Healthcare Integrated General Ledger Accounting System

The Healthcare Integrated General Ledger Accounting System (HIGLAS) is a federal financial system used by the Centers for Medicare & Medicaid Services (CMS) to support legislative mandates, including the 2003 Medicare Prescription Drug, Improvement, and Modernization Act (MMA).

HIGLAS provides CMS’s ability to process Medicare, Medicaid, (Part A, Part B, Children's Health Insurance Plan [CHIP], Durable Medical Equipment [DME], Railroad Retirement Board [RRB]), Center for Consumer Information and Insurance Oversight (CCIIO) Insurance Exchanges, and Administrative Program Accounting (APA) data. HIGLAS is the CMS system of record for financial transactions and financial reporting.

The Consolidated Budget System (CBS) is a component of HIGLAS that supports the implementation of a fully integrated budget formulation and execution business system. CBS supports CMS’s ability to produce agency-wide budget deliverables by automating many of the manual business processes inherent in budget development.

The Healthcare Integrated General Ledger Accounting System (HIGLAS) is a uniform, integrated, accounting system that is used to process Medicare, Medicaid, Children's Healthcare Insurance Program (CHIP), and Affordable Care Act payments.  The HIGLAS Medicare Administrative Contractors (MACs) use Health Insurance Claim (HIC) numbers, Social Security Numbers (SSN), Employee Identification Numbers (EIN), Taxpayer Identification Numbers (TIN), Financial Account Information, names, date of birth (DOB), mailing addresses, e-mail addresses, and phone numbers to verify individual payees' payments, bank accounts, and routing numbers for the purpose of timely processing and payment of claims.

Personally Identifiable Information (PII) data is acquired and used by the Internal Revenue Services (IRS) for taxes and claims payments; Department of Treasury for debt collection and claims payments; and the Social Security Administration (SSA) for SSN and name validation. These entities have their own PIAs. Information is stored permanently based on NARA records retention schedule.

• Social Security Number
• Name
• E-Mail Address
• Phone Numbers
• Taxpayer ID
• Date of Birth
• Mailing Address
• Financial Account Info
• Date of Death
• Other - Health Insurance Claim (HIC) number, Employee Identification Numbers (EIN), Taxpayer Identification Numbers (TIN), Name + Salary, and Patient Control Number (PCN).

• Employees
• Business Partners/Contacts (Federal, state, local agencies)
• Vendors/Suppliers/Contractors
• Patients
• Other - Medicare, Medicaid, and Children's Health Insurance Program (CHIP) Beneficiaries

• Within the OPDIV
• Other HHS OPDIV
• Other Federal Entities

• Within HHS: Information is shared with the Health and Human Services (HHS) Office of Inspector General (OIG) auditors and annual Chief Financial Officer (CFO) Auditors. The information is shared so that Auditors may verify accuracy of payments and payees.
• Other Federal Agency/Agencies: Internal Revenue Services (IRS) for taxes and claims payment, Treasury for debt collection and claims payment, and the Social Security Administration (SSA) for SSN/name validation

HIGLAS does not collect PII directly from individuals.

The collecting agency/information systems (listed below) which directly collect the PII sent to HIGLAS are responsible for providing individuals information about the use of their PII.  Those systems are covered by their own PIAs.

Treasury, Social Security Administration (SSA), Internal revenue Services (IRS), Department of Health & Human Services (HHS), National Institute of Health (NIH), CMS Automated Plan Payment Systems (APPS), CMS Benefits Coordination & Recovery System (BCRC), CMS Direct Billing System, Fiscal Intermediary Shared System (FISS), Marketplace Data Exchange, Medicaid & Children' Health Insurance Program Budget Expenditure System, Multi-Carrier System, Quality Improvement and Evaluation System, ViPS Medicare Shared System, CMS Component, CMS Concur Government Edition (CGE), Medicare Secondary Payer Systems Contractor - Major Application, ViPS Medicare Shared System. 

HIGLAS does not have an option for opt out.

Opt out is the responsibility of the agency/information systems (listed below) which directly collect the PII sent to HIGLAS. Those systems are covered by their own PIAs.

Treasury, Social Security Administration (SSA), Internal revenue Services (IRS), Department of Health & Human Services (HHS), National Institute of Health (NIH), CMS Automated Plan Payment Systems (APPS), CMS Benefits Coordination & Recovery System (BCRC), CMS Direct Billing System, Fiscal Intermediary Shared System (FISS), Marketplace Data Exchange, Medicaid & Children' Health Insurance Program Budget Expenditure System, Multi-Carrier System, Quality Improvement and Evaluation System, ViPS Medicare Shared System, CMS Component, CMS Concur Government Edition (CGE), Medicare Secondary Payer Systems Contractor - Major Application, ViPS Medicare Shared System.

HIGLAS does not have an option for individuals to provide consent.

The process to notify and obtain consent from individuals whose PII is in the system is the responsibility of the agency/information systems (listed below) which directly collect the information sent to HIGLAS. Those systems are covered by their own PIAs.

Treasury, Social Security Administration (SSA), Internal revenue Services (IRS), Department of Health & Human Services (HHS), National Institute of Health (NIH), CMS Automated Plan Payment Systems (APPS), CMS Benefits Coordination & Recovery System (BCRC), CMS Direct Billing System, Fiscal Intermediary Shared System (FISS), Marketplace Data Exchange, Medicaid & Children' Health Insurance Program Budget Expenditure System, Multi-Carrier System, Quality Improvement and Evaluation System, ViPS Medicare Shared System, CMS Component, CMS Concur Government Edition (CGE), Medicare Secondary Payer Systems Contractor - Major Application, ViPS Medicare Shared System,

Any suspected or confirmed loss of PII is reported to the CMS Help Desk and Incident Response Teams in accordance with federal and agency requirements and policies / within 60 minutes of identification.

The CMS Privacy Office is responsible for addressing individual's concerns by providing the following: Breach notification as needed and without unreasonable delay, in coordination with HHS as well as individuals affected by the breach. The notification includes: the source of the breach, a brief description of the breach, the date it was discovered, and the type of PII involved.
Also included is whether or not the information was encrypted, what steps individuals should take to protect themselves from potential harm, what the agency is doing to resolve the breach, and who to contact for any additional information or for questions. 

• Contractors: Direct Contractors - Support in the development and ongoing maintenance of HIGLAS.

  Medicare Administrative Contractors (MACs) - Access Health Insurance Claim (HIC) numbers to accurately verify claims payments to Medicare/Medicaid/CHIP beneficiaries.

Per CMS Records Disposition Manual 

Bucket 1 Leadership and Operations Records. DAA-0440-2015-0001-0001. Transfer to the National Archives 15 years after cutoff.

Bucket 3 Financial Program Records. Disposition Authority DAA-0440-2015-0004-0001.  Destroyed no sooner than seven (7) years after cutoff.

Bucket 5 Beneficiary Records. Disposition Authority DM-0440-2015-0007-0001.  Destroyed no sooner than 10 years after cutoff.

Access request must be approved by the user's Manager before they can be granted access to the system.  Users who no longer require access to the system are removed promptly.

Some of the technological controls providing IT security services to this system include access control with denial by default implementation, multi-layer firewall architectures, the use of passwords and two factor authentication, least privilege implementation of user access rights with only proven need to know as the approval criteria, and complete auditability of all sensitive transactions with individual accountability. Some of the physical controls include perimeter fencing, Closed Circuit TV (CCTV) monitoring, armed security guard patrolling, raised caged floors, required security clearances, and restricted access to the server room.