Office of Hearings Case and Document Management System

The Office of Hearings and Inquiries has developed and implemented the OH CDMS system which is aimed at achieving an automated workflow and electronic filing system to minimize paper processing and increase the accuracy of the appeal process. OH CDMS allows for transparency between users and consist of four (4) modules:

1) Provider Reimbursement Review Board (PRRB)

2) Medicare Geographic Classification Review Board (MGCRB) and Computation

3) Hearing Officer (HOM).

4) Medicare Advantage (MA) Risk Adjustment Data Validation (RADV).

Each of the four (4) modules are a standalone that run independently of each other.

The OH CDMS system was created to migrate from a paper based manual process case management system to a more automated process that includes storing of data and uploaded electronic documentation files for cases created to track the appeal and the related activity throughout the appeal's lifecycle. The system supports an appeal from the initial request, the maintenance of the appeal, corresponding with the PRRB, MGCRB, HOM and MA RADV, and the outcome or decisions on the appeal request. 

• Name
• E-Mail Address
• Phone Numbers
• Medical Notes
• Mailing Address
• Other - Username, password, security question, and Organization Name

• Employees
• Public Citizens
• Business Partners/Contacts (Federal, state, local agencies)
• Patients

Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104–191, which was enacted on August 21, 1996. Through subtitle F of title II of that law, the Congress added to title XI of the Social Security Act a new part C, entitled ‘‘Administrative Simplification.’’ (Public Law 104–191 affects several titles in the United States Code); 5 USC 552 a(e) (1); 45 CFR 164.514 (e); 44.

USC.3544; 42 USC 1306.

The SORN applicable to this system is Medicare Appeals System (09-70-0566)

Published:

SORN 09-70-3005 Correspondence

Tracking Management System (CTMS)

Published: SORN 09-70-0008 National Provider

System (NPS)

Published: SORN 09-70-0591 Master

Demonstration, Evaluation, and Research

Studies (DERS)

• Online
• Email

• Within the OPDIV
• State/Local/Tribal
• Other Federal Entities

 Individuals may not opt out of providing their personally identifiable information (PII). The registered user must provide their business contact details to utilize the CDMS system.

There is a manual identification process that allows the user to complete user access request forms. The forms are sent out to the user by the Help Desk and the user is instructed to return the forms to the Office of Hearings. Once the forms are processed by the Office of Hearings then the appropriate information is provided to the System Administrator for completing the user access request.

• Users: OH CDMS- employees may have access to PII to determine the status of payments disputes and approving and declining geographical re-classification request.
• Administrators:  As administrators assign roles to users they may be exposed to the user's personally identifiable information (PII) to link access rights to a specific user's name.
• Contractors: OH CDMS Direct Contractors who act in the role of administrators may be exposed to the user's personally identifiable information (PII) to link access rights to a specific user's name. Contractors that evaluate the MA RADV appeals will have access to the documents containing PHI/PII for evaluation and decision making.

All Centers for Medicare and Medicaid Services (CMS) employees and CMS direct contractors are required to complete annual mandatory Information Systems Security Awareness and HHS Privacy Training. This training is required prior to gaining access and required to maintain access to all CMS systems. 

All CMS employees and CMS direct contractors are required to read and acknowledge The Rules of Behavior For Use of HHS Information Resources. A signed and dated acknowledgment is required.

CMS websites keep data collected long enough to achieve the specified objective for which they were collected. The data generated from these activities (including Salesforce) falls under the National Archives and Records Administration (NARA) General Records Schedule (GRS) 3.1 – General Technology Management Records and will be handled according to the requirements of that schedule. 

Information technology operations and maintenance records.

Information Technology Operations and Maintenance records relate to the activities associated with the operations and maintenance of the basic systems and services used to supply the agency and its staff with access to computers and data telecommunications. Includes the activities associated with IT equipment, IT systems, and storage media, IT system performance testing, asset, and configuration management, change management, and maintenance on network infrastructure. Includes records such as files identifying IT facilities and sites, files concerning implementation of IT facility and site management, and equipment support services provided to specific sites reviews, site visit reports, trouble reports, equipment service histories, reports of follow-up actions and related correspondence.  

Administrative: Users are provided with privacy training to understand how to properly handle and disclose privacy data.

Technical: Role based access has been employed by the application to ensure that users only have access to the data which is needed in the performance of the specific jobs. 

Physical: Physical controls are administered by the Salesforce Data Center facility where the application will physically reside. The Salesforce facility has security guards and controlled access rooms with cipher locks to guard against unauthorized access.

User must access production via the EIDM portal using the following link:

https://sei.cms.gov