Recovery Act) to notify the affected beneficiaries.  Such 
breaches can lead to medical identity theft.  Medical identity theft is the appropriation or 
misuse of a patients or a providers medical identifying information (such as a Medicare 
identification number) to fraudulently obtain or bill for medical care.  It can create patient 
safety risks and impose financial burdens on those affected.  Medical identity theft may 
also lead to significant financial losses for the Medicare Trust Funds and taxpayers.  
 
HOW WE DID THIS STUDY 
 
We determined the extent to which CMSs response to breaches met the notification 
requirements in the Recovery Act.  We also assessed CMSs response to medical identity 
theft involving beneficiary and provider Medicare identification numbers and the 
remedies it offers to beneficiaries and providers.  We based this study on CMS data on 
breaches, CMS policies and procedures, CMSs compromised number database, and 
structured interviews with CMS staff and benefit integrity contractors.  
 
WHAT WE FOUND 
 
CMS reported that it had 14 breaches of protected health information requiring 
notification under the Recovery Act between September 23, 2009, and December 31, 
2011.  CMS notified the 13,775 Medicare beneficiaries affected by the breaches, but did 
not meet several Recovery Act requirements.  CMS has made progress in responding to 
medical identity theft by developing a compromised number database for contractors.  
However, the databases usefulness could be improved.  Further, contractors do not 
consistently develop edits to stop payments on compromised numbers.  Lastly, CMS 
offers some remedies to providers but fewer to beneficiaries affected by medical identity 
theft.  
 
WHAT WE RECOMMEND 
 
We recommend that CMS:  (1) ensure that breach notifications meet Recovery Act 
requirements, (2) improve the compromised number database, (3) provide guidance to 
contractors about using database information and implementing edits, (4) develop a 
method for ensuring that beneficiaries who are victims of medical identity theft retain 
access to needed services, and (5) develop a method for reissuing identification numbers 
to beneficiaries affected by medical identity theft.  CMS concurred with all but the draft 
reports fourth recommendation, which we revised as stated above. 
   
   
 
TABLE OF CONTENTS 
 
Objectives ....................................................................................................1 
Background ..................................................................................................1 
Methodology ................................................................................................4 
Findings........................................................................................................7 
CMS had 14 breaches requiring notification under the  
Recovery Act ....................................................................................7 
CMS notified beneficiaries of the breaches, but did not meet  
several Recovery Act requirements .................................................8 
CMS has made progress in responding to medical identity theft  
by developing a compromised number database for contractors .....9 
CMS contractors do not consistently develop edits to stop 
payments on compromised numbers .............................................. 11 
CMS offers some remedies to providers but fewer to  
beneficiaries affected by medical identity theft .............................12 
Conclusion and Recommendations ............................................................14 
Agency Comments and Office of Inspector General Response .....16 
Appendix:  Agency Comments ..................................................................17 
Acknowledgments......................................................................................21 
 
   
   
OBJECTIVES 
1.  To determine the extent to which the Centers for Medicare & Medicaid 
Services (CMS) response to breaches of beneficiaries protected 
health information met the notification requirements in the American 
Recovery and Reinvestment Act of 2009 (the Recovery Act). 
2.  To assess CMSs response to medical identity theft involving 
beneficiary and provider Medicare identification numbers and the 
remedies it offers to beneficiaries and providers. 
BACKGROUND  
CMS maintains the protected health information of millions of Medicare 
beneficiaries, storing, receiving, and transmitting it daily.1  If CMS has a 
breach of unsecured (or unencrypted) protected health information, it is 
required by the Recovery Act to notify the affected beneficiaries.2  A 
breach is defined by the Recovery Act as the unauthorized acquisition, 
access, use, or disclosure of protected health information which 
compromises the security or privacy of such information.3  Breaches of 
health information can lead to medical identity theft. 
Medical identity theft is the appropriation or misuse of a patients or a 
providers medical identifying information (such as a Medicare 
identification number) to fraudulently obtain or bill for medical care, 
prescription drugs, or supplies.  It can affect beneficiaries or providers.  
Such theft can create patient safety risks and impose financial burdens on 
those affected.  It can lead to erroneous entries in beneficiaries medical 
histories and even to the wrong medical treatment.  Medical identity theft 
may also lead to significant financial losses for the Medicare Trust Funds 
and taxpayers. 
In previous reports, the Office of Inspector General (OIG) and the 
Government Accountability Office (GAO) identified gaps and weaknesses 
 
