Recovery Audit Contractor Regions 1, 2 and 5

• PIA Validation (PIA Refresh/Annual Review)
• Other - Current contract is for Recovery Audit Contractor (RAC) Region 1 and 5.  Update of PIA for inclusion of CMS RAC Region 2.

No equipment or environmental changes have been made since the last PIA.  Only the addition of CMS RAC Region 2 which is being implemented in the same equipment and environment as CMS RAC Region 1 and 5.  Slight corrections in PIA-011 to remove some acronyms.  

This information system is used by the CMS Recovery Audit Contractor (RAC) for Region 1, 2 and 5 and is referred to as RAC 1, 2 and 5.

Region 1 encompasses the Northeastern part of the United States Medicare PART A&B (Parts A&B) claim reviews: Connecticut, Delaware, District of Columbia, Maine, Maryland, Massachusetts, New Hampshire, New Jersey, New York, Pennsylvania, Rhode Island, and Vermont.

Region 2 encompasses the Central part of the United States Medicare PART A&B (Parts A&B) claim reviews: Arkansas, Colorado, Iowa, Illinois, Kansas, Louisiana, Missouri, Minnesota, Mississippi, Nevada, New Mexico, Oklahoma, Texas, and Wisconsin.

Region 5 encompasses Durable Medical Equipment (DME), Home Health, and Hospice Claim reviews for the entire United States of America.

The purpose of the RAC 1, 2 and 5 system are for auditing Medicare claims to ensure providers/hospitals are following proper billing guidelines and whether there were any incorrect payments.

Recovery Audit Contractor Regions 1, 2 and 5 system maintains patient and provider information in relation to Medicare payment claims. This information is not collected directly by the Recovery Audit Contractor Regions 1, 2 and 5 system. The information is collected by CMS' National Claims History (NCH) system which has its own PIA. The information is transferred once a month to Recovery Audit Contractor Regions 1, 2 and 5 via a secured data file transfer directly from NCH.

Recovery Audit Contractor Regions 1, 2 and 5 system contains the following personally identifiable information (PII) about patients: social security number (SSN), taxpayer ID, date of death, therapy records, Medicare beneficiary identifier, name, date of birth, mailing address, telephone number, health insurance claim number (HICN), sex, ethnicity, medical notes, medical record information (procedure codes, diagnosis codes, dates of service, total charges, Medicare payment amount) and provider credentials to access the Claims Status website are also stored in the Recovery Audit Contractor Region 1, 2 and 5 system.

The system also contains information about providers, such as: National Provider Identifier (NPI), facility name and address, and provider name and telephone number.

PII records are maintained and stored for 7 years unless requested to be deleted.

• Social Security Number
• Name
• E-Mail Address
• Phone Numbers
• Medical Notes
• Taxpayer ID
• Date of Birth
• Mailing Address
• Medical Records Number
• Other - User Credentials, Health insurance claim number (HICN), Medicare Beneficiary Identifier, Date of Death, medical record information (date of service, diagnosis code, procedure code, charge for procedure), sex, ethnicity, and National Provider Identifier (NPI). Provider credentials to access the Claims Status website are also stored in the Recovery Audit Contractor Region 1 and 5 system.
• Therapy records

Recovery Audit Contractor Regions 1, 2 and 5 system accurately tracks Medicare claims being audited by Contractor and provides transparency to medical service providers via the Recovery Audit Contractor Regions 1, 2 and 5 provider portal.  Qualified customer service staff members assist providers when they have questions or need information regarding the audit review process.  Role-based user credentials are used to access Recovery Audit Contractor Regions 1, 2 and 5 data to perform the various functions of the system.

The Recovery Audit Contractor Regions 1, 2 and 5 audit team reviews claims paid to medical providers by CMS RAC 1, 2 and 5 through either a complex review that includes a professional review of medical records or through an automated data analysis, which does not require review of medical records. As part of the audit process for review of Medicare claims, the Recovery Audit Contractor Regions 1, 2 and 5 system receives Medicare Claims that include the following beneficiary information:

Beneficiary name,

Beneficiary Identifier MBI (or HICN),

Date of birth,

Date of death if deceased

The complex reviews are conducted by appropriately qualified auditors such as nurses and certified coders. These individuals are required to follow Medicare policy and guidelines when reviewing provider claims and the related medical records requested and scanned into the Recovery Audit Contractor Regions 1, 2 and 5 system.  Claims auditors can access claim information, provider information, medical records associated with the claim, enter notes and associated result findings (if any) during the review. The data and the results of their reviews are securely stored in the Recovery Audit Contractor Regions 1, 2 and 5 system. Auditors and customer service representatives can access all information associated with the overpayment/ underpayment such as the claims, records, letters, and auditors’ notes. After review results letters have been sent to providers, the providers can call the Performant customer service center for the “discussion period” or, they may send discussion requests through mail, fax, or the esMD (Electronic Submission of Medical Documentation) system. The discussion reviewers can access all information associated with the overpayment or underpayment such as the claims, records, letters, and auditors’ notes, and can answer the provider’s questions. All call notes are documented in the Recovery Audit Contractor Regions 1, 2 and 5 system.

