CM - C2C Innovative Solutions Inc.

The purpose of this Center for Medicare (CM) C2C Innovative Solutions, Inc. (C2C) information system (CM-C2C) is to provide the platform to perform adjudication services for level 2 Medicare appeals of coverage determinations, payment disputes and the use of Durable Medical Equipment (DME). The adjudication services include processing appeal requests, tracking appeal data, and responding to correspondence related to the appeal.

The CM-C2C system obtains information concerning Medicare beneficiaries, providers, and system users from the Medicare Appeals System (MAS), another Centers for Medicare & Medicaid Services (CMS) information system which is also covered by a separate PIA. C2C staff retrieve records from MAS primarily using an appeal number, although they may need to query by beneficiary name or HICN/MBI number to find related appeal numbers. The records in MAS are Medicare beneficiary and medical service data related to appeals filed for Medicare service coverage or claim(s) payment information. MAS maintains its own PIA for the information collected, stored, and shared within it as the system of records.

The CM-C2C system is used by C2C in the performance of Medicare appeal services as a CMS Qualified Independent Contractor (QIC). C2C does not maintain or operate a system of records for CMS. QICs are responsible for conducting the second level of appeals of Medicare Part A, Part B, and DME coverage determinations, payment disputes and the use of DME. The adjudication services include processing appeal requests, tracking appeal data, and responding to correspondence related to the appeal, as set forth by Title II of the Medicare Prescription Drug, Improvement and Modernization Act of 2003 (MMA). C2C staff retrieve records from the CM-C2C system primarily using an appeal number, although they may need to query by beneficiary name or number to find related appeal numbers.

C2C and Texas Medical Foundation (TMF) are direct CMS contractors. Only authorized system users have access. Access includes authorized CMS contractors, C2C employees, C2C contractors and sub-contractors, and some vendors doing system development. To access the CM-C2C system, users provide their name, user identification (ID), and password to create a user account and obtain access to the system.

• Name
• E-Mail Address
• Phone Numbers
• Medical Notes
• Date of Birth
• Mailing Address
• Medical Records Number
• Legal Documents
• Date of Death
• Other - HICN/MBI, User ID, Password, NPI, Appeal Number, Claim Number and Payment information related to claim.

• Employees
• Public Citizens

• Online
• Hard Copy Mail/Fax
• Email

• Within the OPDIV

• Other - C2C receives PII/PHI from healthcare providers and also from CMS MAS.

Within HHS: Within Department of Health and Human Services (HHS) for the MAS System.

Private Sector: Authorized TMF-C2C Contractors and Subcontractors and Healthcare Organizations.

The source of the CM-C2C beneficiary personal information is the CMS operated MAS. MAS is covered by a System of Record Notice (SORN) (09-70-0566) and its own PIA. The CM-C2C system does not directly notify individuals that their personal information is being collected because the system uses personal information from the MAS system. Any required notifications are provided through MAS. Providers and beneficiaries are informed on their appeal request form that providing their information is voluntary but failure to provide all or part of the requested information may affect the determination of their appeal.

System users are notified as part of the employment process and to obtain access to the CM-C2C that their personal information is required.

Beneficiary and provider PII is required for appeal processing and is received from the MAS system. MAS is covered by a SORN (09-70-0566) and its own PIA. If the appeals process requires individuals to verify the information in the MAS system, they are notified on the standardized processing letters that the information provided will be used to further document their appeal and that submission of the information requested is voluntary, but failure to provide all or any part of the requested information may affect the determination of the appeal.  

System user credentials, PII, are mandatory for system access, so there is no option to opt-out.

CM-C2C obtains PII from MAS. MAS PII is obtained from other systems which verify appellant PII. These systems include the Medicare Beneficiary Database (MBD), Health Plan Management System (HPMS), Next Generation Desktop (NGD) and National Plan and Provider Enumeration System (NPPES) which all are covered by their separate CMS PIAs. Contacts for these various applications are available from CMS.gov. If there are concerns about user PII, users can contact the MAS Help Desk.

If CM-C2C system users have concerns about their PII, they would contact the C2C IT help desk. The help desk would investigate the incident and provide direction to the user on if further action is necessary.

• Users: Users access the PII within the system to process appeals or attest that the workflow management is operating properly.
• Administrators: Administrators have access to PII to manage the workflow and create, review, and manage user accounts.
• Developers: Developers access the system to attest that the workflow management system is operating properly.
• Contractors: Direct contractors, in their roles as users, administrators, or developers have access to PII as described in the explanations above.
• Others - Vendors with limited access: Vendors only have access to systems for a limited time.

The system uses the principle of least privilege as well as role-based access control to ensure system users are granted access on a "need-to-know" and "need-to-access" for performing their job functions. 

System administrators review user accounts at least semi-annually. Any anomalies are addressed and resolved by contacting the user, and modifying their user data, or by removing their access if it is no longer required. Activities of all users including system administrators are logged and reviewed by the system Information Security staff to review system activities and access.

The system’s management security and privacy controls consist of policies, procedures, and control standards. This is in addition to security and privacy training, role-based access permissions, and regular review of access logs and activities.

The system’s technical security controls consist of implementing security/privacy hardening (CIS Benchmarks) as the Active Directory (AD) Group Policy Objects (GPOs); restricting access using user ids, passwords, and two-factor authentication one-time passcode. Technical protection is also achieved through boundary controls, continuous monitoring for system usage and unexpected or malicious activity; the configuration of specialty hardware/software; in transit encryption; at rest encryption (full disk encryption of laptops, workstations, and backed-up snapshots).

The system’s physical security controls consist of restricted access areas (the company offices and data centers) are monitored and recorded. Only authorized personnel may access restricted areas with appropriate security permissions (access badge or issued door key). All external company office suite doors are controlled with badge access card readers. Designated limited restricted security areas are only accessible to approved personnel. Physical equipment and media are subject to documented handling procedures, including proper disclosure, disposal, and destruction as necessary. Environmental protections consist of protected cooling and power sources that are monitored.