Provider Enrollment Chain and Ownership System

The Provider Enrollment Chain and Ownership System (PECOS) serves as a national database of Medicare Provider information.  The database contains information related to ownership, managing employees, billing arrangements, re-assignment of benefits, practice locations, and related organizations for Medicare providers.

Core Functions:

The primary function of PECOS is the capture and management of enrollment information.

PECOS allows enrollment of Medicare providers – both individuals and institutions

Collects, relates, and stores Medicare provider enrollment information in a national database.

Allows organizations and individuals to initiate the Medicare enrollment process or make update to an existing enrollment via a web- or paper-based application. The enrollment information is electronically stored and shared with other systems. The data is collected to enable providers to bill to Medicare, and to also assist with CMS fraud prevention.

The Medicare Federal Health Care Provider/Supplier Enrollment Application (CMS 855A, 855B, 855I, 855R, and 855S) has been designed by the Centers for Medicare and Medicaid Services (CMS) to assist in the administration of the Medicare program and to ensure that the Medicare program is in compliance with all regulatory requirements. Provider information collected in this application, including name, application User ID, DOB, EIN and SSN if applicable, will be used to ensure that payments made from the Medicare trust fund are only paid to qualified health care providers, and that the amounts of the payments are correct.

This information will also identify whether the provider is qualified to render health care services and/or furnish supplies to Medicare beneficiaries. To accomplish this, Medicare must know basic identifying and qualifying information about the health care provider that is seeking billing privileges in the Medicare program. Medicare needs to know: (1) the type of health care provider enrolling, (2) what qualifies this provider as a health care related provider of services and/or supplies, (3) where this provider intends to render these services and/or furnish supplies, and (4) those persons or entities with an ownership interest, or managerial control, as defined in this application, over the provider. The data includes PII information of providers.

• Social Security Number
• Name
• Driver's License Number
• Mother's Maiden Name
• E-Mail Address
• Phone Numbers
• Medical Notes
• Certificates
• Education Records
• Taxpayer ID
• Date of Birth
• Photographic Identifiers
• Vehicle Identifiers
• Mailing Address
• Financial Account Info
• Other - Application User ID

• Employees
• Business Partners/Contacts (Federal, state, local agencies)

Multi-Carrier System (MCS) and Fiscal Intermediary Standard System (FISS) claims payment system – to populate the claims system provider files. National Plan & Provider Enumeration System (NPPES) – to verify National Provider Identifier (NPIs). Social Security Administration (SSA) – to verify SSNs. Medicare contractors, CMS Central Office, CMS Regional Office to research or verify provider/supplier enrollment data.

MCS, FISS and NPPES are covered under their own PIAs.

• Online
• Hard Copy
• Mail/Fax

• Members of the Public
• Private Sector

PECOS: 0938-1056 (855S) and 0938-0685 (855 A, B, I, O and R)

1. OMB control number 0938-0685 (CMS-855A) expired 03/31/2022.  CPI is currently working to get the package reinstated.
2. OMB control number 0938-1035 (CMS-10220) expired 12/31/2020. CPI notified us that it will not need to be reinstated.
3. OMB control number 0938-1056 (CMS-855S) expires 10/31/2024.

• Within HHS: Downstream systems who need PECOS data for processing, e.g. claims systems;

  Partnering systems who rely on PECOS data for validation, e.g. HITECH (Health Information Technology Economic and Clinical Health).

• Other Federal Agency/Agencies: Drug Enforcement Administration (DEA) and Federal Bureau of Investigation (FBI).  These entities have direct access to aid in fraud prevention measures.
• State or Local Agency/Agencies: Medicaid have direct access to aid in fraud prevention measures.

Privacy act for System of records. Computer Matching and Privacy Protection Act of 1988 (P.L. 100-503) amended the Privacy Act, 5 U.S.C. § 552a, to permit the government to verify information through computer matching.

There are Memorandum(s) of Understanding (MOU) in place with CDS and MCS. 

• Users: PECOS PI: Healthcare providers and their surrogates; 

  PECOS AI: Medicare Administrative Contractors - private health care insurers that have been awarded a geographic jurisdiction to process Medicare Claims for Medicare Parts A and B or for Durable Medical Equipment. Users that require access will need to conduct research, identification of physicians on Medicare claim form.

• Administrators: CMS staff, Medicare Administrative Contractor (MAC) administrators. Data correction, maintenance, problem resolution.
• Developers: Application contractors and infrastructure contractors will conduct problem resolution testing.
• Contractors: Application indirect contractors and infrastructure contractors will conduct problem resolution testing. 

All CMS employees and contractors with access to CMS networks, applications, or data must complete mandatory annual Privacy Awareness Training annually. Prior to accessing the CMS network, and as part of the annual re-certification process, a Computer-Based Training (CBT) course regarding information system security awareness is completed.

Users logging into the application for the first time must acknowledge a Rules of Behavior agreement before proceeding; content is in-line with standard CMS training.

[Administrative] PII will be secured in the system using these administrative, technical, and physical controls. The administrative controls include: inactivity timeout, more than one method of authentication required to verify user's identity, annual account reviews, and user trainings.

[Technical] PECOS include firewalls, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), etc. to prevent unauthorized access to the system.

[Physical] PECOS information is stored on a data center and will be protected through intrusion alarm, surveillance equipment, and biometric/badge readers.