Recovery Audit Contractor Region 4

Cotiviti GOV Services (Cotiviti) is the Recovery Audit Contractor (RAC) for Region 4 and is charged with identifying and correcting overpayments and underpayments made under the Fee for Service (FFS) Medicare systems. Cotiviti GOV Services (Cotiviti) does not collect PII from beneficiaries directly; however, our system electronically receives, stores and shares, when required, national claims history data received from CMS, information, and documentation received from the provider and reviewed by Region 4 for Medicare overpayments and underpayments. When required claims data is shared with the Medicare Administrative Contractors (MAC) through the CMS secure Network Data Mover line. 

Information containing PII for Patients includes Name, Medical Records Number, Medical Records, Medical Notes, User ID, Therapy Records, Medicare HIC Number, UPI, MBI, Date of Birth, and Date of Death.

Information containing PII for Beneficiaries includes Name, Medical Records Number, Medical Records, Medical Notes, User ID, Therapy Records, Medicare HIC Number, UPI, MBI, Date of Birth, and Date of Death.

Information containing PII for Business Partners/Contacts includes Employee/Business Partner names, phone numbers, addresses, and email addresses.

PII data elements are used as part of the retrieval process when querying records for audit purposes.

• Name
• E-Mail Address
• Phone Numbers
• Medical Notes
• Taxpayer ID
• Date of Birth
• Mailing Address
• Medical Records Number
• Date of Death
• Other - Medicare HIC Number, Medical Notes, MBI, User ID, Medical Records, and Unique Patient Identifier (UPI)
• Therapy records

• Business Partners/Contacts (Federal, state, local agencies)
• Patients
• Other - Beneficiaries

• Other - Within the CMS OPDIV through the CMS Network Data Mover (NDM) connection.

• Within the OPDIV
• Other - Through the CMS Network Data Mover (NDM) connection.

• Other - N/A

• Within HHS: PII, when required, is shared with the Medicare Administrative Contractors (MAC), to the extent of the terms of the Joint Operating Agreement (JOA) established between contractors. This PII includes Medicare HIC Number, Date of Birth, Therapy Records, Taxpayer ID, Date of Death, Name, Medical Records Number, Medical Records, Employee/Business Partner names, User ID, phone numbers, and emails. The MACs receive PII to support the appeal process and to allow for adjustment of the claim for the improper payment findings.

• Users: Review staff, Customer Service and Management require access to the national claim's history data, which includes Medicare HIC Number, Date of Birth, Date of Death, Taxpayer ID, Therapy Records, Employees/Business Partners, Name, Medical Records Number, Medical Records, PII to perform Claim review to identify overpaid and underpaid Medicare Claims

   

• Administrators: Administrators require access to PII the national claims history data, which includes Medicare HIC Number, Date of Birth, Date of Death, Taxpayer ID, Therapy Records, Employees/Business Partners, Name, Medical Records Number, Medical Records to provide oversight and quality assurance to ensure appeals information is accurate.

   

• Developers: Perform application operations support

   

• Contractors: Non-Direct Contractors: Security auditors ensure all CMS, Federal Information Security Management Act (FISMA) security standards, procedures and guidelines are met. The security auditors also validate proper security controls are in place to protect PII information.

The system is maintained using the security concept of least privilege. Only employees with a need to work with PII are provided access to PII. Application and database developers have full access to data. End users such as medical reviewers and provider service representatives are provided access using applications controlling their access to just the PII within the scope of their review and to meet their job requirements. Software is used to track and log events.

Users are granted a specific level of access to the operating system on which they are working. This access is only granted after an approval process is performed via the ticket management system. After approval, access is granted for specific named role access to a system. Users with certain access can only perform specific actions on that system, such as Windows server administrators cannot perform administrator functions on a Linux system. Each role has a minimum privilege need to accomplish the assigned work. Users are assigned to roles based on the concept of least privileges. Administrator roles are granted so that they can perform only the tasks which they need to while blocking them out from all other tasks. Employees must be authorized by their manager as well as the Information System Security Officer (ISSO) to perform privileged functions. Active Directory is used to enforce least privilege in conjunction with our ticketing system and audit log reviews for escalated privileges.

RAC Region 4 institutes a security awareness and training program providing all government programs personnel with general security awareness training upon hire (before accessing RAC Region 4 systems) and annual refresher training thereafter.

All employees undergo annual Compliance, Code of Conduct and Health Insurance Portability and Accountability Act (HIPAA) training as well as Mandatory annual Security & Privacy Awareness Computer Based Training (CBT), Annual Social Networking Training, Annual Phishing Awareness Training, Annual IT Security and Awareness Training. In addition, there is a notification posted prior to accessing CMS data stating responsibilities for protecting the information collected.

All users including medical reviewers are provided specialized training utilizing in-house applications to enable them to perform their job duties. The training covers how to work with PII, how to use the applications, and security measures in place, and IT end user best practices. Specific training includes Annual Rules of Behavior Training, Annual Conflict of Interest Training and Disclosure, Annual Portable Device and Removable Storage Training, Annual Incident Response Management training (InfoSec personnel), Annual Contingency Planning training (InfoSec personnel), Additional Operational and Technical training (System Admin), Additional InfoSec training (InfoSec personnel).

The Information System Security Officer (ISSO) is responsible for ensuring that all personnel are appropriately trained and have completed annual security awareness and training. User training consists of a one-hour course emphasizing security awareness and policies The curriculum includes the purpose of security, security contacts, the Health Insurance Portability and Accountability Act (HIPAA), privacy awareness, types of malicious activities, recognition of security incidents and the requirement to report them. Training includes Rules of Behavior, such as securing sensitive information, securing workstations, using licensed software; prohibitions against network or workstation modification, incident reporting and password management are covered in Security Awareness Training. In addition, building and physical security guidelines are stressed to staff Corporate Code of Conduct training is given annually via web training in the Learning Management System (LMS). 

Physical: This includes multiple physical security measures within data centers which maintain 24/7 Security Staff and Physical Access Control System (PACS) using Secure-Card Key Access, Biometric Scanners, and Alarms. Physical destruction of PII is handled utilizing shred bins, locked in secure areas that only the company can access. Shredding is done onsite.

Technical: Encryption is implemented for all backup storage, data connections, and databases. Intrusion detection and prevention solutions are employed, and the system is scanned daily for application and system vulnerabilities.

Administrative: Policies and Procedures have been created for securing PII in the RAC Region 4 system. Examples include the security awareness and training policy, access control policies, record retention policy, and audit monitoring and logging policies and controls.