• Social Security numbers have been exposed in a public database
• The database was used to populate a Medicare directory
• The directory was launched by CMS as part of Trump administration plans to modernize Medicare

A directory created by the Centers for Medicare and Medicaid Services (CMS) has exposed the Social Security numbers of a number of US healthcare providers.

The Trump administration introduced a new Medicare portal as part of plans to modernize US healthcare technology.

However, a database that was part of the directory was left publicly accessible, and exposed providers’ names and Social Security numbers.

Article continues below

Private data exposed

The directory, which included the database, was created to assist seniors in need of care to look up which doctors and medical providers were compatible with their healthcare insurers.

The database, downloaded and examined by the Washington Post, was publicly accessible as part of efforts by CMS to adhere to data transparency efforts.

Unbeknownst to CMS, the database contained some of the providers’ Social Security numbers, which CMS says were entered into the database by mistake. CMS explained that the error “stems from incorrect entries of provider or provider-representative-supplied information in the wrong places.”

“The agency has taken steps to address it promptly and reinforce safeguards around data submission and validation,” CMS added.

CMS did not explain how many Social Security numbers were exposed, nor any information on if providers had been informed about the exposure. The database was taken down after the Post notified health officials.

Speaking to the Post, one anonymous physician said, “I don’t even know how [Medicare officials] would get my Social Security number.”

The modernization of US Medicare under the Trump Administration has faced a number of previous errors, including mismatched or duplicated insurance coverage, which has raised criticism from some Democrats.

Sens. Jeff Merkley (D-Oregon) and Ron Wyden (D-Oregon) wrote a letter to CMS in November, stating, “We are concerned that this rushed rollout will mislead millions of seniors as they compare plans, and may cause seniors and people with disabilities to incur medical bills they reasonably believed would be covered.”

For Healthcare providers who believe their Social Security number may have been exposed, Microsoft recommends taking the following steps:

1. Place a temporary fraud alert on your credit to alert credit bureaus to suspicious activity
2. Download an up-to-date copy of your credit report
3. Escalate any unrecognized accounts to the Federal Trade Commission
4. File a police report so that there is an official record of your identity being stolen
5. File a complaint with the Internet Crime Complaint Center
6. Notify the Internal Revenue Service

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

Benedict is a Senior Security Writer at TechRadar Pro, where he has specialized in covering the intersection of geopolitics, cyber-warfare, and business security.

Benedict provides detailed analysis on state-sponsored threat actors, APT groups, and the protection of critical national infrastructure, with his reporting bridging the gap between technical threat intelligence and B2B security strategy.

Benedict holds an MA (Distinction) in Security, Intelligence, and Diplomacy from the University of Buckingham Centre for Security and Intelligence Studies (BUCSIS), with his specialization providing him with a robust academic framework for deconstructing complex international conflicts and intelligence operations, and the ability to translate intricate security data into actionable insights.