• Online

• Within the OPDIV
• Other HHS OPDIV

• Other - N/A

Recovery Audit Contractor Regions 1, 2 and 5 does not interact with Medicare Beneficiary (patient) directly as part of the Recovery Audit Contractor Regions 1, 2 and 5 contract. Medicare Beneficiary (patient) has no option for opt-out of the collection or use of their PII with Recovery Audit Contractor Regions 1, 2 and 5 system.  Recovery Audit Contractor Regions 1, 2 and 5 system is not the authoritative source of PII obtained from National Claims History for RAC 1, 2 & 5.  Recovery Audit Contractor Regions 1, 2 and 5 contractor only receives and does not modify any of the PII from National Claims History for RAC 1, 2 & 5.  Any such requests for modification of PII will be redirected to CMS RAC 1, 2 and 5 COR.

In case the beneficiary does contact Recovery Audit Contractor Regions 1, 2 and 5 contractor, the beneficiary is redirected to contact the provider if they believe their PII is inaccurate.

Should the Medicare Beneficiary believe their PII has been inappropriately obtained, used, or disclosed by Recovery Audit Contractor Regions 1, 2 and 5 contractor, the Recovery Audit Contractor Regions 1, 2 and 5 compliance department will perform an investigation to include information security on the concern.  Should the investigation determine data is inappropriately obtained, used or disclosed, Recovery Audit Contractor Regions 1, 2 and 5 contractor will submit a security incident ticket with the CMS helpdesk along with any corrective actions required.

Recovery Audit Contractor Regions 1, 2 and 5 does not interact with Medicare Beneficiary (patient) directly as part of the Recovery Audit Contractor Regions 1, 2 and 5 contract. Medicare Beneficiary (patient) has no option for opt-out of the collection or use of their PII with Recovery Audit Contractor Regions 1, 2 and 5 system.  Recovery Audit Contractor Regions 1 and 5 system is not the authoritative source of PII obtained from National Claims History for RAC 1, 2 & 5.  Recovery Audit Contractor Regions 1, 2 and 5 contractor only receives and does not modify any of the PII from National Claims History for RAC 1, 2 & 5.  Any such requests for modification of PII will be redirected to CMS RAC 1, 2 and 5 COR.

In case the beneficiary does contact Recovery Audit Contractor Regions 1, 2 and 5 contractor, the beneficiary is redirected to contact the provider if they believe their PII is inaccurate.

Should the Medicare Beneficiary believe their PII has been inappropriately obtained, used, or disclosed by Recovery Audit Contractor Regions 1, 2 and 5 contractor, the Recovery Audit Contractor Regions 1, 2 and 5 compliance department will perform an investigation to include information security on the concern.  Should the investigation determine data is inappropriately obtained, used or disclosed, Recovery Audit Contractor Regions 1, 2 and 5 contractor will submit a security incident ticket with the CMS helpdesk along with any corrective actions required.

• Users: The Recovery Audit Contractor Regions 1, 2 and 5 users have access to PII (to include name, medical notes, phone numbers, date of birth, mailing address, medical records number, health insurance claim number (HICN), medical record information (date of service, diagnosis code, procedure code, charge for procedure), sex, ethnicity, and National Provider Identifier (NPI)) to access medical records, scan in documents and medical records, conduct audits, respond to inquiries, respond to appeals, and gather required documents for The Medicare claim audit process. 

   

• Administrators: Recovery Audit Contractor Regions 1, 2 and 5 Administrators have access to PII (to include name, medical notes, phone numbers, date of birth, mailing address, medical records number, health insurance claim number (HICN), medical record information (date of service, diagnosis code, procedure code, charge for procedure), sex, ethnicity, and National Provider Identifier (NPI)) to support the system production environment as part of their roles and responsibilities.

   

• Developers: Recovery Audit Contractor Regions 1,2 and 5 Developers have periodic access to PII (to include name, medical notes, phone numbers, date of birth, mailing address, medical records number, health insurance claim number (HICN), medical record information (date of service, diagnosis code, procedure code, charge for procedure), sex, ethnicity, and National Provider Identifier (NPI)) in support of the information systems that hold and process PII as part of their job roles and responsibilities. These activities may include post go-live support, bug fixes, or troubleshooting activities.

   

• Contractors: N/A. No external or 3rd party individuals outside of Recovery Audit Contractor Regions 1, 2 and 5 have access to PII. Only the users, administrators or developers have access to system or PII data.