CMS pulled a provider directory after reporters found exposed provider SSNs; officials say they are reinforcing safeguards.