1
 The phrase protected health information is defined by regulation to mean, with some 
exceptions, identifying information created or received by an employer or a health care entity 
that relates to an individuals physical or mental health condition and is transmitted or 
maintained in any medium.  See 45 CFR  160.103. 
2
 While CMS also maintains the health information of Medicaid beneficiaries, which is 
subject to Recovery Act breach notification requirements, this report is limited to breaches of 
Medicare information. 
3
 The Recovery Act, P.L. 111-5  13400(1).  Title XIII of the Recovery Act is also referred to 
as the Health Information Technology for Economic and Clinical Health Act, or the HITECH 
Act.  The Department of Health and Human Services (HHS) implemented the breach 
notification requirements at 45 CFR Pt. 164, subpart D. 
CMS Response to Breaches and Medical Identity Theft (OEI-02-10-00040)  1 
   
   
in the information security procedures of CMS and its contractors.4  To 
date, no evaluation has examined CMSs breach notification procedures or 
determined how many breaches involving beneficiaries protected health 
information have occurred.  There has also been no evaluation of CMSs 
efforts to respond to medical identity theft involving Medicare beneficiary 
or provider identification numbers. 
Breach Notification 
The Recovery Act requires covered entitiessuch as health care providers 
and plansand their business associates to notify an individual whose 
unsecured protected health information5 has been or is reasonably 
believed to have been accessed, acquired, or disclosed as a result of a 
breach.6  An example of a breach that would require notification under the 
Recovery Act is the loss of a CMS laptop containing unencrypted 
Medicare beneficiary identification numbers. 
The Recovery Act requirements became effective on September 23, 2009.7  
As a covered entity, CMS is subject to these requirements.8  CMSs 
contractors are considered business associates9 and are required to inform 
CMS of any breaches and provide the information necessary for CMS to 
make the required notifications to affected individuals.10   
The notification requirements pertain to breaches of beneficiaries 
protected health information; provider Medicare identification numbers 
are not covered by the Recovery Act notification requirements.  These 
numbers are not protected health information because they do not relate 
to the providers health status. 
The Recovery Act requires that notification to each affected individual 
include: 
  a description of what happened, including the dates of both the 
breach and its discovery, if known; 
  the type(s) of unsecured protected health information involved; 
 
4
 OIG, Review of Medicare Contractor Information Security Program Evaluations for Fiscal 
Year 2009, A-18-10-30300, September 2011.  GAO, Information Security:  Department of 
Health and Human Services Needs to Fully Implement Its Program, GAO-06-267, 
February 2006. 
5
 Unsecured protected health information is protected health information that has not been 
rendered unusable, unreadable, or indecipherable to unauthorized individuals using methods 
approved by the Secretary. 
6
 The Recovery Act  13402 and 13404; see also 45 CFR  164.404(a) and 164.410. 
7
 74 Fed. Reg. 42740 (Aug. 24, 2009).  Publication of the final rule is pending. 
8
 45 CFR  160.103; CMS Program Memorandum, Transmittal AB-03-034 (February 28, 
2003). 
9
 CMS Program Memorandum, Transmittal AB-03-034 (February 28, 2003). 
10
 The Recovery Act  13402(b); 45 CFR  164.410. 
CMS Response to Breaches and Medical Identity Theft (OEI-02-10-00040)  2 
   
   
  steps individuals should take to protect themselves from potential 
harm; 
  a description of how the covered entity is investigating the breach, 
mitigating losses, and protecting against further breaches; and 
  contact procedures for individuals who want to learn more.11 
In general, affected individuals must be notified by first-class mail, 
without unreasonable delay, and no more than 60 days after the breach 
has been discovered.12 
In addition, covered entities must notify HHS of any breaches not later 
than 60 days after the end of the calendar year during which the breach 
occurred.13  HHS must in turn identify the covered entity involved in the 
breach on its Web site.14  If any breach affects 500 or more residents of a 
State or jurisdiction, the covered entity must also notify prominent media 
outlets in the area.15  The notification to media outlets must contain the 
same information as the notification to individuals.16  In these cases, 
notification must also be provided to HHS contemporaneously with 
individual notification.17   
Medical Identity Theft 
Breaches may lead to medical identity theft.  Medical identity theft is the 
misuse of provider or beneficiary medical identifying information.  An 
example of medical identity theft occurs when someone obtains 
unencrypted Medicare identification numbers of beneficiaries and uses 
them to submit false claims to CMS.  This is against Federal law, which 
prohibits using another persons identification to make false statements 
when seeking payment under a Federal health care program.18 
CMS Contractors 
CMS relies on contractors to review and pay claims.  These contractors 
maintain the protected health information of Medicare beneficiaries as part 
of their duties.  As business associates of CMS, they are required by the 
Recovery Act to inform the agency if they commit any breaches of this 
information.  They are also involved in CMSs efforts to identify and 
 
11
 The Recovery Act  13402(f); 45 CFR  164.404(c). 
12
 The Recovery Act  13402(d)(1) and 13402(e)(1); 45 CFR  164.404.  Section 13402(g) 
of the Recovery Act allows for a delay of notification for law enforcement purposes. 
13
 The Recovery Act  13402(e)(3); 45 CFR  164.408(c). 
14
 The Recovery Act  13402(e)(4). 
15
 The Recovery Act  13402(e)(2); 45 CFR  164.406(a). 
16
 45 CFR  164.406(c). 
17
 45 CFR  164.408. 
18
 18 U.S.C.  1028A(a) and 42 U.S.C.  1320a7b. 
CMS Response to Breaches and Medical Identity Theft (OEI-02-10-00040)  3 
   
