Recovery Audit Contractor Region 3

The RACs- 2 and 3 system maintains patient and provider information in relation to Medicare payment claims. This information is not collected directly by the RACs- 2 and 3 system. The information is collected by the CMS National Claims History (NCH) system which has its own PIA. The information is transferred once a month to RACs- 2 and 3 is through a secured data file transfer directly from NCH. 

The RACs- 2 and 3 system contains the following information about patients: name, date of birth, mailing address, telephone number, health insurance claim number (HICN), sex, ethnicity, medical notes, medical record information (procedure codes, diagnosis codes, dates of service, total charges, Medicare payment amount), and Medicare Beneficiary Identifier. The system also contains information about providers, such as: National Provider Identifier (NPI), facility name and address, and provider name and telephone number.

The RACs- 2 and 3 system users are internal and input a username and password to access the information in the system. The following user information is stored in the system First Name, Last Name, Display Name, Office Location, Telephone Number, E-mail Address, Job Title, Department, and Manager Name.

RACs- 2 and 3 keeps records required to be retained by HIPAA for (PHI) at least six (6) years from the date of its creation or the date when it was last in effect, whichever is later to fulfill the purpose(s) identified in the Notice of Privacy Practices or as required by law. 

The RACs- 2 and 3 system shares data with other CMS systems to include, Fiscal Intermediary Standard System (FISS), Multi-Carrier System (MCS), and the Recovery Audit Contractor Data Warehouse (RACDW). It does not collect PII from Medicare beneficiaries.  Data is sent to the Virtual Data Center (VDC).

For Medicare beneficiaries, the system is used to predict, identify, manage and analyze medical claims; receive data; execute queries; audit results; create and submit adjustments; and generate letters and reports.

The following data elements are maintained in support of claims management, auditing, and letter generation: name, date of birth, mailing address, telephone number, health insurance claim number (HICN), sex, ethnicity, medical notes, medical record information (procedure codes, diagnosis codes, dates of service, total charges, Medicare payment amount), and Medicare Beneficiary Identifier. This data is used to evaluate Medicare claims and to identify improper payments made on claims of health care services provided to Medicare beneficiaries. If an overpayment is identified, the system performs the business functions necessary to recover Medicare’s funds.  If an underpayment is identified, the system performs the business functions necessary to reimburse the additional funds.

Medicare claims needing to be reprocessed are submitted to organizations that handle Medicare claims.

The RACs- 2 and 3 system regularly uses PII to retrieve medical records directly from Providers and a healthcare information management company. The PII includes using the last name, first initial, date of birth, claim number, medical record number, and date of service.

The RACs 2- and 3 system user information maintained is used for system authentication, security and integrity.

• Social Security Number
• Name
• Date of Birth
• Other - Health Insurance Claim Number/Medicare Beneficiary Identifier, sex, race, written medical records, procedure codes, diagnosis codes, dates of service, office location, telephone number, email address, job title, department, manager name, Medicare Beneficiary Identifier, mailing address, medical notes, medical record information (procedure codes, diagnosis codes, dates of service, total charges, Medicare payment amount), National Provider Identifier (NPI), facility name, provider name and telephone number, username and password.

• Employees
• Patients

Private Sector Explanation: Once an improper payment has been identified, the claim information (containing Personally Identifiable Information (PII) is sent to the Medicare Administrative Contractors (MAC) so they can adjust the claim. This allows CMS to collect overpayments or return underpayments.

Additionally, in connection with performance of the services under RACs- 2 and 3 contracts # HHSM- 500-2016-00081C and #HHSM-500-2016-00082C, and their respective Statements of Work, RACs- 2 and 3 may share or disclose information containing PII with applicable MACs, Zone Program Integrity Contractor (ZPICs), Qualified Independent Contractor (QICs) and/or Administrative QIC (AdQICs); including by sending information to the Fiscal Intermediary Shared System (FISS), SORN #09- 70-0503; Medicare Multi-Carrier Claims System (MCS), SORN #09-70-0501; and RAC Data

Warehouse Quality Improvement System.

RACs- 2 and 3 Contracts #HHSM-500-2016- 00081C and #HHSM-500-2016-00082C, the recovery audit contracts for Regions 2 and 3, and their respective Statements of Work, contemplate information sharing and disclosure with Medicare providers, as well as MACs, Zone Program Integrity Contractors (ZPIC), Qualified Independent Contractors (QICs) and Administrative Qualified Independent Contractors (AdQICs) and others as indicated by the CMS Contracting Officer’s Representative (COR), in connection with our performance of services. Pursuant to the

Statements of Work, we are party to Joint Operating Agreements with each applicable MAC, ZPIC, QIC and AdQIC to encompass all communication between ourselves and them.

• Users: Auditors have access to the data for the purpose of identifying improper payments.
• Administrators: Information Technology System Administrators have access to the system that contains the PII data for the purpose of maintaining the system and its components.
• Developers: Information Technology Application Developers have access to the system that contains the PII data for the purpose of maintaining the Applications used by the Auditors.