Medicare Secondary Payer Systems Contractor - Major Application

To gather information in an effort to identify the health benefits available to Medicare beneficiaries, which involves the collection, management, and reporting of other insurance coverage.  This ensure the accuracy and timeliness of updates to Medicare’s eligibility and entitlement databases housed in other Centers for Medicare and Medicaid Services (CMS) systems.

To consolidate the activities of Coordination of Benefits and Recovery (COB-R) and Medicare Secondary Payer (MSP), and to manage the performance of all activities that support the collection, management, and reporting of other insurance coverage of Medicare beneficiaries and the collection of conditional payments or mistaken primary payments. It supports internal and external Medicare Secondary Payer (MSP) customers.

To identify and track cases of mistaken and conditional payments that are to be recovered by the Centers for Medicare and Medicaid Services (CMS). Medicare Secondary Payer Systems Contractor - Major Application (MSPSC MA) provides case creation and tracking, letter generation, and a standard reporting capability Core functions: 1) to identify Medicare Secondary Payer (MSP) debt in a more timely manner, 2) to manage and control Medicare Secondary Payer (MSP) recovery cases in a centralized database, and 3) to be the system of record relative to the status of recovery of Medicare Secondary Payer (MSP) claims by Medicare.

The Medicare Secondary Payer Systems Contractor - Major Application (MSPSC MA) collects and maintains the following information types:

Social Security Number
Email Address
Education Records
Date of Birth
Mailing Address
Financial Account Information
Name
Phone Numbers
Taxpayer ID
Medical Records Number
Employment Status 
User Credentials - (user ID and password) 
Medicare Health Insurance Claim Numbers
Federal Employer Identification Number (EIN)
Federal Tax Identification Number (TIN)
Medicare Beneficiary Identifiers (MBIs)
Medical Record Data (Provider Data, Diagnosis Codes, Dates of Insurance Coverage, Claim Dates)

All public facing websites which fall under the purview of the MSPSC MA are Secure Websites. These websites require credentials to access. Said websites employ the use of Multi-Factor Authentication (MFA).

The Coordination of Benefits and Recovery (COB-R) program is the result of the Centers for Medicare and Medicaid Services (CMS) efforts to consolidate the Coordination of Benefits (COB) and Medicare Secondary Payer Recovery (MSPR) activities into a centralized operation, providing quality customer service and a streamlined process to all stakeholders. To make this effort a success, CMS has partnered with General Dynamics Information Technology (GDIT). GDIT is the original developer and current maintainer of the internal applications that make up the Medicare Secondary Payer Systems Contractor (MSPSC) program which is comprised of the Medicare Secondary Payer Systems Contractor (MSPSC) Major Application (MA).

The goal of combining the COB and MSPR into the COB-R program is to consolidate these activities, the performance of all activities that support the collection, management, and reporting of other insurance coverage of Medicare beneficiaries and the collection of conditional payments or mistaken primary payments.

CMS has established a centralized COB and Medicare Secondary Payer (MSP) operation by consolidating these activities, the performance of all activities that support the collection, maintenance, and reporting of other insurance coverage of Medicare beneficiaries, and the collection of conditional payments or mistaken primary payments. These activities have been performed under two separate contracts in the past. CMS has established a centralized COB and Medicare Secondary Payer Recovery Contractor (MSPRC) operation in order to provide quality customer service and a single source to Medicare providers, suppliers, beneficiaries, insurers, and other stakeholders by streamlining the Medicare Secondary Payer data and debt collection processes while ensuring the integrity of the Medicare Trust Funds. As with any consolidation of efforts for similar functions, savings of time and costs can be realized.