   
respond to medical identity theft involving Medicare beneficiary or 
provider information. 
Contractors have a range of duties.  Zone Program Integrity Contractors 
(ZPIC) conduct Part A- and Part B-related benefit integrity activities.19  
They recommend claims processing edits to suspend or deny potentially 
improper payments, including those that result from medical identity theft.  
They are also responsible for identifying and investigating potential fraud. 
Medicare Drug Integrity Contractors (MEDIC) conduct Part C- and 
Part D-related benefit integrity activities.20  Their work includes analyzing 
Part D prescription claims data and reviewing beneficiary complaints to 
prevent the payment of fraudulent claims.  They recommend appropriate 
administrative actions to CMS, which may include denying or recouping 
fraudulent payments.  Hereinafter, we refer to the MEDICs and ZPICs 
collectively as benefit integrity contractors. 
Compromised Number Database 
CMSs compromised number database, first released in February 2010, 
contains beneficiaries and providers Medicare identification numbers that 
have been involved in, or are suspected of having been involved in, 
medical identity theft and those that are vulnerable to medical identity 
theft.  Medicare identification numbers of beneficiaries are also known as 
Health Insurance Claim numbers.  In this report, we refer to Medicare 
identification numbers of beneficiaries as beneficiary numbers.  
Medicare identification numbers of providers are also known as National 
Provider Identifiers.  In this report, we refer to Medicare identification 
numbers of providers as provider numbers. 
METHODOLOGY 
This study is based on several data sources:  (1) CMS data on breaches, 
(2) CMS breach policies and procedures, (3) CMSs compromised number 
database, and (4) structured interviews with CMS staff and benefit 
integrity contractors. 
Review of CMS Data on Breaches  
We requested data from CMS on the number of breaches that occurred 
between September 23, 2009 (when the Recovery Act notification 
requirements became effective), and December 31, 2011.  We considered a 
breach committed by CMS or by any of CMSs contractors acting in their 
 
19
 ZPICs are assuming the role formerly held by Program Safeguard Contractors.  Five ZPICs 
were operating and two zones were transitioning at the time of our review. 
20
 One MEDIC focuses on benefit integrity and its work consists primarily of claims analysis 
and investigations.  The other MEDIC handles compliance and enforcement issues. 
CMS Response to Breaches and Medical Identity Theft (OEI-02-10-00040)  4 
   
   
capacity as business associates to be a CMS breach.  We analyzed the data 
to enumerate and describe the breaches known by CMS to have occurred 
within the specified time period. 
Review of CMS Policies and Procedures Regarding Breaches  
We requested from CMS its policies and procedures for responding to 
breaches.  We also requested documentation on how CMS responded to 
breaches that occurred after the Recovery Act went into effect, September 
23, 2009, through December 31, 2011.  This documentation included the 
notifications CMS provided to affected individuals. 
We reviewed CMSs policies and procedures to determine how CMS 
responds to breaches.  We also reviewed the notifications CMS provided 
to affected individuals to determine the extent to which CMS met 
Recovery Act requirements.  We determined whether the notifications 
included a description of what happened, including the dates of both the 
breach and its discovery; the type(s) of unsecured protected health 
information involved; steps individuals should take to protect themselves 
from potential harm; a description of how the covered entity is 
investigating the breach, mitigating losses, and protecting against further 
breaches; and contact procedures for individuals who want to learn more.  
We also determined whether CMS provided the notifications within 
60 days of the breaches discovery, as required by the Recovery Act. 
Review of Database Containing Compromised Medicare 
Identification Numbers 
We requested and analyzed the database of compromised beneficiary and 
provider numbers that CMS maintains.  We reviewed the February 2012 
version of the database.   
Structured Interviews With CMS Staff and Benefit Integrity 
Contractors 
We conducted structured interviews with key CMS staff responsible for 
developing and implementing policies and procedures regarding breaches 
and medical identity theft.  We asked how CMS identifies and responds to 
breaches and instances of medical identity theft, including what remedies 
are available for affected beneficiaries and providers.   
In addition, we interviewed staff from CMSs benefit integrity contractors 
(five ZPICs that were operating at the time of our review and the two 
MEDICs).  We asked them how they identify and respond to instances of 
medical identity theft involving Medicare identification numbers.  We also 
asked how they use CMSs compromised number database.  Further, we 
inquired about remedies available to beneficiaries and providers affected 
by medical identity theft. 
CMS Response to Breaches and Medical Identity Theft (OEI-02-10-00040)  5 
   
   
Limitations 
This study was limited to breaches known to CMS that required 
notification under the Recovery Act.  The findings are based on an 
analysis of CMS data.  We did not independently determine whether there 
were additional breaches. 
Standards 
This study was conducted in accordance with the Quality Standards for 
Inspection and Evaluation issued by the Council of the Inspectors General 
on Integrity and Efficiency. 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
CMS Response to Breaches and Medical Identity Theft (OEI-02-10-00040)  6 
   
