CMS Accidentally Publishes Provider Social Security Numbers, Prompting Data Privacy Concerns

The Centers for Medicare & Medicaid Services (CMS) inadvertently released Social Security numbers of at least 100 health-care providers in its publicly accessible National Provider Directory. The Washington Post discovered the breach, notified CMS, and the agency removed the page. The error occurred weeks after the directory’s launch, part of the Trump administration’s health-technology modernization push.

Common DreamsThe Hill

The directory launched last year to help Medicare beneficiaries locate providers, an initiative led by the Department of Government Efficiency (DOGE) acting administrator Amy Gleason. Prior concerns included inaccurate plan information and a March whistleblower claim that DOGE stored Social Security data on an unsecured cloud server.

The Hill

• CMS, the agency managing the National Provider Directory.

Common Dreams

• The Trump administration’s Department of Government Efficiency (DOGE) under Amy Gleason.

Common Dreams

• CMS Administrator Mehmet Oz.

The Hill

• Senators Jeff Merkley (D-OR) and Ron Wyden (D-OR) and the watchdog group Social Security Works.

The Hill

The directory lists over 7 million providers. At least 100 providers had Social Security numbers exposed in the public file linking names and identifiers.

Common Dreams

CMS said providers entered Social Security numbers in the wrong form field and that the agency has taken steps to address the issue and reinforce safeguards around data submission and validation. Senators Merkley and Wyden warned the rushed rollout could mislead seniors and cause medical bills.

The Hill

Lawmakers and watchdogs called the breach evidence of systemic mishandling. Rep. Neal cited a pattern of incompetence, Sen. Gallego called the exposure “unacceptable,” and Social Security Works called it a “goldmine for identity thieves.” Rep. John Larson urged Republican action.

Common Dreams

• “The more we learn about how the Trump Administration handles the people’s most sensitive data, the clearer their incompetence becomes.” — Rep. Richard Neal, D-MA

Common Dreams

• “Over and over again, the Trump administration is exposing private Social Security data," said Social Security Works, an advocacy group that serves as a public watchdog for the nation's social programs.” — Social Security Works

Common Dreams

• “The agency has taken steps to address it promptly and reinforce safeguards around data submission and validation,” — CMS spokesperson

The Hill

• “ "This is a failure by this administration," said Sen.” — Rep. Ruben Gallego, D-AZ

Common Dreams

Sources report “at least 100” providers affected but do not give a precise total. CMS has not published a full count, and the extent of incorrect data entry remains unclear.

Common Dreams

CMS pledged tighter data-validation and review of submission processes. Congressional members plan oversight hearings. Advocacy groups call for stronger accountability to prevent future exposure of sensitive personal information.

The Hill