The new Medicare Plan Finder raises some security concerns
Getty
By now, most who work with the Medicare Plan Finder have had a chance to familiarize themselves with the new version. The most onerous change is that beneficiaries must log into their MyMedicare.gov account to access saved information. If they don’t have an account and they want the system to save their information, they will need to set up an account, which requires entry of their Medicare number and other pieces of protected health information.
This requirement should concern anyone who helps beneficiaries with Medicare Advantage and Part D drug plan reviews. How should they deal with this secure access? The presenter for the Centers for Medicare and Medicaid Services’ (CMS) NTP New Plan Finder Webinar on August 16 suggested that, if meeting in person, the helper should pass the keyboard to the beneficiary to type in his or her user name and password. If talking on the phone, the helper should ask for that information, enter it in the Plan Finder and not write it down.
However, that suggestion does not align with the MyMedicare.gov help page. “MyMedicare.gov is a secure site. Your MyMedicare.gov account may only be accessed by signing in with your own username and personalized password. You or your appointed Authorized Representative are the only people who should have this information.”
According to Medicare, anyone who helps a beneficiary with plan review must be an authorized representative. This involves more than sharing a keyboard.
What you should know about authorized representatives
Medicare.gov defines an authorized representative as “a person you choose to help you with Medicare-related matters, such as:
“ – Choosing a plan to participate in;
“ – Gathering more information about your insurance plan/policies for research and decision making purposes….”
There is a procedure for becoming a personal representative. The beneficiary can add authorized representatives to their MyMedicare.gov account by completing an online version of the “Medicare Authorization to Disclose Personal Health Information” form available via the link on the “My Account tab.” Or, the beneficiary can complete and mail in the form. Beneficiaries are able to add and remove personal representatives through their accounts or by contacting Medicare.
Hopefully, you’re beginning to see the issues involved with this change. According to Medicare, only those who are authorized representatives can access the account to help with Medicare plan review. The beneficiary must go through a process to designate that representative. How will beneficiaries feel about designating SHIP (State Health Insurance Assistance Program) counselors, pharmacists, insurance agents or plan representatives, and others? In many cases, the beneficiary has never met the person on the other end of the phone. Then, the new Plan Finder raises concerns about the security of the individual’s information. Once logged in to help with plan review, the reviewer has access to current coverage, favorite providers, and claims information. What if this information falls into the wrong hands? For example:
Sam, a very congenial guy, got to know several individuals at the senior center. In conversations, he mentioned that he knows Medicare and offered help during the Open Enrollment Period. Several accepted the offer and provided the information to set up a MyMedicare.gov account because they didn’t know where to start. Unknown to these seniors, he accessed more than just medications. In the following months, several of these seniors received calls about money they owed for past medical procedures with a demand for immediate payment.
Farfetched, you say? Hopefully, but with reports of a new scam a day, I believe something like this could happen.
CMS did provide the ability in the new Plan Finder to check plan information without logging into an account. But how helpful will that be? For example:
During a phone call, Catherine shared her 11 medications and pharmacies with a volunteer, who entered the information. Together, they discussed her options and selected a plan. The next day, Catherine realized she had forgotten a medication and called the volunteer. Once again, he had to enter medications (now 12) and three pharmacies. Then, two weeks later, a new pharmacy opened in Catherine’s village. She wanted to find out whether this would be a good choice for her so she called her volunteer yet again.
The new system is not only inefficient and frustrating for both beneficiaries and reviewers but it also greatly increases the chance for mistakes. By the third time a reviewer enters the same medications, the likelihood of errors increases dramatically.
Why and what’s next?
This change no doubt befuddles those who have experience with plan review while raising many questions.
Why was it necessary to connect plan review to a MyMedicare.gov account?
The Legacy Plan Finder requires only zip code, medications and pharmacies. It saves the information and generates a drug list ID and password date (no protected health information) for login. Logging back in to the system does not provide access to all kinds of protected information.
Maybe the fact that the system pulls in medications billed to Medicare is a benefit. However, that list may not be current so the reviewer will need to check it carefully.
Will those who have helped with Open Enrollment in the past want to do so again this year?
Doing reviews without logging in will be time-consuming and frustrating because information cannot be saved. Even if there are no changes in medications during the review period, it’s very possible the beneficiary may have follow-up questions about the plan, pharmacies, or benefits. To get the answers, the reviewer will need to start over.
Do reviewers want to be personal representatives?
Being designated a personal representative brings its own set of issues. Personally, I am very concerned about having access to information I don’t need. What if a beneficiary I help has his identity stolen? As his representative, would I be in trouble? Maybe that’s an overreaction but in today’s world, I would rather be safe than sorry.
Where does that leave beneficiaries who need help?
CMS must figure out how to allow those who assist with plan reviews to save information in a way that doesn’t involve logging into an account. Otherwise, too many beneficiaries will not get the help they need and will likely pay more. That’s now how a new tool should work.