   
FINDINGS 
CMS had 14 breaches requiring notification under the 
Recovery Act 
Over a 2-year period, between September 23, 2009, and December 31, 
2011, CMS had 14 breaches that, by its own determination, required 
notification of the affected individuals under the Recovery Act.  As a 
covered entity, CMS must provide notification if it reasonably believes the 
information has been accessed, acquired, used, or disclosed as a result of a 
breach.21  CMS considers several factors when making this determination, 
including the nature of the data elements breached and the likelihood that 
the information is accessible and usable. 
In general, CMSs breaches involved beneficiaries names, Medicare 
identification numbers, dates of birth, diagnoses, and services received.  In 
total, 13,775 Medicare beneficiaries were affected by the 14 breaches 
requiring notification.  One breach affected 13,412 beneficiaries.  This 
breach involved a Medicare Summary Notice printing error by a CMS 
contractor, which caused the notices to be sent to incorrect addresses.  Ten 
breaches resulted from other mismailing or from loss of documents during 
transit.  In another two breaches, beneficiary information was posted 
online.  In the remaining breach, a CMS contractor employee was arrested 
for stealing beneficiary information.  See Table 1 for more details about 
the 14 breaches. 
 
Table 1:  Breaches Requiring Notification, Reported by CMS                                                                  
(From September 23, 2009, Through December 31, 2011)  
Number of   Number of Affected 
Type of Breach 
Breaches  Beneficiaries 
Medicare Summary Notice printing error  1  13,412 
Beneficiary information posted online  2  190 
Mismailings or loss during transit  10  165 
Stolen beneficiary information  1  8 
     Total  14  13,775 
Source:  OIG analysis of CMS data on breaches requiring notification under the Recovery Act, 2012. 
 
21
 45 CFR  164.404(a). 
CMS Response to Breaches and Medical Identity Theft (OEI-02-10-00040)  7 
   
   
CMS notified beneficiaries of the breaches, but did not 
meet several Recovery Act requirements 
Although CMS notified all beneficiaries affected by the 14 breaches, it 
failed to meet the Recovery Acts standard for timeliness for 7 of them.  
Notification letters for these breaches were not sent to the beneficiaries 
within the timeframe dictated by the Recovery Act (without unreasonable 
delay and in no case later than 60 days after the date of discovery).22  
Notifications for some breaches were sent 4 days after the 60-day 
timeframe, while others were sent more than 4 months after the 60 days.  
Notification letters for the largest breach were sent within the required 
timeframe. 
The notifications for these breaches often were missing required 
information.  Notably, the notification letters for six of the breaches did 
not explain how the contractors were investigating the breach, mitigating 
losses, or protecting against further breaches, as required by the Recovery 
Act.  Moreover, notification letters for half the breaches, including the 
largest breach, were missing either the date the breach occurred or the date 
it was discovered.  Notification letters for three breaches did not include 
the types of unsecured protected health information involved, contact 
procedures for individuals who want to learn more, or steps individuals 
can take to protect themselves from harm.  See Table 2. 
 
Table 2:  CMS Breaches and Recovery Act Notification Requirements 
Number of  Breaches Not 
Recovery Act Notification Requirement 
Meeting Requirement  
Notification within 60 days of breachs discovery  7 
Description of breach investigation, loss mitigation, 
6 
and protection against further breaches 
Date breach occurred or was discovered  7 
Information involved, contact procedures, or steps 
3 
to protect from harm 
Source:  OIG analysis of CMS data on breaches requiring notification under the Recovery Act, 2012. 
 
CMS informed HHS of all 14 breaches within the required timeframes.  In 
addition, CMS provided timely notice to the media for the largest breach, 
as required for breaches affecting 500 or more residents of a State or 
jurisdiction.  Although this breach affected individuals in 9 States, the 
impact was concentrated in Tennessee, which was home to over 13,000 of 
 
22
 45 CFR  164.404(b) and 164.410(b). 
CMS Response to Breaches and Medical Identity Theft (OEI-02-10-00040)  8 
   
   
the affected individuals.  Accordingly, CMS notified media outlets in 
Tennessee only.  HHS also posted notice of the breach on its Web site.  
However, the media notification regarding this breach neglected to include 
steps that individuals should take to protect themselves from harm.  
CMS has made progress in responding to medical 
identity theft by developing a compromised number 
database for contractors 
Medical identity theft is the misuse of medical identifying information, 
such as beneficiary numbers and provider numbers, to fraudulently obtain 
or bill for medical services or supplies.  CMSs response to medical 
identity theft has centered on maintaining a database of compromised 
beneficiary and provider numbers.  The database contains numbers that 
have been involved in, or are suspected of having been involved in, 
medical identity theft and those that are vulnerable to medical identity 
theft.  As of February 2012, the database contained the Medicare numbers 
of almost 284,000 beneficiaries and 5,000 providers.  The database also 
includes classifications that indicate the level of risk associated with each 
compromised number.  Numbers are classified as high, medium, or low 
risk.23  The majority of the numbers in the database were classified as 
medium risk.  See Table 3 for a summary of the risk-level information in 
the database. 
 
Table 3:  Compromised Numbers as Reported by CMS, by Risk Level  
Medicare  Medicare 
Risk Level 
Beneficiaries   Providers  
 High  56,164  1,383 
Medium  213,792  3,547 
Low  13,616  32 
     Total  283,572  4,962 
 
Source:  OIG analysis of CMS compromised number database, February 2012 version.
 
