Medicare Exclusion Database

The system collects the Excluded Provider information such as Name, Date of Birth, Social Security Number (SSN), Employer Identification Number (EIN) and Exclusion related data provided by the CMS Office of Inspector General (OIG).  

Access control information is maintained and controlled within the CMS Enterprise User Administration (EUA) and Enterprise Identity Management (EIDM) systems.

The CMS Office of Inspector General (OIG) generates the List of Excluded Individuals and Entities who are excluded from participating in the Medicare Program. The Medicare Exclusion Database (MED) application receives the excluded provider information from OIG monthly basis and MED is responsible for adding new sanctions and updating the existing data. The data is shared with approved users using an online web application available at MED CMS Homepage and as downloadable files through the CMS Managed File Transfer (MFT) application with various user communities such as Medicare Contractors, Law Enforcement Agencies, State Medicaid Agencies, and other CMS applications etc.

The access to the MED and MFT site is managed through CMS Enterprise Identity Management (EIDM) and access can be requested through the CMS Portal website EIDM Login Portal.

The System collects information such as Name, Date of Birth, Social Security Number (SSN), Employer Identification Number (EIN) and Exclusion related data, provider sanctions, reinstatements, a list of MED users from EIDM, and the provider information from National Plan and Provider Enumeration System (NPPES). The excluded provider information from OIG is compared with the provider information from NPPES to ensure data quality and consistency.

At the end of monthly processing of sanctions and reinstatements data, the database is updated to provide the latest information about the excluded providers and the downloadable files are made available that includes current month's sanctions, reinstatements, cumulative sanctions, cumulative reinstatements, and any waiver data.

As a part of monthly data maintenance and in response to data questions, the staff retrieves the PII data from the MED system using various search criteria such as SSN, Last Name, Date of Birth, and NPI ID.

• Social Security Number
• Name
• E-Mail Address
• Phone Numbers
• Taxpayer ID
• Date of Birth
• Mailing Address
• Other - National Provider Identifier (NPI) number; Employer Identification Number (EIN) and Exclusion related data, provider sanctions, reinstatements, a list of MED users from EIDM

• Other - The system received from National Plan and Provider Enumeration System (NPPES) and Office of Inspector General (OIG). Files are transmitted via Secure File Transfer

• Within the OPDIV
• Other HHS OPDIV

• Within HHS: The MED data is shared within HHS and used by the CMS Provider Enrollment Chain and Ownership System (PECOS) to check for the excluded provider and by the Integrated Data Repository (IDR) through One Program Integrity (One PI) to perform analysis of fraud, waste, and abuse.

  Additionally, we shared data with Carriers, Fiscal Intermediaries, Payment Safeguard Contractors, Zone Program Integrity Contractor, and Medicare Advantage Payers also use MED data to identify and refuse payment to the excluded providers.

• Private Sector: The Private Medicare Contractors refer to MED data to exclude any providers from providing the Medicare Services.
• State or Local Agency/Agencies: The State Medicaid agencies also use the MED data to verify the enrollment into the State Medicaid Program.

• Users: The users of MED online application have access to PII to identify the individuals and business entities that are excluded from Medicare Program.
• Administrators: The database administrators and system administrators have privileged access to the systems to perform routine maintenance and upgrades for the operating system, databases, and other supporting applications. As such these users have access to locations where the PII is stored.
• Developers: Developers are responsible for maintaining and adding new functionality to the application. Additionally, they are required to support CMS enterprise application changes/upgrades, perform problem resolution within MED application and testing the data and functionality.
• Contractors: Direct contractors perform the operation and maintenance tasks of the system. Additionally, they assist in running monthly data update process and performing data corrections.

The excluded provider PII information in MED is saved permanently because MED system serves both current operational needs as well as long-term knowledge management requirements for preserving institutional history and facilitating research on historical data that related to current matters. However, the PII information obtained from National Plan and Provider Enumeration System (NPPES) is kept temporarily and deleted each month.

National Archives and Records Administration (NARA) record schedule is N1-440-09-18, items 1a,1b, and1c.

Administrative Controls:

The MED application implements all applicable CMS security controls to protect the PII. The implementation of controls is documented under System Security Plan (SSP), Contingency Plan (CP) and Risk Assessment (ISRA) plan. Various reviews are performed periodically, such as accounts review, application access log review, audit log review etc. to ensure data protection and compliance. Additionally, all employees and contractors who have access to PII data are required to take annual Security & Privacy Awareness Training.

Technical Controls:

MED application uses CMS Enterprise Identity Management (EIDM) system for access management. The application uses Multifactor authentication for access, implements role-based security and functionality, inactivity session time-out and maintains audit trial history.

Physical Controls:

The MED application is housed in a secured CMS AWS data center and uses physical controls such as Armed security guards, Identification Badges, Key Cards, periodic access review and Closed-Circuit TVs.