Medicaid-CHIP Payment Error Rate Measurement – NCI RC

The Medicaid-CHIP Payment Error Rate Measurement - Navigate Collaborate Innovate Review Contractor system (PERM NCIRC) does not collect Personally Identifiable Information (PII) or Protected Health Information (PHI) directly from individuals that receive Medicaid and CHIP benefits. The system conducts reviews of medical claims and medical records that originate from a CMS processing system that include phone numbers, medical notes, date of birth, mailing address, medical record ID, Insurance Claim Number (HICN), patient International Classification of Diseases (ICD) diagnosis description and notes from the provider about the patient. The system will collect and maintain user credentials (i.e., name, usernames and passwords) for PERM NCIRC system users, developers and administrators to control system access. 

Information collected, maintained and shared from the CMS processing system will be used by the PERM NCIRC system to: (1) Support regulatory and policy functions performed within the Agency or by a contractor, consultant or grantee; (2) assist another Federal or state agency in the proper administration of the Medicare program, enable such agency to administer a Federal health benefits program, and/or assist Federal/state Medicaid programs within the state; (3) support constituent requests made to a Congressional representative; (4) to support litigation involving the Agency related to this system; and (5) combat fraud and abuse in certain health benefits programs.

The Payment Error Rate Measurement (PERM) system performs the following functions:

Medical Reviews - Includes sampled Fee-for-Service (FFS) claims information, as part of the review of the provider’s medical record supporting the service(s) claimed, Code of Federal Regulations that are applicable to conditions of payment, and the State’s written policies to determine whether the service was medically necessary, reasonable, provided in the appropriate setting, billed correctly, and coded accurately.

PERM Data Processing Reviews – Includes sampled FFS and managed care payments information, which involves on site or remote reviews of the claim and other information available in the State’s Medicaid Management Information System, related systems, or outside sources of provider verification.

Eligibility Reviews – Includes information on sampled eligibility cases pertaining to active case reviews, such as reviews of last caseworker actions. The system also includes negative case review information, such as review of caseworker actions to deny or terminate recipient from Medicaid/CHIP coverage.

Information stored in the system required to perform payment error reviews include the following: name, phone number, mailing address, date of birth, patient's Health Insurance Claim Number (HICN), PERM NCIRC usernames and passwords, Medicaid and CHIP identification number, Medicaid and CHIP claims data, provider's medical records, claim numbers, managed care capitation payment data, and eligibility-related information on the Medicaid and CHIP beneficiaries included in the eligibility sample.

• Name
• Phone Numbers
• Medical Notes
• Date of Birth
• Mailing Address
• Medical Records Number
• Other - The system will also collect patient's Health Insurance Claim Number (HICN), patient International Classification of Diseases (ICD) diagnosis description and notes from the provider about the patient. The system will also collect and maintain user credentials (i.e., name, usernames and passwords) for PERM NCIRC system users, developers and administrators to control system access.

• Employees
• Public Citizens
• Business Partners/Contacts (Federal, state, local agencies)
• Vendors/Suppliers/Contractors
• Patients
• Other - Medicaid and CHIP Beneficiaries.

• Within the OPDIV
• Other - The PERM NCIRC system conducts reviews of medical claims and medical records received online, that originate from a CMS processing system.

• Other - The system collects PII from system users, developers and system administrators (i.e., usernames and passwords).

The PERM NCIRC system does not collect PII or PHI directly from individuals receiving Medicaid and CHIP benefits. The PERM NCIRC system retrieves Medicare records and claims directly from CMS systems, MMIS (Medicaid Management Information System) and TMIS (Transformed Medicaid Statistical Information System). 
 
Therefore, providing prior notice to individuals regarding the collection of their PII and PHI related information is the responsibility of the originating CMS processing systems. However, Medicare beneficiaries sign a Privacy Act notice when they become eligible for Medicaid and CHIP that discloses the information they provide and will be used to determine the appropriateness of Medicaid and CHIP FFS and managed care payments, as well as eligibility. 
 
For PERM NCIRC system users, developers and administrators, a warning banner is displayed prior to logging into the system notifying users that their personal information will be recorded and monitored. Consent to the warning banner is required by all users prior to accessing the PERM NCIRC system.

Medicaid Management Information System (MMIS) and Transformed Medicaid Statistical Information System (TMIS) are covered by separate PIAs. 

PERM NCIRC conducts reviews of medical claims and medical records that originate from CMS processing systems, MMIS (Medicaid Management Information System) and TMIS (Transformed Medicaid Statistical Information System). Therefore, individuals who receive Medicaid and CHIP benefits that want to opt-out, must contact the CMS processing systems in which the data originates. 

PERM NCIRC does collect PII from system users, developers and administrators. System users, developers and administrators cannot opt-out of PII (username and password) because this information is required for system access. 

PERM NCIRC conducts reviews of medical claims and medical records that originate from CMS processing systems, MMIS (Medicaid Management Information System) and TMIS (Transformed Medicaid Statistical Information System). Therefore, the process to notify and obtain consent of individuals receiving Medicaid and CHIP benefits is a function of the originating CMS processing system.   

However, PERM NCIRC system users, developers and administrators are notified by email if there are any changes to the use of their PII.  

PERM NCIRC conducts reviews of medical claims and medical records that originate from separate CMS processing systems, MMIS (Medicaid Management Information System) and TMIS (Transformed Medicaid Statistical Information System). Therefore, individuals who receive Medicaid and CHIP benefits that want to resolve how their PII and PHI is obtained, used, or disclosed, must contact the CMS processing systems in which the data originates. 

However, PERM NCIRC system users, developers and administrators can contact the PERM NCIRC help desk for any issues related to their PII being inappropriately obtained, used, disclosed, or that the PII is inaccurate. 

• Users: PERM NCIRC system users access PII on the system to perform the following job functions:
  
  Review of the provider’s medical record supporting the service(s) claimed, Code of Federal Regulations that are applicable to conditions of payment, and the State’s written policies to determine whether the service was medically necessary, reasonable, provided in the appropriate setting, billed correctly, and coded accurately.
  
  On site or remote reviews of the claim and other information available in
  the State’s Medicaid Management Information System, related systems,
  or outside sources of provider verification.
  
  Active case reviews – Review of the last caseworker action for recipients on the
  Medicaid/CHIP eligibility rolls.
  
  Negative case review – Review of caseworker action to deny or terminate
  recipient from Medicaid/CHIP coverage.

• Administrators: Database administrators have access to PHI due to their elevated permissions that are required to perform daily database administrative functions.

• Developers: Developers are responsible for developing and testing of the PERM NCIRC application components and therefore will have access to PII and PHI in the process.

• Contractors: The contractor (both direct and non-direct/independent) performs user, administrative and developer functions previously mentioned for PERM NCIRC.