The beneficiary and provider numbers in the database come from CMSs 
benefit integrity contractors.  These contractors identify the numbers 
 
23
 High-risk numbers have been confirmed as compromised.  For instance, a beneficiary 
number is considered high risk if at least one inappropriate service was billed with it.  
Numbers categorized as low risk have been identified as potentially compromised.  For 
instance, a beneficiary number is considered low risk if the beneficiary reported the loss of his 
or her Medicare card.  Medium-risk numbers are strongly suspected of having been 
compromised. 
CMS Response to Breaches and Medical Identity Theft (OEI-02-10-00040)  9 
   
   
through claims analysis and complaint investigations and send them to 
CMS monthly.24  CMS consolidates this information into a database and 
sends it to each contractor on a compact disk once a month.  CMS also 
incorporates the database into its predictive modeling initiative.25  The 
goal of this initiative is to identify unusual billing activity and establish 
risk scores to identify claims for review before payment is made. 
Opportunities exist for improving the databases usefulness 
CMS has provided benefit integrity contractors with technical guidance 
about how to submit beneficiary and provider numbers and additional 
information to the compromised number database.  However, CMS has 
not issued guidance to contractors about how to incorporate database 
information into their benefit integrity activities. 
As a result, benefit integrity contractors use the database in different ways.  
Some contractors use it to discover numbers that they did not know were 
compromised.  These contractors routinely compare all the compromised 
numbers in the database to the beneficiary and provider numbers on 
claims that have been submitted in their area.  In contrast, one contractor 
compares only beneficiary and provider numbers it is investigating to 
numbers in the database.  In both cases, if contractors find a match, they 
investigate further. 
Further, benefit integrity contractors rarely use information in the database 
other than the numbers.  In fact, one contractor was not aware that the 
database contained other information, such as the date the number was 
added to the database or edits associated with the number.   
Benefit integrity contractors also noted that information can be difficult to 
find in the database.  For example, a field in the database that is supposed 
to contain the reason that numbers were added to the database was blank 
for 75 percent of the high-risk beneficiary numbers and 62 percent of 
high-risk provider numbers.  Knowing the reason a number is considered 
compromised can assist contractors in their investigations. 
Some contractors characterized the database as not user friendly.  They 
described the interface as cumbersome and ill-suited to the databases high 
volume of information.  One contractor noted that the database seems to 
have been designed to facilitate investigations of individual cases, whereas 
benefit integrity contractors focus on large-scale data analysis.  
 
24
 All ZPICs are required to report information for the database.  The benefit integrity MEDIC 
began doing so in July 2010.  The compliance and enforcement MEDIC is not required to 
report information for inclusion in the database. 
25
 This initiative grew out of legislation that required CMS to use predictive modeling.  See 
Small Business Jobs Act of 2010, P.L. 111-240  4241; 42 U.S.C.  1320a-7m. 
CMS Response to Breaches and Medical Identity Theft (OEI-02-10-00040)  10 
   
   
Contractors also commonly noted that the database does not meet their 
need for up-to-date data.  Several said that they would like the database to 
be available in real time, instead of being distributed monthly. 
In addition, some contractors have concerns about the quality of the 
information in the database.  These contractors noted that they place 
minimal weight on database information mainly because they believe that 
other contractors standards for categorizing numbers differ from their 
own. 
CMS contractors do not consistently develop edits to 
stop payments on compromised numbers 
Most benefit integrity contractors cited claims processing edits as a 
powerful tool against medical identity theft.  When a contractor develops 
an edit for a compromised beneficiary or provider number, the contractor 
can deny claims that contain that number or identify claims for further 
scrutiny.26 
Contractors vary in the extent to which they develop edits for 
compromised numbers.  They also differ in the types of edits that they 
develop.  One contractor focused its edits exclusively on provider 
numbers.  This contractor did not develop edits for beneficiary numbers at 
all.  In contrast, other contractors noted that they routinely develop edits 
for individual beneficiary numbers.  Another contractor developed only 
autodenial edits, which automatically deny claims using predetermined 
criteria.  Other contractors make extensive use of prepay edits, which 
identify claims for individual review prior to payment. 
Contractors reported that they consider potential consequences when 
deciding whether to develop edits.  For instance, contractors do not want 
to limit access to needed services for a beneficiary whose number has been 
stolen.  Taking this into account, a contractor may put edits in place for 
certain types of services, such as durable medical equipment, but may 
allow other services, such as emergency room visits.  Another 
consequence is that edits can conflict with criminal investigations, as 
payment delays and claim denials can tip off fraudulent billers.  Law 
enforcement agencies might request that contractors refrain from 
developing an edit so that law enforcement can track claims and build a 
criminal case.  In these instances, contractors can work with law 
enforcement to come to an agreement on when to stop claim payments. 
 
