Press Releases

STATEMENT OF MARK B. MCCLELLAN, M.D., PH.D. ADMINISTRATOR, CENTERS FOR MEDICARE & MEDICAID SERVICES

Protecting personal Medicare beneficiary information is a top priority for CMS and its partners.   We have established and enforced a broad range of privacy and information security protections for our beneficiaries, and we are working with Federal and state partners to monitor and enforce these requirements.   With strong requirements in place, it is unacceptable when personal information on any beneficiary is put at risk. 

CMS has learned from the HHS Office of Inspector General that a computer file containing personally identifiable information for approximately 17,000 Medicare beneficiaries enrolled in a health plan administered by Humana Health Plans, Inc. was not maintained securely.   In an unrelated incident, approximately 250 Humana member applications were stolen from an insurance agent’s vehicle in Minnesota last month. 

CMS has taken action to assure that the affected beneficiaries are supported and beneficiaries are protected from similar events in the future.  The plan is being required to implement the following set of corrective actions:  contacting all affected beneficiaries, providing beneficiaries free access to a credit monitoring service for one year, and submitting a comprehensive corrective action plan to ensure that such privacy violations do not occur again.  CMS will closely monitor the plan’s activities to ensure that this corrective action plan is fully implemented.  These matters are also being reviewed to determine what additional compliance and enforcement actions, including those under the HIPAA Security and Privacy rules, may be warranted.

We are also reminding all employees, contractors and health plans about the penalties for violating the privacy, security and information laws and regulations.   We will take aggressive actions against any plan or Medicare contractor that compromises the privacy and security of Medicare beneficiaries' personal information.