The Medicare Secondary Payer Systems Contractor - Major Application (MSPSC MA) collects and maintains information about persons:

Social Security Number

Email Address

Education Records

Date of Birth

Mailing Address

Financial Account Information

Name

Phone Numbers

Taxpayer ID

Medical Records Number

Employment Status

User Credentials - (user ID and password)

Medicare Health Insurance Claim Numbers

Federal Employer Identification Number (EIN)

Federal Tax Identification Number (TIN)

Medicare Beneficiary Identifiers (MBIs)

Medical Record Data (Provider Data, Diagnosis Codes, Dates of Insurance Coverage, Claim Dates)

• Social Security Number
• Name
• E-Mail Address
• Phone Numbers
• Education Records
• Taxpayer ID
• Date of Birth
• Mailing Address
• Medical Records Number
• Financial Account Info
• Employment Status
• Other - User Credentials - (user ID and password) Medicare Health Insurance Claim Numbers Federal Employer Identification Number (EIN) Federal Tax Identification Number (TIN) Medicare Beneficiary Identifiers (MBIs) Medical Record Data (Provider Data, Diagnosis Codes, Dates of Insurance Coverage, Claim Dates)

• Employees
• Public Citizens
• Business Partners/Contacts (Federal, state, local agencies)
• Patients

• Online

• Within the OPDIV

• Members of the Public
• Private Sector

• Other Federal Agency/Agencies: Shares data with the Department Of Justice (DOJ) for the purpose of recovering monies due to the Trust Fund.

  Shares data with the Department Of Treasury for the purpose of referring delinquent debt for further collection actions.

• Private Sector: Personally Identifiable Information is shared with Section 111 Responsible Reporting Entities and their authorized representatives who are required to report under Section 111 of the Medicare, Medicaid, and State Children’s Health Insurance Program Extension Act of 2007 (MMSEA) (P.L. 110-173), which adds new mandatory reporting requirements for group health plan (GHP) arrangements and for liability insurance (including self-insurance), no-fault insurance, and Workers' Compensation.  See 42 U.S.C. 1395y (b) (7) & (8). for the purpose of recovering monies due to the Trust Fund.

For users of Internet Facing Secure Website Applications: About three months before a beneficiary’s entitlement to Medicare, Initial Enrollment Questionnaire is mailed to the beneficiary. The Initial Enrollment Questionnaire asks whether the beneficiary has other insurance that pays before Medicare. To ensure correct payment of Medicare claims, it is important that Medicare enrollees complete and return the Initial Enrollment Questionnaire timely. Additionally, the following Privacy Act Statement is presented when first navigating to the Individual Application:

The collection of this information is authorized by 42 U.S.C. 1395y(b)(5). The information collected will be used to identify and recover past mistaken Medicare primary payments and to prevent Medicare from making mistakes in the future for those Medicare Secondary Payer situations that continue to exist. In addition, Section 42 U.S.C. 1395y(b)(5)(C)(ii) provides for a civil monetary penalty of up to $1,000.00 per individual for whom an inquiry concerning health coverage was made, to be assessed to any employer (other than a governmental entity) who willfully or repeatedly fails to respond timely, accurately, and completely to this request.

This statement contains information about the privacy and use of information and must be accepted before accessing the application.

Additionally, the following SORNs have been posted on the HHS website to inform the public:

Published: 09-70-501 Medicare Multi-Carrier Claims System

Published: 09-70-0503 Fiscal Intermediary Shared System

Published: 09-70-0526 Common Working File

Published: 09-70-0536 Medicare Beneficiary Database

For Administrators of Internet Facing Applications:  Login Banner Statements are displayed and must be agreed upon prior to access to the Application. The login banner states that employees' actions are monitored while accessing the system and that there is no reasonable expectation of privacy regarding any communication or data transiting or stored on this information system.

CMSNet Facing applications do not collect PII directly from the individual about whom it pertains. The information is supplied by other CMS systems of record. Those systems, Medicare Multi-Carrier Claims System, Fiscal Intermediary Shared System, Common Working File, Medicare Beneficiary Database, National Claims History, and National Provider System, have processes in place to notify individuals that their PII will be collected. They have their own PIAs. These applications also collect user ID and password from internal users in order to log into the system. The only user accounts are those used by the agency or the direct contractor. These accounts are created by request of the individual's employer to perform a job function.

For Users of Internet Facing MSPSC MA Applications: Users are required to review and agree to the Coordination of Benefits - Secure Website (COB-SW) User Agreement, Privacy Policy and Login Warning. In the event of a major change, the System of Record Notice (SORN) will be updated and posted on the HHS website to inform the public. The revised SORN is published in the Federal Register for a 60 day comment period by the public. This system contains Protected Health Information as defined by Health and Human Services (HHS) regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, 65 FR 82462 (Dec. 28, 00), as amended by 66 FR12434 (Feb. 26, 01)). Disclosures of Protected Health Information authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information."
For Administrators: All system administrators are employees to the direct contractor. The direct contractor is responsible for notifying administrators of major changes to the system that may impact PII. Additionally, the login banner states that employees' actions are monitored while accessing the system and that there is no reasonable expectation of privacy regarding any communication or data transiting or stored on this information system.