26
 For Medicare Part C and Part D, private plans are responsible for developing and 
implementing edits. 
CMS Response to Breaches and Medical Identity Theft (OEI-02-10-00040)  11 
   
   
CMS offers some remedies to providers but fewer to 
beneficiaries affected by medical identity theft 
Providers and beneficiaries affected by medical identity theft are 
susceptible to adverse financial and Medicare benefit-related 
consequences if their numbers are misused.  For example, providers can 
be subject to tax liabilities and requests for reimbursement of Medicare 
payments for claims that they did not submit.  For beneficiaries, claims 
resulting from the misuse of their numbers may count toward Medicare 
caps that limit services and medical devices that they are eligible to 
receive.  For instance, outpatient therapy is subject to Medicare benefit 
caps.27 
CMS has taken some steps to assist providers affected by 
medical identity theft 
CMS has implemented a Provider Victim Validation/Remediation 
Initiative, which establishes protocols for assisting legitimate providers 
who have incurred Medicare financial liabilities, such as overpayment 
demands and tax liabilities, because of identity theft.  Such situations can 
occur, for example, if an individual with access to provider information 
fraudulently bills Medicare and redirects Medicare payments to himself or 
herself. 
Providers who have suffered financial liabilities are told to contact benefit 
integrity contractors.  The contractors conduct investigations and send the 
results to CMS.  CMS then decides whether to relieve the providers of the 
liabilities.  Another remedy available to providers is the assignment of new 
Medicare identification numbers. 
CMS offers few remedies for beneficiaries affected by medical 
identity theft 
Medicare beneficiaries who suspect fraud or identity theft are encouraged 
to call the 1-800-MEDICARE hotline.28  Hotline representatives refer 
suspected fraud to a benefit integrity contractor for further investigation.  
The contractor determines whether the beneficiary number should be 
added to the compromised number database.  According to CMS officials, 
the contractor must acknowledge to the beneficiary that the complaint was 
 
27
 CMS, Medicare Claims Processing Manual, Pub. No. 100-04, ch. 5,  10.2. 
28
 CMS, Protecting Medicare and You from Fraud, Pub. No. 10111, October 2011, p. 5. 
Accessed at https://www.medicare.gov/Publications/Pubs/pdf/10111.pdf on June 21, 2012. 
Also, OIG has created a brochure containing tips on how to avoid medical identity theft and 
instructions for reporting Medicare fraud and medical identity theft.  Accessed at 
http://oig.hhs.gov/fraud/medical-id-theft/OIG_Medical_Identity_Theft_Brochure.pdf on 
June 21, 2012. 
CMS Response to Breaches and Medical Identity Theft (OEI-02-10-00040)  12 
   
   
received but does not provide details to beneficiaries when a case is under 
investigation.   
Beneficiaries with compromised numbers are not routinely assigned new 
numbers.  Several benefit integrity contractors expressed a desire for CMS 
to terminate and issue new beneficiary numbers, citing the credit card 
industry as a model.  According to most contractors, new beneficiary 
numbers would minimize the damage caused by medical identity theft.  
One contractor noted that assigning new numbers would greatly assist 
beneficiaries because resolving issues associated with a compromised 
number can be time consuming and financially draining for the 
beneficiaries. 
One obstacle to assigning new numbers is that beneficiary numbers are 
linked to Social Security numbers.  The Social Security Administration 
OIG has encouraged CMS to eliminate Social Security numbers from 
beneficiaries Medicare numbers.29  CMS officials, however, have cited 
high costs, the volume of changes, and operational and systems issues as 
barriers to altering beneficiary numbers.30 
Further, there is no standard procedure for ensuring that beneficiaries 
retain their access to services if their Medicare numbers have been 
misused by others.  If a beneficiarys number is misused, a claim for a 
service or an item resulting from the misuse is included in the 
beneficiarys Medicare billing history.  This could delay or prevent 
beneficiaries from receiving needed services, particularly when these 
services are subject to a cap. 
 
 
 
   
 
29
 Social Security Administration OIG, Removing Social Security Numbers from Medicare 
Cards, A-08-08-18026, May 2008. 
30
 Part C and Part D plans generate their own identification numbers for enrollees that are 
different from the Social Security numbers. 
CMS Response to Breaches and Medical Identity Theft (OEI-02-10-00040)  13 
   
   
CONCLUSION AND RECOMMENDATIONS 
As the single largest health care payer in the United States, CMS plays a 
critical role in addressing breaches of protected health information and 
medical identity theft.  Breaches and medical identity theft put 
beneficiaries, providers, and the Medicare Trust Funds at risk.  If CMS 
does not follow the requirements for handling breaches, opportunities 
increase for medical identity theft and fraudulent billing of the Medicare 
program.   
CMS reported that it had 14 breaches requiring notification under the 
Recovery Act between September 23, 2009, and December 31, 2011.  
CMS notified the 13,775 beneficiaries affected by the breaches, but did 
not meet several Recovery Act requirements.     
CMS has made progress in responding to medical identity theft by 
developing a compromised number database for contractors.  However, 
the databases usefulness could be improved.  CMS has not issued 
guidance to contractors about how to incorporate database information 
into their benefit integrity activities, and as a result, contractors use the 
database in different ways.  Also, contractors do not consistently develop 
edits to stop payments on compromised numbers.  Lastly, CMS offers 
some remedies to providers but fewer to beneficiaries affected by medical 
identity theft.  
We recommend that CMS: 
Ensure That Breach Notifications Meet Recovery Act 
Requirements  
CMS should ensure that breach notifications are sent within the required 
timeframe and include the required information.  Notifications must 
include a description of how CMS is investigating the breach, mitigating 
losses, and protecting against further breaches.  They must also include a 
description of what happened, the type of information involved, steps 
individuals should take to protect themselves, and contact procedures for 
individuals who want to learn more. 
Improve the Compromised Number Database  
CMS should solicit input from the benefit integrity contractors and 
improve the completeness and quality of the database.  CMS should also 
make the database more user friendly, moving away from monthly 
mailings to a system that would allow for timelier reporting and access.  
Improving the database would enable contractors to use it more 
extensively to better detect and deter medical identity theft.   
CMS Response to Breaches and Medical Identity Theft (OEI-02-10-00040)  14 
   
