COMPASS WEB

Livanta LLC (“Livanta”) is a Medicare Beneficiary and Family Centered Care - Quality Improvement Organization (BFCC-QIO) that contracts with CMS to perform medical record review functions, including quality of care reviews, beneficiary complaint reviews, discharge, and termination of service appeals in various provider settings, medical necessity reviews, and Emergency Medical Treatment and Labor Act (EMTALA) reviews, among others, for which payment is made under Medicare. Livanta is one of two BFCC-QIOs that perform these services in the U.S. and manages case reviews for CMS Regions 2, 3, 5, 7, and 9.

Livanta also provides CMS with nationwide claim review services as part of its BFCC-QIO duties.

CompassWeb is the internal application/system Livanta uses to support those services.

QIOs are authorized under Title XI Part B, Title XVIII, and Sections 1152-1154 of the Social Security Act. The QIO Program is an essential resource in CMS’s effort to improve the quality and efficiency of care for Medicare beneficiaries by expeditiously addressing individual Medicare beneficiary complaints, provider-based notice appeals, violations of the Emergency Medical Treatment and Labor Act (EMTALA), and other Medicare beneficiary concerns outlined within the QIO regulations/law.

Livanta uses CompassWeb to collect and maintain the following beneficiary information:

Names;
Dates of birth;
Mailing addresses;
Phone numbers;
Medical records and notes;
Medical records numbers;
Legal documents (e.g., powers of attorney);
Device identifiers;
Employment status;
Health Insurance Claim Numbers (HICN); and
Medicare Beneficiary Identifier (MBI).

The system also collects and maintains information about the entity providing healthcare services, including

Names;
Mailing addresses;
Email addresses;
Phone numbers;
Fax numbers;
National Provider Identifiers (NPI); and
Medicare Provider Numbers, as well as pre-decisional and decisional information about the discharge process, the quality of care received, the medical necessity, and coding correctness of services rendered.
Quality of Care Reviews, including beneficiary complaint reviews and general quality of care reviews;
Beneficiary appeals of denials of hospital admissions, discharge and termination of services (Grijalva, BIPA and Weichardt appeals);
Reconsiderations;
Medical Necessity Reviews;
EMTALA Reviews;
Sanctions and/or Sanction Activities;
Quality Improvement Initiatives (QIIs);
Monitoring Physician Acknowledgement Statement;
Person/Patient and Family Engagement including Immediate Advocacy;
Pre-Admission/Admission Hospital Issued Notice of Non-coverage (HINN);
Short Stay (2 Midnight) Reviews;
Higher-Weighted Diagnosis Related Group (HWDRG) Reviews;
Readmissions Reviews;
Any additional statutory requirements.

CompassWeb is used to record and share medical record review data and case notes from Livanta authorized employees and approved subcontractors. Additionally, CompassWeb is used to compose, send, and store determination letters to providers and beneficiaries and run reports on statistical and other management data.

The CompassWeb system is a Livanta-maintained, standalone system. Livanta authorized employees and approved subcontractors are not direct contractors of CMS and do not have HHS credentials. However, the system stores the required user identities and credentials, e.g., username and password, for its authorized Livanta users. No CMS employees access this system.

As a Beneficiary and Family Centered Care-Quality Improvement Organization (BFCC-QIO), Livanta conducts various Medicare beneficiary medical reviews. These include but are not limited to, quality-of-care reviews (encompassing beneficiary complaint reviews and general quality of care reviews), beneficiary discharge and termination of service appeals, medical necessity reviews, reviews of Emergency Medical Treatment and Labor Act (EMTALA) services, sanctions, coding accuracy for services rendered, and admission necessity reviews. Additionally, Livanta monitors Physician Acknowledgement Statements (PAS).

Livanta employs a medical review application within CompassWeb to facilitate and manage these reviews. The information collected and maintained in CompassWeb is retained for the duration necessary to complete a review and resolution, following CMS QIO retention guidelines.

BFCC-QIO Medicare case reviews are initiated through a phone call, fax, or letter from a beneficiary, a beneficiary representative, a state agency, or other referral sources. At this stage, all relevant beneficiary demographic information is entered into CompassWeb’s predefined fields, including name, date of birth, mailing address, phone number, Medicare Beneficiary Identifier (MBI), Health Insurance Claim Number (HICN), phone number, and review notes. Signed complaint and representation forms are subsequently obtained from the beneficiary or beneficiary representative, where applicable, and are added to the imaging section of CompassWeb.

