If a consumer's PII is suspected to be used in a fraud incident involving a change in plan selection, what is the required action?

• A. Notify the consumer
• B. Report to the CMS IT Service Desk
• C. Cancel the enrollment
• D. Ignore

Answer: (B)

When you suspect that a consumer’s PII has been used in a fraud incident involving a change in plan selection, the immediate, proper action is to report it to the CMS IT Service Desk. This channels the issue into the official incident response process, allowing security specialists to verify the breach, review access and system logs, implement any necessary containment measures, and coordinate with fraud prevention teams. It also creates an auditable trail for compliance.

Notifying the consumer is important for awareness, but it doesn’t trigger the necessary internal safeguards or documentation for a fraud investigation. Canceling the enrollment could be a step later on, but only after the incident has been assessed and authorized through the proper procedures. Ignoring the incident is not acceptable and would leave potential fraud untreated.