CMS, Maximus investigating data breach involving personal health information
No HHS or CMS systems were impacted, the agencies say, though protected information was potentially compromised.
Photo: Al David Sacks/Getty Images
The Department of Health and Human Services and the Centers for Medicare and Medicaid Services are responding to a data breach in May in Progress Software's MOVEit Transfer software on the corporate network of Maximus Federal Services, a contractor to the Medicare program. The breach involved Medicare beneficiaries' personally identifiable information (PII) and/or protected health information (PHI).
No HHS or CMS systems were impacted, the agencies said. Maximus is among the many organizations in the U.S. that have been impacted by the MOVEit vulnerability.
Late last week, CMS and Maximus sent letters of notification to people who may have been impacted by the breach, informing them of the actions being taken in response. CMS estimates the MOVEit breach impacted about 612,000 current Medicare beneficiaries.
WHAT'S THE IMPACT?
The incident in question involved a security vulnerability in the MOVEit software, a third-party application that allows for the transfer of files during the Medicare appeals process. Maximus is among a handful of organizations in the U.S. that have been impacted by the MOVEit vulnerability.
The breach occurred on May 30, when Maximus detected unusual activity in its MOVEit application. Maximus began to investigate and stopped all use of the MOVEit application early on May 31. Later that same day the third-party application provider, Progress Software Corporation, announced that a vulnerability in its MOVEit software had allowed an unauthorized party to gain access to files across many organizations in both the government and private sectors.
Maximus notified CMS of the incident on June 2.
So far the investigation indicates that from about May 27 through the 31st, the unauthorized party obtained copies of files that were saved in the app, though no CMS system has been compromised. After notifying CMS, Maximus then began to analyze the files to determine which data had been affected. It was determined that those files contained some patients' personal information.
The personal information may, according to Maximus, include names, social security numbers, dates of birth, mailing addresses, phone numbers and email addresses, driver's license numbers, medical history and notes, prescription information, health insurance claims, and health benefits and enrollment information.
CMS is continuing to investigate this incident. The letter sent to beneficiaries indicates they can address the issue by enrolling in Experian identity and credit monitoring services, obtain a free credit report and continue using their existing Medicare cards, because the investigation has not yet found any reports of identity fraud or improper use of the information.
THE LARGER TREND
While data breaches affect all industries, healthcare suffers the largest financial hit, according to data recently compiled by the Ponemon Institute.
This year, the average cost of a data breach reached an all-time high of $4.4 million. That's a 2.3% increase from 2022, and, taking the long-term view, the average cost has increased 15.3% from the 2020 report.
Since 2020, healthcare data breach costs specifically have increased 53.3%, representing a considerable rise in recent years. This is the 13th consecutive year the health industry reported it had the most expensive data breaches, averaging $10.9 million in cost.
A 2022 report from law firm BakerHostetler showed consumers are increasingly suing organizations over data breaches. Healthcare comprises 23% of lawsuits due to data breaches. The next highest is business and professional services, at 17%, followed by finance and insurance (15%), education (12%) and manufacturing (10%).
Of all industries, healthcare also logged the highest initial ransom demand from hackers and bad actors, at more than $8.3 million. The average ransom that was actually paid was far lower, at about $876,000, but that was still the highest average amount paid across all industries.
Twitter: @JELagasse
Email the writer: Jeff.Lagasse@himssmedia.com
