Medicare Part B Shared System Claims Processing Maintenance

The information in MCS includes name, date of birth, social security number, mailing address, phone numbers, medical record numbers, medical notes, financial account information and/or numbers, certificates, device identifiers, email address, military status, employment status, education records, health insurer name/plan, health insurer group number, patient marital status, and claims forms for the purpose of processing and paying claims. 

MCS manages the system's user credentials. Users are CMS employees and direct contractors. User credentials are user ID and password and are synchronized by the CMS Enterprise User Administrator system (EUA).

MCS provides ongoing Medicare Part B claims for physician care, durable medical equipment, and other outpatient services, nationwide claim support, and system maintenance. The information collected, maintained or disseminated includes test data, change requests to the application code or system and patient claims processing.

The MCS Test and Development System requires User system login credentials for identifications and authentication to retrieve system records. 

MCS regularly retrieves information by the beneficiary's name, Health Insurance Claim Number (HICN), and assigned unique physician identification number.

• Social Security Number
• Name
• E-Mail Address
• Phone Numbers
• Medical Notes
• Certificates
• Education Records
• Military Status
• Date of Birth
• Mailing Address
• Medical Records Number
• Financial Account Info
• Device Identifiers
• Employment Status
• Other - Health Insurer name/plan, Health insurer group number, Patient marital status, Claims forms, User credentials, Physician identification numbers, Medicare Beneficiary Identifier.

• Employees
• Public Citizens
• Patients

Information is shared to verify patient data between Medicare Insurers, if necessary, as well as beneficiary entitlement and accuracy of payment.

Internal system user's PII is collected to verify the system user's identity and credentials.

The SSN identifies beneficiary data within MCS through the Health Insurance Claim Number (HICN) in production only at the Virtual Data Centers (VDCs) but not in the MCS Test and Development system.

The function of the SSN is internal to CMS. Instead the Medicare Beneficiary Identifier (MBI) is used for external outward facing interfaces.

The MCS Test and Development systems have been de-identified and do not contain real SSNs.       

• In-Person
• Online

• Within the OPDIV

• Members of the Public

OMB CONTROL NUMBER: 0938-1197

Expiration Date: 10/31/2023

For the beneficiary, written notice is given when the beneficiary initially enrolls in the Medicare program, and written or orally each time the beneficiary applies for service at a provider. 

For the MCS system users, written notice is provided as part of the employment process.

When a beneficiary’s data is collected and sent to the MCS system, the beneficiary has already agreed to share their information, so there is not an ability for them to opt out of PII data collection. 

The MCS system users cannot opt out of providing PII because it (user credentials) is necessary to access the system. 

Individuals are notified annually in the Medicare & You handbook of their right to file a complaint if they believe their privacy rights have been violated.  A phone number is included in the handbook and there is more information on www.medicare.gov.  The phone number is 1-800-Medicare.  

For system users, they would contact the CMS IT help desk either by telephone or email and describe the issue. The IT help desk will investigate and determine how to resolve the concern. 

• Users: MCS system users have access to PII to process claims.
• Administrators: MCS system users have access to PII to process claims.
• Contractors: CMS direct contractors in their roles as users or administrators have access to PII to process and review claims, to grant access to the system and review controls, to test new application code for desired results, and to correct program errors encountered in operations.

Security Awareness and Privacy training is required for CMS employees and direct contractors on an annual basis. Users acknowledge successful training after passing a test at the end of training and the system verifies completion. Included in the training is education about how to properly handle sensitive data.

Security personnel receive job related training by attending conferences, forums, and other specific training on an annual basis. Security based role training is recorded within the security department.

The administrative controls include: access to the systems is given based on need to know and job responsibilities; system maintainers use security software and methods to provide “least privilege access.” External audits also verify these controls. 

Technical controls used include user identification, passwords, firewalls, virtual private networks and intrusion detection systems. 

Physical controls used include guards, identification badges, key cards, cipher locks and closed-circuit televisions.