By Megan R. Wilson

Listen to this briefing

Did someone forward this newsletter to you? Sign up here to get it in your inbox.

In today’s issue:

• WaPo exclusive: A Medicare portal database unintentionally reveals health providers’ Social Security numbers, prompting confusion among doctors and outrage from Democrats
• After nearly a year of review, federal officials conditionally approve Florida’s plan for extra Medicaid cash
• The approval comes after Republicans on Capitol Hill moved to rein in the state-federal program

Good afternoon, thanks for checking in with the Health Brief newsletter, and happy Friday!

→ BREAKING: The Food and Drug Administration granted “expanded access” to a promising pancreatic cancer drug, as WaPo’s Christopher Rowland reports. The move allows the treatment — made by Revolution Medicines — to be given to a wider population of patients while it remains under regulatory review.

Last month, the experimental drug came into the spotlight because former senator Ben Sasse (R-Nebraska) discussed his experience with it.

→ A reminder that I’ll be out next week, but my Washington Post Intelligence colleagues — Rebecca Adams, Nour Wood and Kendrick Frankel — will be manning the ship. Our lead health analyst, Rebecca, wants to hear from you: What’ve you got going on next week? Send her a note: rebecca.adams@washpost.com.

Programming note: With both chambers of Congress out, the newsletter will only be published on Monday and Wednesday.

I’d still love to be in the loop about what you’re watching for the rest of May and beyond: megan.wilson@washpost.com.

Doctors' Social Security numbers were exposed after they were accidentally revealed in databases posted on a federal website. (Jenny Kane/AP)

	The Lead Brief

The Trump administration inadvertently exposed Social Security numbers for health care providers in a publicly accessible database tied to a new Medicare provider directory, as WaPo’s Dan Diamond and Clara Ence Morse write in an exclusive report.

Advertisement

The database, used by the Centers for Medicare and Medicaid Services to power a tool helping older Americans find in-network doctors, contained provider names alongside SSNs and other identifiers. A review of a sample of records by The Post found dozens of Social Security numbers were exposed.

The directory is part of a broader initiative that includes plans for a new national directory of health care providers, led by Amy Gleason, the acting administrator of the U.S. DOGE Service and a senior CMS official.

While the Medicare directory itself does not display the underlying data, the back-end files feeding it were publicly accessible for weeks.

• What the agency is saying: CMS officials told Dan that providers had entered the sensitive information in the wrong place, leaving their Social Security numbers exposed. CMS is now working to correct the issue.

“The agency has taken steps to address it promptly and reinforce safeguards around data submission and validation,” CMS said in a statement.

• What doctors are saying: Providers contacted by The Post said they were alarmed by the exposure.

“I don’t even know how [Medicare officials] would get my Social Security number,” said one physician, who spoke on the condition of anonymity to avoid the risk of identity theft.

Advertisement

• What Congress is saying: Democrats sharply criticized the breach. Rep. Richard E. Neal (Massachusetts), the top Democrat on a House committee overseeing CMS, called it evidence of “incompetence” in handling sensitive data, and urged congressional Republicans to investigate the issue.

→ The incident adds to scrutiny of CMS’s broader effort to modernize its provider directory. Last year, Dan and Akilah Johnson reported that an early version of the directory was riddled with erroneous and conflicting information.

	State scan

CMS is close to approving a Florida plan worth nearly $8 billion to boost Medicaid payments to providers in the state, ending a long-pending request that had prompted a lobbying blitz from lawmakers, hospitals and conservative groups.

The so-called direct payment program, run by Florida’s Agency for Health Care Administration (AHCA), is designed to close the gap between Medicaid payments and the actual cost of care.

The Medicaid funding flows through a mechanism known as state-directed payments, a fast-growing Medicaid tool that lets states steer extra money to providers by using state or local funds to draw down on federal matching dollars.

→ CMS has estimated that state-directed payment programs would cost $145 billion this year, a 16 percent increase from 2025.

Critics, including some Republicans on Capitol Hill, argue the arrangements inflate federal spending. The Paragon Health Institute, a prominent conservative group, has called it “legalized money laundering.”

Meanwhile, hospitals in Florida say the direct payment program “helps hospitals maintain

services like labor and delivery and mental health care that otherwise could be too expensive to administer.”

But, last year, Republicans in Congress voted in their signature domestic policy law to curtail the payments. Some states, including Florida, rushed to get proposals in before those limits took effect.

Florida’s request — about $7.9 billion, more than double its prior $3.4 billion program — stands out for its size.

→ Two weeks ago, Florida’s health agency received “contingent approval” from CMS, according to a state Legislative Budget Commission document dated Tuesday. AHCA Deputy Secretary for Medicaid Brian Meyer told a panel of Florida state lawmakers earlier this week he expected the approval to “come any day.”

The decision came almost a year after Florida submitted its application to regulators, a long wait time that prompted a wave of advocacy: Several Florida Republican lawmakers on Capitol Hill pressed CMS to approve the state’s direct payment program application, Roll Call reported earlier this year.

In February, a collection of conservative groups including the Pacific Research Institute also wrote to CMS Administrator Mehmet Oz, arguing that there is “no plausible programmatic basis for the delay” in approving Florida’s plan.

	Numbers Game

In the first few months of this year, CMS has approved more than $26 billion in hospital-focused, state-directed payment plans, according to a Healthcare Financial Management Association analysis completed in March.

Here are some of the largest state-directed payment programs approved this year:

• Kentucky: $5.1 billion
• Michigan: $4.9 billion
• Georgia: $4.5 billion
• Ohio: $3.9 billion

→ Nearly 40 states use these Medicaid programs, according to CMS.

	What We’re Reading

“[Katherine] Szarama named acting FDA CBER director,” Politico’s David Lim reports.

“New White House drug abuse strategy floats wastewater testing, AI, more treatment and faith-based options,” reports Jennifer Jacobs at CBS News.

“Aetna, Cigna, UnitedHealthcare fined over alleged mental health parity violation,” Alan Goforth writes at BenefitsPRO.

This newsletter is published by WP Intelligence, The Washington Post’s subscription service for professionals that provides business, policy and thought leaders with actionable insights. WP Intelligence operates independently from The Washington Post newsroom. Learn more about WP Intelligence.