Create a free Commercial Carrier Journal account to continue reading

FMCSA leaves questions swirling around hack of medical examiner site

Sample_CDL_Medical_Examiners_Certificate2

Drivers’ private medical information likely was not at risk in a recent hack of the Federal Motor Carrier Safety Administration’s online registry of DOT-certified medical examiners. But if any information regarding examiners was stolen, specifically their license number, there could be potential for bogus medical certificates to be issued, according to interviews with several DOT-certified medical examiners.

The agency earlier this month said “there was no evidence of exposure of the personal information of drivers, medical examiners or motor carrier operators,” but the agency refuses to answer questions from CCJ seeking to confirm whether FMCSA still sees no evidence of stolen data. Agency spokesperson Sharon Worthy, to whom CCJ has sent repeated queries in recent weeks, also has refused to answer questions about how drivers can find medical examiners while the site is down and whether the outage has caused disruptions in the issuance of medical certificates. Worthy has also refused to answer questions about the nature of the hack and what data might have been at risk of exposure.

However, there should be no issues during roadside inspections, says Collin Mooney, executive director of the Commercial Vehicle Safety Alliance. “The outage reported on the National Registry for Certified Medical Examiners’ website does not impact the data reliability and our verification efforts at roadside,” said Mooney. “The drivers are still required to take the medical [certification] to the state and the state updates the CDL. Medicals are still able to be verified ar roadside through CDLIS, not the national registry.”

Drivers are required to maintain paper copies of their medical cards and provide their CDL-issuing state with their med certificate within 15 days of receiving it.

Dr. Mike Megehee, president of the nationwide Team CME network of clinics, says there’s little to no private medical information on the forms that medical examiners must transmit to FMCSA. Listed on the forms are drivers’ names, license numbers and optional contact information, such as email address and mailing address. The only private health information potentially at risk for exposure is whether the drivers need an exemption from FMCSA for vision, hearing, seizures or diabetes, he says.

FMCSA has had little to no correspondence with its medical examiners, says Megehee and other examiners. The agency has offered no timeline to examiners as to when the system will resume normal operations, they said.

“We haven’t received anything,” says Cindy Bagwell, manager of the Primary Care Clinics of Georgia in Gainesville, Georgia, whose Dr. David Hocker is a certified medical examiner. “There’s been very, very little communication, if any. We tried to log in and load our exams — that’s when we found out it was down.”

She fears that access to examiners’ licensing information, should it have been exposed, could allow for creation of fraudulent medical certificates. “They could try to falsify something by having that information,” she said.

“Absolutely it could be done,” says Dr. Tiffany Ringfield, another Atlanta-area based examiner. “There’s nothing to stop them from getting a copy [of a medical certificate] and just inserting my number on it.”

Given the lack of information from FMCSA, questions such as these remain.

Examiners face backlog of thousands of exam uploads

The now two-month-long outage of the agency’s online system has caused examiners to hold a backlog of thousands of exams performed in recent weeks, said Megehee. Team CME operates more than 650 clinics nationwide, specializing in DOT physicals. Given the volume of exams the clinic network completes, their backlog of necessary uploads continues to grow the longer the site stays down. Team CME performs an average of about 1,000 exams a day nationwide. “That’s getting to be a pretty big pile,” he says of the site’s outage.

Bagwell says her clinic has results from about 200 exams yet to be uploaded due to the outage. Ringfield says she has “stacks and stacks and stacks” of results that need to be filed with FMCSA. She performs about 7-10 DOT physicals a day.

–Todd Dills contributed to this report.