Printer Friendly, PDF & Email

Privacy Briefs: January 2023

The Centers for Medicare & Medicaid Services (CMS) said a data breach at a Medicare subcontractor impacted the personally identifiable information and protected health information (PHI) of up to 254,000 Medicare beneficiaries. The data breach occurred at Healthcare Management Solutions LLC, a subcontractor of ASRC Federal Data Solutions LLC. ASRS Federal Data Solutions provides services to CMS that involve resolving system errors related to Medicare beneficiary entitlement and premium payment records. The contractor’s services also support the collection of Medicare premiums from the direct-paying beneficiary population, according to CMS, which reported that the contractor does not handle Medicare claims information. CMS is notifying Medicare beneficiaries whose information may have been put at risk due to the breach and will issue them updated Medicare cards with new Medicare beneficiary numbers. Those whose information was involved in the breach will be offered free-of-charge credit monitoring services, according to CMS.[1]

Amazon has notified developers that it has decided to no longer support the HIPAA-eligible skills offered for digital voice assistant Alexa, ending the sole opportunity for independent developers to build voice experiences if HIPAA-eligible data can be collected. “We kindly ask that you remove your skill from the skills store,” Amazon wrote to developers. “Alternatively, we will suppress your skill for you on December 9, 2022. Once the skill is removed/suppressed, any existing users who try to use the skill will get a message that the skill is no longer supported. Alexa responds by default to these types of utterances with, ‘Sorry, I didn’t get that.’ After the skill is suppressed, Amazon will delete all associated PHI. Alexa does not plan to contact users of your skill but we encourage you to reach out to your skill users if you anticipate user frustration or questions.” This doesn’t mean Amazon is abandoning the idea of using Alexa in HIPAA-protected environments; however, the tech giant can still develop HIPAA-compliant Alexa skills in-house. In its message to developers, Amazon stated: “We continue to grow our Alexa Smart Properties for Healthcare business,” and an Amazon spokesperson said that the company is “continuing to invest heavily in developing healthcare experiences with first and third-party developers.” Amazon first launched its HIPAA-compliant feature for Alexa in April 2019, and six health care organizations signed on at the time.[2]

This document is only available to subscribers. Please log in or purchase access.

Would you like to read this entire article?

If you already subscribe to this publication, just log in. If not, let us send you an email with a link that will allow you to read the entire article for free. Just complete the following form.

* required field