By Bill Britt
Alabama Political Reporter
MONTGOMERY—Due to gross mismanagement of the CARES system, not only are Alabama’s most needy citizens in danger of identity theft, but the system’s many failures also open a gaping door to unchecked, fraudulent claims for CHIPs and Medicaid.
After publication of APR’s article, “CARES: A Massive Technology Failure Costing Taxpayers Tens of Millions,” the Alabama Political Reporter received numerous emails revealing the system’s vulnerabilities.
According to these sources, the CARES database contains approximately 500,000 applications for Medicaid and CHIPs combined, which translates into nearly 750,000 Social Security Numbers, Personal Health Information (PHI) and Personally Identifiable Information (PII) (which includes income details from IRS).
Personal data from enrollees is not protected by passwords or encryption. This leaves all SSNs visible, in plain text, to more than 20 employees. This error could lead to a massive theft of personal information by hackers.
As stunning as these revelations may appear, according to senior officials and programmers, the CARES system doesn’t verify personal information used for determining eligibility for the Medicaid and CHIPs programs, which could lead to thousands of illegal claims.
Other Federal programs use an online database provided by CMS to verify income and eligibility. However, this database is not used to determine eligibility for the Medicaid and CHIPs programs, according to those with hands on experience with the operations.
Sources close to the project provided this example: the system allows an individual to fill out an application using their name, SSN and income. This person becomes eligible for Medicaid even if they lie, because there in no method being used to confirm the information.
There isn’t even a check on family composition through any federal or state agency. Again: A household of one applying for Medicaid could simply add a pet to increase the members of the family to meet the eligibility standards for entitlement.
One individual who understands the system said, “There is no age check in the system. If you say you are under 18, then you get CHIPs, as long as you claim the right income. Even if you are a senior citizen, all you have to do is lie on the online application.” They further stated, “The system believes your DOB, SSN, name, income and even incarceration through the online application.”
Because the system doesn’t have a “patient matching algorithm” in place, a person could, theoretically, apply several times by manipulating their information to dupe the system. There isn’t even a check on where an applicant lives, meaning everyone can enroll in Alabama’s Medicaid and CHIPs by using an Alabama address, or a P.O. Box. They say the system is so faulty even a fake SSN or that of another person is usable for enrollment.
Other problems have led to payment backlogs lasting six months or more, according to insiders.
Many of CARES problems existed under the what is called “The Legacy System,” overseen by Regina Patterson at Public Health.
There is a better system for verification of eligibility presented to those in charge of that program, however, it was never seriously considered.
An analysis of the Legacy System led to the creation of CARES.
If the CARES online enrollment is as susceptible to fraud and theft assources have outlined, the system must be shut down immediately, and an investigation should be initiated by law enforcement.
