Inquiry Management System

The Inquiry Management System (IMS) utilizes Salesforce ServiceCloud’s out-of-the-box workflow rules or process builder to automate the workflow steps namely – Intake, Triage, Addressing the Inquiry, and Reporting.

Additional tasks include:

Utilize role-based access to implement the Case Coordinator, Subject Matter Expert (SME), Reviewer, and Business Administrator roles in the application.

IMS is available on multiple browsers, including the following versions running on the Windows platform: Microsoft® Internet Explorer® 11 and Apple® Safari® version 12.x on macOS; the most recent stable versions of Microsoft Edge, Mozilla® Firefox®, and Google Chrome™ are also supported. The Salesforce email-to-case functionality shall be utilized to create a case when emails are sent to the following Outlook mailboxes:

Riskadjustment@cms.hhs.gov

Riskadjustmentoperations@cms.hhs.gov

Case numbers are text/numeric/alphanumeric, with the option of being auto generated by Salesforce.

Users are able to complete fields using various methods such as text fields, date fields, check boxes and dropdown menus.

SMEs and reviewers have the ability to upload supporting documents in multiple formats to support various case management tasks.

IMS sends notifications and reminders if tasks are delayed or left uncompleted for any reason.

Users log in to view requests, including processing times.

The system sends timely reminders and alerts to SMEs or reviewers using Salesforce workflows and email alerts to decrease processing times.

The IMS application utilizes services provided by Salesforce used as Platform as a Service (PaaS) that includes all requirements to develop and deploy an IT solution within the cloud including:

Infrastructure

Development Coding/Software

Network

Security

IMS collects and stores:

• E-mail address
• First Name
• Last name
• Phone Number
• Organization Name
• Organization Address
• Enterprise User Administration (EUA) ID

IMS does not retrieve any data using PII elements.

In 1997, the Balanced Budget Act, Public Law 105-33, established the Medicare + Choice program, (later renamed as the Medicare Advantage (MA) Program), which authorizes the Centers for Medicare and Medicaid Services (CMS) to enter into contracts with a variety of different managed care entities to provide and underwrite Medicare benefits on a risk basis. Over the past several years, the MA program has seen dramatic growth. Today, more than 23 million individuals, representing about 35% of Medicare beneficiaries, are enrolled in the MA program. The entities providing original Medicare benefits (and often Medicare Part D prescription drug benefits, too) under the MA program are referred to as Medicare Advantage Organizations (MAOs).

The Medicare Plan Payment Group (MPPG) is responsible for calculating and making monthly capitated payments to Medicare Advantage Organizations (MAOs) for the provision of medical services and items to Medicare beneficiaries under Part C as well as payments for the Medicare prescription drug benefit under Part D. MPPG regularly receives inquiries from MAOs and other entities.

The Inquiry Management System (IMS), which is developed, operated and maintained by Radiant Infotech (CMS contractor), utilizes the Salesforce Service Cloud, enhances the current inquiry management process by modernizing the workflow and tracking inquiries throughout the life of the inquiry, resulting in timely resolution of all inquiries. IMS provides the following:

Efficient workflow for the mailbox management process, including receiving new inquiries automatically through the Outlook mailboxes, automatically assigning the responsible party, notifying the responsible party, and sending responses back to inquirers.

Increased transparency by storing responses and providing users the ability to look at inquiries based upon similar topics and by historical inquiries received by inquirers.

Improved reporting including reports identifying time to resolve cases, time spent on certain tasks within the workflow, aging, inquiries by user, status or category, user activity reports, etc.

MAO staff do not access, log into or use the IMS. MAO staff can only initiate cases by sending an email inquiry to select MPPG mailboxes, as described in section PIA-011.The IMS may store and collect the following information for MAO staff.

E-mail address

First Name

Last Name

Phone Number

Organization Name

Organization Address

The IMS is used by CMS employees, and well as by Vendors/Suppliers/Contractors, to process these inquires. These IMS users log into the system using their EUA credentials, which are stored in the CMS EUA system and Okta. The IMS does not store or collect user login credentials (such as EUA password, MFA preference, MFA tokens, etc.). The IMS stores only the following for these user categories:

EUA ID

E-mail address

First Name

Last name

Phone Number

Organization Name

Organization Address

IMS does not retrieve any data using PII elements. 

• Name
• E-Mail Address
• Phone Numbers
• Date of Birth
• Other - IMS collects and stores: E-mail address First Name Last name Phone Number Organization Name Organization Address EUA ID

• Employees
• Vendors/Suppliers/Contractors
• Other - MAO Staff

• Email
• Other - CMS employees project team members

• Within the OPDIV
• Other HHS OPDIV

• Other - Contractors

• Users: CMS Employees from MPPG Risk Adjustment Operations as well as Policy Divisions, other contractors as deemed appropriate by CMS. They need access to the system to perform their day-to-day tasks.
• Administrators: IMS System Administrators need access to the system to perform their day-to-day tasks.
• Developers: They need access to the system to perform their day-to-day tasks of development and release of new functionalities
• Contractors: MPPG-IMS System Administrator, CMS Employees from MPPG Risk Adjustment Operations as well as Policy Divisions, other contractors as deemed appropriate by CMS. They need access to the system to perform their day-to-day tasks. Contractors are direct contractors

The System Administrator's job responsibility includes the ability to create, assign, and remove access to the IMS modules. No other users have this job responsibility, and they are solely responsible for managing user access.  MPPG-IMS employs the concept of least privilege for Administrator specific duties and information systems in accordance with risk assessments to mitigate risk to CMS operations, assets, and individuals. Application uses Role Based Access Control (RBAC) to perform system security administration such as account maintenance, security log review, and applying access controls and permissions. Administrators have access to the bare minimum of PII in order to do their jobs of creating and removing user access in the system. For security model, we adopt least privilege approach. Using access request tools, we only grant access to a user to data that is needed to perform day-to-day jobs. If elevated access is required temporarily for troubleshooting purposes, etc. we audit users’ actions and promptly remove once the assigned task is complete.

The CMS users and direct contractors will have access the system to perform their daily task. We are calling them direct contractors because they use HHS credentials (EUA ID) to access the system. The system administrator will assign the IMS roles that these users will have based on role authorization matrix provided by CMS Management.

Roles Based Access Control (RBAC) will be implemented and enforced for all IMS users.