By Elizabeth Casolo

A publicly accessible database powering CMS’ Medicare Advantage provider directory exposed Social Security numbers of healthcare providers.

The database was downloaded and from there, dozens of provider Social Security numbers were revealed. The database had been accessible for multiple weeks, at least.

A CMS spokesperson said “the issue stems from incorrect entries of provider or provider-representative-supplied information in the wrong places.” CMS did not reply to questions regarding how many providers had exposed Social Security numbers and how long the information had been available.

The issue was flagged to health officials on April 28. CMS said it promptly addressed the issue and is reinforcing safeguards.

Last year, the publication identified errors in the directory, such as duplicative addresses and contradictory information regarding providers’ network status. In November, two Democratic lawmakers sent a letter to CMS Administrator Mehmet Oz, MD, questioning the directory’s “rushed launch.”

The initial Medicare directory was the first phase of a broader push for a national provider directory, which is scheduled to beta-launch in full later this year.