Auditors claim inmates had access to patient Social Security numbers

A Maryland corrections division that provides inmate labor has backed out of a data entry contract with the health department after state auditors found that prisoners had access to some patients' personal information, which was supposed to have been redacted from documents, but occasionally wasn't.

The findings were included in a Legislative Services report made public Tuesday, three months after Maryland Correctional Enterprises, an industry arm of the Department of Public Safety and Correctional Services, ceased providing the services to the Department of Health and Mental Hygiene.

According to the report, DHMH used inmate labor to enter physician Medicaid reimbursement claims into a state database. Social Security numbers that appeared in the proper spot in the upper right corner of the forms were automatically redacted, or "blacked out." But "infrequently, Social Security numbers for the recipient and/or the provider appeared in other locations on the form" and "remained accessible to the inmates," the report said.

DPSCS spokesman Rick Binetti said in an email that this occurred in roughly 3 out of 3,000 cases reviewed, when doctors' offices mistakenly used a patient's Social Security number as the account identifier.

He said there was no evidence to suggest inmates even noticed the numbers, and he stressed that there was "strict security in the room where this data entry took place," including four cameras and supervisory staff.

"Any recording of information by inmates off of these forms would have been noticed and caught," Binetti said. The prisoners are also searched on their way out of the plant.

A law took effect in June preventing inmates in the MCE programs from having access to personal information of others. In a response to auditors, the division said it "cannot ensure" that personal information will be protected on the Medicaid forms, and therefore "notified DHMH on 11/01/11 that it would be necessary for MCE to immediately cease providing data entry services."

Data entry is routinely performed by inmates throughout the nation, Binetti said. The MCE workers earn about $2 per day for their work, Binetti said, and DHMH paid about $1.45 per 1,000 keystrokes for the data entry.

Inmates had been doing the work since July 1, 2003, according to the health department, which called it a "cost-effective" arrangement.

Officials have since transferred the work to a firm known as the Data Entry Co., which has another contract with DHMH and took on this project after a competitive bidding process. The cost to have TDEC do the work increased to 96 cents per claim from 53 cents, according to the health department.

"We estimate that it will cost approximately $250,000 more a year to use the new vendor," DHMH spokeswoman Dori Henry said in an email.

Using inmates in industry is a practice that goes back to the 19th century, according to MCE, which employed 1,855 prisoners in fiscal year 2011 that ended in June. The division brought in more than $50 million that year, and provided more than 2.8 million hours of inmate employment and training in areas including furniture restoration, sign making and relocation services.

The program is designed to give prisoners skills they can use when they're released, reducing the chance that they'll end up in trouble again.

Copyright © 2021, The Baltimore Sun, a Baltimore Sun Media Group publication | Place an Ad