   
Provide Guidance to Contractors About Using Database 
Information and Implementing Edits  
We recognize that CMS uses database information in its predictive 
modeling initiative.  In addition, CMS should provide guidance to 
contractors about how to incorporate database information into their 
benefit integrity activities.  CMS should also provide contractors with 
protocols for developing edits for compromised numbers.  These protocols 
should outline the circumstances that warrant edits and the types of edits 
that are most appropriate for compromised provider and beneficiary 
numbers.  These protocols could help promote consistent use of edits 
across contractors. 
Develop a Method for Ensuring That Beneficiaries Who Are 
Victims of Medical Identity Theft Retain Access to Needed 
Services 
CMS should mitigate the damage of medical identity theft by ensuring that 
beneficiaries retain their access to services if their Medicare numbers have 
been misused by others.  Misuse of a beneficiarys number could delay or 
prevent that beneficiary from receiving needed services, particularly when 
the services are subject to a cap.  CMS could insert an indicator in the 
beneficiary claim record that would exclude certain claims from frequency 
and utilization edits, allowing for payment of legitimate claims for victims 
of medical identity theft.  CMS could also develop other methods for 
providing assurances and documentation to these beneficiaries that their 
access to services will not be restricted as a consequence of the theft. 
Develop a Method for Reissuing Identification Numbers to 
Beneficiaries Affected by Medical Identity Theft 
The issuance of new Medicare beneficiary numbers is complex.  We 
recognize that there is no easy solution to this problem, given that 
beneficiaries Medicare numbers currently are linked to their Social 
Security numbers.  However, CMS should explore different options and 
then develop a method for reissuing Medicare numbers to beneficiaries 
affected by medical identity theft.   
 
 
 
 
 
 
 
CMS Response to Breaches and Medical Identity Theft (OEI-02-10-00040)  15 
   
   
AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 
RESPONSE 
CMS concurred with four of the five recommendations in the draft report.  
With regard to the first recommendation, CMS concurred and stated that it 
will develop new procedures and/or modify existing ones to improve the 
breach notification process.  With regard to the second recommendation, 
CMS concurred and is working with system users to both identify 
improvements to design a more user-friendly database and add critical 
information about each compromised number to support fraud detection 
efforts.  CMS is also developing a Web-based interface that will allow 
direct access by users.  CMS also concurred with our third 
recommendation and stated that it has issued instructions and guidance to 
contractors regarding updating, entering, and redefining entries in the 
database.  Also, CMS intends to share edit development best practices for 
compromised numbers and issue edit development protocols. 
CMS did not concur with the fourth recommendation in the draft report to 
correct beneficiary billing histories.  CMS cited concerns that changing 
billing records could negatively impact criminal and civil prosecutions and 
the integrity of the Medicare claims processing system.  However, CMS 
stated that it will consider the insertion of an indicator on the beneficiary 
claim record that would allow for payment of legitimate claims for victims 
of medical identity theft.  In response, we modified the fourth 
recommendation to include CMS's comments and to focus on developing 
a method for ensuring that beneficiaries who are victims of medical 
identity theft retain access to needed services.   
Finally, CMS concurred with the fifth recommendation and noted that 
making the necessary changes to allow CMS to reissue identification 
numbers for beneficiaries will require significant monetary investments 
and multiple systems and operational changes for CMS, its contractors, the 
Social Security Administration, State Medicaid programs, private health 
plans, and providers.  CMS stated it is reviewing options and cost 
estimates for developing an identification number that is not based on the 
Social Security number. 
The full text of CMSs comments is provided in the appendix.   
CMS Response to Breaches and Medical Identity Theft (OEI-02-10-00040)  16 
  APPENDIX 

