Home Health & Hospice Week

BB2.0 apps were sharing beneficiaries’ info.

A coding bug in Medicare’s Blue Button 2.0 program led to Medicare beneficiary PHI being improperly shared, the Centers for Medicare & Medicaid Services reports.

Blue Button 2.0 aims to provide a secure way for beneficiaries to access and share their personal health data in a universal digital format.

The problem: “BB2.0 was truncating a 128-bit user ID to a 96-bit user ID,” CMS explains in a blog post. “The 96-bits remaining were not sufficiently random to uniquely identify a single user. This resulted in the same truncated user ID being assigned to different beneficiaries.” Then, some beneficiaries with the same truncated ID were passed protected health information data pertaining to other users via BB2.0. The bug affected 30 authorized BB2.0 apps, CMS says.

The solution: CMS “corrected the faulty code, implemented additional protections, and is resuming normal operations of the system,” the agency said in a Dec. 27, 2019 post.