CMS Warns of Breach Impacting 254,000 Medicare Beneficiaries

The Centers for Medicare & Medicaid Services (CMS) is responding to a data breach at Healthcare Management Solutions (HMS), a subcontractor of ASRC Federal Data Solutions, LLC (ASRC Federal), that might involve Medicare beneficiaries’ personally identifiable information (PII) and/or protected health information. No CMS systems were breached, and no Medicare claims data were involved. 

Initial information indicates that Healthcare Management Solutions acted in violation of its obligations to CMS and that the incident involving HMS has the potential to impact up to 254,000 Medicare beneficiaries’ personally identifiable information out of the over 64 million beneficiaries that CMS serves. CMS mailed beneficiaries that have been potentially impacted a letter from CMS notifying them directly of the breach. 

“The safeguarding and security of beneficiary information is of the utmost importance to this Agency,” says Chiquita Brooks-LaSure, CMS administrator. “We continue to assess the impact of the breach involving the subcontractor, facilitate support to individuals potentially affected by the incident, and will take all necessary actions needed to safeguard the information entrusted to CMS.” 

The services provided to CMS under the contract with ASRC Federal include resolving system errors related to Medicare beneficiary entitlement and premium payment records. The contractors’ services also support the collection of Medicare premiums from the direct-paying beneficiary population. The contractor does not handle Medicare claims information.