For CMSNet Facing MSPSC MA Applications: The PII within this system is provided through interconnections with other CMS systems which are documented within the Data Use Agreement (DUA) and is not collected directly from the individuals. In the event of a major change, the System of Record Notice (SORN) will be updated and posted on the HHS website to inform the public.  This system contains Protected Health Information as defined by Health and Human Services (HHS) regulation "Standards for Privacy of Individually Identifiable Health Information" (45 CFR Parts 160 and 164, 65 FR 82462 (Dec. 28, 00), as amended by 66 FR12434 (Feb. 26, 01)). Disclosures of Protected Health Information authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information."

Benefits Coordination Recovery System (BCRS) Application Specifically: The login credentials within this system are provided to users by another CMS system which is Enterprise User Administration (EUA) which has a PIA addresses the process to notify and obtain consent from the individuals.

For the Administrators of CMSNet Facing MA Applications: The only user accounts are those used by the agency or the direct contractor. These accounts are created by request of the individual's employer to perform a job function. The direct contractor is responsible for notifying administrators of major changes to the system that may impact PII. Additionally, the login banner states that employees' actions are monitored while accessing the system and that there is no reasonable expectation of privacy regarding any communication or data transiting or stored on this information system.

• Users: The user uses the data stored in the system to associate claims to beneficiaries for the purposes of gathering claim information and to recover mistaken primary payments when another entity is responsible for primary payment.
• Administrators: The Administrators maintain the system to ensure data Confidentiality, Integrity and Availability.
• Developers: The developers perform development efforts pertaining to the system including troubleshooting and to resolving problems.
• Contractors: Direct contractors use the data stored in the system to associate claims to beneficiaries for the purpose of gathering claim information and to recover mistaken primary payments when another entity is responsible for primary payment.

In addition to the Information Security Awareness training that all employees are required to complete, users, administrators, developers and contractors of the system are also required to complete the following courses as part of their training prior to receiving System access;

HHS Rules of Behavior

The HHS Rules of Behavior (HHS Rules) provides common rules on the appropriate use of all HHS technology resources and information for Department users, including federal employees, interns and contractors.

Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Training

The purpose of this Privacy Training course is to 1) increase HIPAA awareness, 2) define requirements of the Privacy Rule, 3) communicate Privacy policies, 4) provide examples of how Privacy requirements impact operations, 5) identify organizational support contacts, and 6) foster and maintain a culture of integrity  

Culture of Responsibility

This training course is designed to make sure employees are aware of their responsibilities in assuring the protection of customer data that has been entrusted to them.

Users, administrators, developers and contractors CMS employees and contractors with privileged access are also required to complete role-based training at hire and annually thereafter, and meet continuing education requirements commensurate with their role. Other training avenues such as conferences, seminars and classroom training provided by CMS are available apart from the regular annual training.

CMS adheres to data retention and destruction policies/procedures that closely follow National Archives and Record Administration (NARA) guidelines related to data retention. Specifically, the Medicare Secondary Payer Systems Contractor - Major Application (MSPSC MA) adheres to NARA General Records Schedule (GRS) 3.2 Item 31 - System Access Records and NIST guidelines related to data destruction.

PII is stored for 7 years per NARA GRS 3.2 standards.

• Section111/MRA
  • PROD
    • https://cob.cms.hhs.gov/Section111                       
• ECRS
  • PROD
    • https://cob.cms.hhs.gov/ECRS                                                                   
• MSPRP
  • PROD
    • https://cob.cms.hhs.gov/MSPRP/                                                   
• CRCP
  • PROD
    • https://cob.cms.hhs.gov/CRCP/                                                     
• WCMSA
  • PROD
    • https://cob.cms.hhs.gov/WCMSA/                                                                        
• EDI
  • PROD
    • https://cob.cms.hhs.gov/EDI   

Please note all public facing websites which fall under the purview of the MSPSC MA are Secure Websites. These websites require credentials to access.