The Centers for Medicare & Medicaid Services (CMS), led by Administrator Dr. Mehmet Oz, exposed the Social Security numbers of health care providers in a publicly downloadable database powering its new national provider directory, The Washington Post reported on April 30, 2026. The directory, part of the administration's push to modernize health care technology, is meant to help seniors find doctors and providers that accept their insurance plans. The numbers, linked to providers' names and other identifying information, sat in the public data for weeks until the Post flagged the problem to the agency.
Politico reported that the data was uploaded on April 6 and that CMS pulled the National Provider Directory offline on Thursday, April 30. Politico confirmed that at least 102 providers had their full, unredacted Social Security numbers in the downloadable file, in a column normally used for qualifications such as state license numbers. The files are mainly used by insurers and health companies to build search tools; patients using an online search likely could not see the numbers. CMS did not say how many providers were affected.
A CMS spokesperson blamed the providers, saying the problem “stems from incorrect entries of provider or provider-representative-supplied information in the wrong places,” and that “the agency has taken steps to address it promptly and reinforce safeguards around data submission and validation.” Politico reported it was unclear whether the agency checked the forms before uploading them.
The directory has had accuracy problems since its rollout last year, including listing the wrong insurers for providers; Sens. Jeff Merkley and Ron Wyden wrote to Oz in November that they were “deeply concerned” about “erroneous, conflicting, and duplicative information” in it. The Hill reported the project is part of an effort led by DOGE acting administrator Amy Gleason. The New Republic suggested the lapse may trace to DOGE's layoffs of hundreds of CMS employees. John Davisson of the Electronic Privacy Information Center told Politico, “We have seen in a lot of contexts this administration brushing aside privacy safeguards.”
Correction (October 2, 2026): The entry said the Post flagged the issue on Tuesday, April 30 (April 30 was a Thursday, the day the Post's report ran and CMS took the directory down), that CMS acknowledged “at least dozens” of affected providers (it was the Post that found at least dozens; CMS gave no number, and Politico later confirmed at least 102), that the data was queryable from any browser (it was a downloadable file mainly used by insurers), and that DOGE cuts removed the staff who quality-checked directory submissions. No source supports the quality-control claim, so it was removed, along with the claim that Oz had no prior government experience and the entry's generalized “pattern” conclusion.