Agency Comments 
,..  ,., 
_.llo'Si"l('~
(::/- DEPAR1MENT OF HEALTH & HUMAN SERVICES  Cenlers for Medicare & Medicaid Services 
Administrator 
Washinglon, DC 20201 
AUG  2 7 2012 
DATE: 
TO: 	 Daniel R. Levinson 
Inspector General 
FROM: 	 MaRTyn T.Aen1rol' 
Acting Ad'mlllistrator 
SUBJECT: 	 Office oflnspector General (OIG) Draft Report: "CMS Response to Breaches and 
Medical Identity Theft" (OEJ-02-1 0-000040) 
The Centers for Medicare & Medicaid Services (CMS) appreciates the opportunity to review and 
comment on the OIG Draft Report entitled, "CMS Response to Breaches and Medical Identity 
Theft" (OEI-02-10-000040). The objectives ofthis study are to determine the extent to which 
CMS' response to breaches ofbeneficiaries' protected health information met the notification 
requirements in the American Recovery and Reinvestment Act of 2009 (the Recovery Act) and 
to assess CMS's response to medical identity theft involving beneficiary and provider Medicare 
identification numbers. as well as the remedies it offers to beneficiaries and providers. 
The OIG examined the 14 breaches requiring notification under the Recovery Act between 
September 23, 2009 and December 31, 2011 . The report indicates that CMS did notify the 
13,775 Medicare beneficiaries affected by the breaches, but did not meet several Recovery Act 
requirements. OIG also reports that CMS has made progress in responding to medical identity 
theft by developing a compromised number database for contractors, but improvements are 
needed to increase database utility and improve edit development designed to stop payments. 
Lastly, OIG acknowledges that CMS offers some remedies to providers but fewer to 
beneficiaries affected by medical identity theft. 
The CMS appreciates OIG's efforts in working with our agency to help ensure that health 
information ofMedicare beneficiaries is protected. CMS' response to each of the OIG 
recommendations follows. 
OIG Recommendation 1 
The CMS should ensure that breach notifications meet Recovery Act Requirements. 
CMS Response 
The CMS concurs with this recommendation. Our policy and procedures reflect the Recovery 
Act's breach notification provisions. To ensure breach notifications are sent within the required 
CMS Response to Breaches and Medical Identity Theft (OEI-02-1 0-00040)  17   
   
 
 
 
CMS Response to Breaches and Medical Identity Theft (OEI-02-10-00040)  18 
   
   
 
 
 
 
CMS Response to Breaches and Medical Identity Theft (OEI-02-10-00040)  19 
   
   
 
 
 
 
CMS Response to Breaches and Medical Identity Theft (OEI-02-10-00040)  20 
   
   
ACKNOWLEDGMENTS 
This report was prepared under the direction of Jodi Nudelman, Regional 
Inspector General for Evaluation and Inspections in the New York regional 
office.   
Deputy Regional Inspector General Nancy Harrison served as the team 
leader for this study.  Other Office of Evaluation and Inspections staff 
from the New York regional office who conducted the study include Rose 
Goldberg, Olivia Herman, Jennifer Karr, and Michael Rubin.  Central 
office staff who provided support include Scott Horning, Kevin Manley, 
Debra Roush, Tasha Trusty, and Rita Wurm.  
 
 
 
CMS Response to Breaches and Medical Identity Theft (OEI-02-10-00040)  21 
   
Office of Inspector General 
http://oig.hhs.gov 
 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as 
amended, is to protect the integrity of the Department of Health and Human Services 
(HHS) programs, as well as the health and welfare of beneficiaries served by those 
programs.  This statutory mission is carried out through a nationwide network of audits, 
investigations, and inspections conducted by the following operating components: 
Office of Audit Services 
The Office of Audit Services (OAS) provides auditing services for HHS, either by conducting 
audits with its own audit resources or by overseeing audit work done by others.  Audits 
examine the performance of HHS programs and/or its grantees and contractors in carrying 
out their respective responsibilities and are intended to provide independent assessments of 
HHS programs and operations.  These assessments help reduce waste, abuse, and 
mismanagement and promote economy and efficiency throughout HHS. 
Office of Evaluation and Inspections 
The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide 
HHS, Congress, and the public with timely, useful, and reliable information on significant 
issues.  These evaluations focus on preventing fraud, waste, or abuse and promoting 
economy, efficiency, and effectiveness of departmental programs.  To promote impact, OEI 
reports also present practical recommendations for improving program operations.  
Office of Investigations 
The Office of Investigations (OI) conducts criminal, civil, and administrative investigations 
of fraud and misconduct related to HHS programs, operations, and beneficiaries.  With 
investigators working in all 50 States and the District of Columbia, OI utilizes its resources 
by actively coordinating with the Department of Justice and other Federal, State, and local 
law enforcement authorities.  The investigative efforts of OI often lead to criminal 
convictions, administrative sanctions, and/or civil monetary penalties. 
Office of Counsel to the Inspector General 
The Office of Counsel to the Inspector General (OCIG) provides general legal services to 
OIG, rendering advice and opinions on HHS programs and operations and providing all 
legal support for OIGs internal operations.  OCIG represents OIG in all civil and 
administrative fraud and abuse cases involving HHS programs, including False Claims Act, 
program exclusion, and civil monetary penalty cases.  In connection with these cases, OCIG 
also negotiates and monitors corporate integrity agreements.  OCIG renders advisory 
opinions, issues compliance program guidance, publishes fraud alerts, and provides other 
guidance to the health care industry concerning the anti-kickback statute and other OIG 
enforcement authorities.