Common Electronic Data Interchange

CEDI exchanges Durable Medical Equipment (DME) Medicare Administrative Contractors (MAC) Fee for Service (FFS) and Veteran’s Administration (VA) electronic Medicare Remittance Advice (eMRA) HIPAA electronic transactions to assist with the payment of Medicare claims. CEDI does not directly collect any data directly from providers or beneficiaries. It is an electronic exchange of information.

The Common Electronic Data Interchange (CEDI) Gateway and Translator is a transactional information system. It supports the Medicare program by processing the Durable Medical Equipment (DME) Medicare Administrative Contractor (MAC) Fee for Service (FFS) and Veteran’s Administration (VA) electronic Medicare Remittance Advice (eMRA) HIPAA electronic transactions.

An electronic data interchange is the structured electronic process that is used to transfer information electronically instead of using paper. There is no direct collection of information from beneficiaries or medical providers.

CEDI does not collect information directly from people. There is an electronic interchange of data between CEDI and another CMS data center, the Perspecta Virtual Data Center (VDC). Perspecta VDC creates and maintains a Privacy Impact Assessment (PIA) to describe the security and privacy controls. All files are transferred to and from the Perspecta VDC using Network Data Mover (NDM) Connect: Direct over CMSNet from the CEDI environment to the Perspecta VDC and from the Perspecta VDC into the CEDI environment.

Data files contain name, mailing address, phone numbers, medical records numbers, Social Security number, date of birth, financial account information and medical provider taxpayer ID.

For CEDI system users the data is userID, password, email and phone number.

CEDI exchanges files between Durable Medical Equipment (DME) Medicare Administrative Contractors (MAC) Fee for Service (FFS) and Veteran’s Administration (VA) electronic Medicare Remittance Advice (eMRA) HIPAA electronic transactions to assist with the payment of Medicare claims. CEDI does not directly collect any data directly from providers or beneficiaries. It is an electronic exchange of information.

Data files contain name, mailing address, phone number, medical records numbers, Social Security number, date of birth, financial account information and medical provider taxpayer ID.

For CEDI system users the data is userID, password, email and phone number. To access the system and perform functions and retrieve data in CEDI, the userID and password are used. A warning banner alerts the users that they are accessing a US Government website.

CEDI regularly uses PII of CMS employees and direct contractors, userID, password, to retrieve system records and perform the functions of CEDI. To retrieve some CEDI claims records, medical provider National Provider Identifier (NPI) can be used. For claims records, a beneficiary's last name can be used.

• Social Security Number
• Name
• E-Mail Address
• Phone Numbers
• Taxpayer ID
• Date of Birth
• Mailing Address
• Medical Records Number
• Financial Account Info
• Other - User ID and Password, NPI

• Employees
• Public Citizens
• Vendors/Suppliers/Contractors

Sections 1842, 1862 (b) and 1874 of Title XVIII of the Social Security Act (The Act), (42 United States Code (U.S.C.) 1395u, 1395y (b), and 1395kk)

5 U.S.C. 301, Departmental Regulations

09-70-0501 Medicare Multi-Carrier Claims System: 55 FR 37549 (9/12/90); updated 55 FR 47394 (11/13/90), 59 FR 37243 (7/21/94), 62 FR 6648 (2/21/96), 63 FR 38414 (7/16/98), 65 FR 50552 (8/18/00), 67 FR 54428 (8/22/02), 71 FR 64968 (11/6/06), 78 FR 32257 (5/29/13), *83 FR 6591 (2/14/18)

09-70-0503 Fiscal Intermediary Shared System: 71 FR 64961 (11/6/06); updated 78 FR 32257 (5/29/13), *83 FR 6591 (2/14/18)

The CEDI system notifies system users that their PII is being collected in the warning banner that they are accessing a government system. 

There is no process to notify beneficiaries because CEDI does not directly collect PII from beneficiaries. Beneficiaries would be notified by their medical providers.

For CEDI system users there is no method to opt-out of the collection of PII because it required to access the system by using the userID and password.

There is not an opt-out option for beneficiaries because CEDI does not directly collect PII from beneficiaries. Beneficiaries would be advised by their medical providers about options to opt-out of providing PII.

There is no process in place to directly notify the beneficiaries should major changes occur to the system because CEDI does not directly collect PII from beneficiaries. If there was a major change affecting the PII in the system, then the SORNs that apply to CEDI would be updated and are available for the general public’s access.

Staff that support the CEDI application are notified of any major changes that happen in the system that requires additional PII through CEDI program meetings and communications.

The data transacted through CEDI is in a flat file that cannot be modified or physically reviewed in CEDI. The external sources, claim file information would be verified by Medicare providers, outside the scope of CEDI. 

The PII data of CEDI system users are verified for accuracy and relevancy by access management monitoring (logon activity, password expiration and account latency rules). Integrity is maintained through system security and control processes that are reviewed by external auditors. Availability is maintained through system redundancies.

• Administrators: Administrators provide support for the midrange operating system, database information and infrastructure and may have access to PII of other system support users.  
• Developers: Developers possess access to perform application maintenance. This may include access to other system user PII.
• Contractors: CMS direct contractors in their roles as administrators and developers may have access to PII based on those roles.

The CEDI system(s) follow the Centers for Medicare and Medicaid Services' (CMS) Acceptable Risk Safeguards (ARS) 5.1 for specific security controls guidance.

The CEDI system and supporting infrastructure is housed in a CMS FISMA ATO-ed datacenter. Entry is controlled by Physical Access Cards and facility personnel who limit access to individuals who have a legitimate business or technical need to enter the facility. The facility has fire suppression and alarms and constantly monitored HVAC systems to ensure environmental controls.

Administrative controls implemented for the CEDI system include role-based access, training of personnel and regular account review, which includes disabling accounts.

The technical controls in place include network firewalls, two-factor authentication, anti-virus protection and encryption of information.