Beneficiary medical records requests and responses are exchanged with the provider, and these records, including medical record numbers, legal documents (e.g., powers of attorney), and device identifiers, are added to CompassWeb. Provider information, such as name, contact information, address, National Provider Identifier, Medicare provider number, phone number, and fax number, is also entered into CompassWeb. Livanta logs information regarding provider interactions into the system.

For claim review services, authorized Livanta employees and approved subcontractors utilize CompassWeb to review various medical documents and Medicare claims to determine the accuracy of coding and claim status (inpatient vs. outpatient) for services.

Authorized Livanta employees and approved subcontractors use CompassWeb to record and share notes, questions, and decisions for both case and claim reviews. For case and claim reviews, they also use CompassWeb to compose, send, and store determination letters to providers and beneficiaries. Additionally, for both case and claim reviews, Livanta authorized employees and approved subcontractors use CompassWeb to generate reports on statistical and other management data. This information is typically available indefinitely, but in all cases, it will be available for at least six years from the decision date.

Access to the CompassWeb system is restricted to authorized Livanta employees and approved subcontractors through multifactor authentication, which includes a username and password. Once entered, a time-sensitive code is emailed to the user's predetermined email address. The user must then enter the code to gain access to the system.

• Social Security Number
• Name
• E-Mail Address
• Phone Numbers
• Medical Notes
• Date of Birth
• Mailing Address
• Medical Records Number
• Legal Documents
• Device Identifiers
• Employment Status
• Date of Death
• Other - Health Insurance Claim Number (HICN); Medicare Beneficiary Identifier (MBI); Social Security Number (SSN); access credentials (username and password); review notes; correspondence with beneficiaries; correspondence with medical providers; correspondence with Medicare contractors; correspondence with CMS; National Provider Identifier; Medicare provider number; and fax number.
• Therapy records

• Public Citizens
• Vendors/Suppliers/Contractors
• Patients
• Other - Medical providers

Sections 1152-1154, 1156, 1160, and 1171-1179 of the Social Security Act; Section 264(c) of the Health Insurance Portability and Accountability Act of 1996; and Regulations at 42 CFR Part 480 and 45 CFR Parts 160, 162, and 164. 

5 USC Section 301, Departmental Regulations

• In-person
• Online
• Hard Copy Mail/Fax
• Other - Telephone

• Members of the Public
• Private Sector

 - CMS Form 10287, Medicare Quality of Care Complaint Form: OMB Control #: 0938-1102, as amended.  

 - Form CMS-1696, Appointment of Representative: OMB Control #: 0938-0950, as amended.

Exp 8/31/2025

• Within HHS: Information may be shared with the HHS Office of the General Counsel to support HHS litigation positions. Information may also be shared with the HHS Office of the Inspector General to allow that agency to consider sanctions, such as expulsion from the Medicare program, for gross and flagrant violations or continued substantial violations of medical standards of care when treating Medicare patients
• Other Federal Agency/Agencies: Information may be shared with the Department of Justice, for the enforcement of Medicare laws.
• Private Sector: Information may be shared with Medicare beneficiaries themselves and their duly- authorized representatives; Providers; and other Medicare contractors.
• State or Local Agency/Agencies: Information may be shared with state departments of health and the state survey agencies that survey medical facilities for compliance with certification requirements.

• Users: Account reviewers, managers, and approved physicians have access to PII to create, process and manage the Medicare beneficiary cases.
• Administrators: The Information Technology (IT) administrators may access PII, in order to maintain and ensure proper functionality of the systems.
• Developers: Senior Software developers may access PII, in order to maintain the applications and ensure the integrity of the data.
• Contractors: Livanta sub-contractors may access PII, in order to maintain and ensure proper functionality of the Compass Web systems. Contracted physician reviewers' access PII in order to conduct case reviews in accordance with the QIO statement of work.

Compass Web is operated inside the federally accredited Amazon Web Services (AWS) data center. Within AWS, Livanta maintains its virtual private cloud. Only authorized Livanta staff members can access these systems.  Stringent pre-screening measures, ongoing security training, and role-based access controls exist.

Technically, Compass Web is a closed system, meaning it cannot be directly accessed from the Internet. Livanta has implemented the following control layers: users must have an active account, users must have dedicated workspaces (virtual PCs), and users must have valid credential IDs registered to Livanta for multifactor authentication measures. Additionally, staff members must have valid Compass Web accounts to access the main application. Data is encrypted in transition and at rest, and it is also backed up daily.

The AWS facility has layers of robust physical security, including security guards, checkpoints, and identification cards to prevent unauthorized access. It is also video monitored.