CM - Maximus

The CM-Maximus information system is used by Maximus Federal Services (Maximus), a CMS direct contractor, in the performance of Medicare appeal services as a CMS Qualified Independent Contractor (QIC). QICs are responsible for conducting second level Medicare appeals of coverage determinations and payment disputes related to Medicare Hospital Insurance (Part A), Medicare Advantage Plans (Part C), and durable medical equipment (DME). The adjudication services include processing appeal requests, tracking appeal data, and responding to correspondence related to the appeal.

The CM-Maximus environment also supports the Federal External Review Process (FERP) Portal which allows for patients/appellants to submit a request a review of their health plan's adverse benefit determination.

The CM-Maximus system is used by Maximus Federal Services in their performance as a Qualified Independent Contract (QIC) conducting appeal services. The CM-Maximus system contains contact information and medical information about Medicare beneficiaries and contact information about Medicare providers. The information on Medicare beneficiaries and providers is obtained from the Medicare Appeals System (MAS), which is another CMS information system. MAS maintains its own PIA for the information collected, stored, and shared within it. It also contains correspondence with beneficiaries and providers about the status of the Medicare appeal.

Maximus is a CMS direct contractor and only Maximus employees are system users. To access the CM-Maximus system, users provide their user ID and password to obtain access to the system. User credentials are maintained for as long as necessary

• Social Security Number
• Name
• E-Mail Address
• Phone Numbers
• Medical Notes
• Date of Birth
• Photographic Identifiers
• Mailing Address
• Legal Documents
• Other - Medicare Beneficiary Identifier (MBI), Health Insurance Claim Number (HICN), Username, Password, NPI

• Employees
• Public Citizens
• Patients

• Online
• Hard Copy
• Mail/Fax

The CM-Maximus system does not directly notify individuals that their personal information is being collected because the system uses personal information from the MAS system. However, providers and beneficiaries are informed on the appeal request form that providing their information is voluntary but failure to provide all or part of the requested information may affect the determination of their appeal.

System users are notified as part of the employment process and to obtain access to the CM-Maximus system that their personal information is required.

The beneficiary and provider PII are required for appeal processing and is received from the MAS system. If the appeals process requires individuals to verify the information in the MAS system, they are notified on the standardized processing letters that the information provided will be used to further document their appeal and that submission of the information requested is voluntary, but failure to provide all or any part of the requested information may affect the determination of the appeal.

System user credentials, PII, are mandatory for system access, so there is no option to opt-out.

System users would be notified of major system changes through internal corporate email and training,

Medicare beneficiaries and providers would find notification of any major changes to the MAS system, and affecting PII, through the updating or revision to the System of Record Notice (SORN) in the Federal Register.

The system uses data directly from the Medicare Appeals System (MAS) which is the appeals system of record.

The PII contained in the CM-Maximus system is routinely backed up to ensure availability. User PII is protected and can only be modified by system administrators and is regularly reviewed for relevancy and accuracy. The PII of beneficiaries is verified with the MAS for accuracy and relevancy at the time of appeal case creation and reviewed throughout the appeal process, maintaining the integrity of the PII. 

• Users: Users have access to PII in order to process second level Medicare appeals.
• Administrators: Administrators have access to PII to support proper system operation. In addition, administrators need access to create, review, and manage system user accounts.
• Contractors: Direct contractors, in their roles as users or administrators have access to PII in the system to process appeals or support the system's operation and to create, review and manage employee user accounts.

The system’s administrative security controls consist of policies and procedures including security training, role-based access permissions and regular review of access logs and activities. 

The system’s technical security controls consist of restricting access using user ids and passwords, and firewalls and intrusion prevention. Technical protection is also achieved through continuous monitoring for system usage and unexpected or malicious activity; the configuration of specialty hardware and the use of encryption, including full disk encryption of laptops and workstations. 

The system’s physical security controls consist of restricted access and environmental protections. Which consist of protected cooling and power sources. Access to this area is recorded and restricted only to authorized personnel with appropriate security clearance. Facility access is controlled using badge access card readers. Designated high security areas are only accessible to approved personnel. Physical equipment and media are subject to documented handling procedures, including proper disposal and destruction as necessary.

• Web Beacons
• Session Cookies