Recovery Audit Contractor Regions 3, 4, and 5

• PIA Validation (PIA Refresh/Annual Review)

The RAC-3 System maintains patient and provider information in relation to Medicare payment claims. This information is not collected directly by the RAC-3 System. The information is collected by the CMS National Claims History (NCH) system which has its own PIA. The information is transferred once a month to the RAC-3 System through a secure data file transfer directly from NCH. 

The RAC-3 System contains the following information about patients: name, date of birth, mailing address, telephone number, health insurance claim number (HICN), sex, ethnicity, medical notes, medical record information (procedure codes, diagnosis codes, dates of service, total charges, Medicare payment amount), and Medicare Beneficiary Identifier. The system also contains information about providers, such as: National Provider Identifier (NPI), facility name and address, and provider name and telephone number.

The RAC-3 System users are internal and input a username and password to access the information in the system. The following user information is stored in the system First Name, Last Name, Display Name, Office Location, Telephone Number, E-mail Address, Job Title, Department, and Manager Name.

The RAC-3 System keeps records required to be retained by Health Insurance Portability and Accountability Act (HIPAA) for Protected Health Information (PHI) at least six (6) years from the date of its creation or the date when it was last in effect, whichever is later to fulfill the purpose(s) identified in the Notice of Privacy Practices or as required by law. 

The RAC-3 System shares data with other CMS systems to include, Fiscal Intermediary Standard System (FISS), Multi-Carrier System (MCS), ViPS Medicare System (VMS), and the Recovery Audit Contractor Data Warehouse (RACDW). It does not collect PII from Medicare beneficiaries. Data is sent to the Virtual Data Center (VDC).

For Medicare beneficiaries, the system is used to predict, identify, manage and analyze medical claims; receive data; execute queries; audit results; create and submit adjustments; and generate letters and reports.

The following data elements are maintained in support of claims management, auditing, and letter generation: name, date of birth, mailing address, telephone number, health insurance claim number (HICN), sex, ethnicity, medical notes, medical records number, medical record information (procedure codes, diagnosis codes, dates of service, total charges, Medicare payment amount), and Medicare Beneficiary Identifier. This data is used to evaluate Medicare claims and to identify improper payments made on claims of health care services provided to Medicare beneficiaries. If an overpayment is identified, the system performs the business functions necessary to recover Medicare’s funds. If an underpayment is identified, the system performs the business functions necessary to reimburse the additional funds.

Medicare claims needing to be reprocessed are submitted to organizations that handle Medicare claims.

The RAC-3 System regularly uses PII to retrieve medical records directly from Providers and a healthcare information management company. The PII includes using the last name, first initial, date of birth, claim number, medical record number, and date of service.

The RAC-3 System user information maintained is used for system authentication, security and integrity.

• Social Security Number
• Name
• Date of Birth
• Mailing Address
• Medical Records Number
• Medical Notes
• Other - Health Insurance Claim Number/Medicare Beneficiary Identifier, sex, race, written medical records, procedure codes, diagnosis codes, dates of service, office location, telephone number, email address, job title, department, manager name, Medicare Beneficiary Identifier, medical record information (procedure codes, diagnosis codes, dates of service, total charges, Medicare payment amount), National Provider Identifier (NPI), facility name, provider name and telephone number, username and password.

• Employees
• Patients

• Other - The RAC-3 System does not collect Personally Identifiable Information from Individuals.

• Other - Other - National Claims History (NCH), SORN# 09-70- 0558 – This is the monthly claims file received from CMS on processed Medicare claims, and it is used to identify improper payments. Additional research may be conducted in other systems or sources: Fiscal Intermediary Shared System (FISS), SORN #09- 70-0503; Medicare Multi-Carrier Claims System (MCS), SORN #09-70-0501; Common Working File (CWF), SORN# 09-70-0526; Medicare Appeals System (MAS), SORN# 09-70-0566; Healthcare Integrated General Ledger (HIGLAS); and RAC Data Warehouse Quality Improvement System.

• Within HHS Private Sector: 
  • Once an improper payment has been identified, the claim information containing Personally Identifiable Information (PII) is sent to the Medicare Administrative Contractors (MAC) so they can adjust the claim. This allows CMS to collect overpayments or return underpayments.
  • Additionally, in connection with performance of the services under the RAC-3, 4, and 5 contracts # HHSM- 500-2016-00081C and #HHSM-500-2016-00082C, and their respective Statements of Work, the RAC-3 System may share or disclose information containing PII with applicable MACs, Zone Program Integrity Contractor (ZPICs), Qualified Independent Contractor (QICs) and/or Administrative QIC (AdQICs); including by sending information to the Fiscal Intermediary Shared System (FISS), SORN #09- 70-0503; Medicare Multi-Carrier Claims System (MCS), SORN #09-70-0501; and RAC Data
  • Warehouse Quality Improvement System.

• Users: Auditors have access to the data for the purpose of identifying improper payments. 
• Administrators: Information Technology System Administrators have access to the system that contains the PII data for the purpose of maintaining the system and its components. 
• Developers: Information Technology Application Developers have access to the system that contains the PII data for the purpose of maintaining the Applications used by the Auditors. 

The PII utilized by the system are secured using administrative, technical, and physical controls in accordance with National Institute of Standards and Technology (NIST) Special Publications (SP) 800-53. Some of these controls are 

Administrative: policies, and procedures designed to manage (1) the selection, development, implementation, and maintenance of the security measures designed to protect the PII and (2) the conduct of those with access to the PII, 

Technical: encryption, automatic logoff, and 2-factor authorization; and 

Physical: facility access controls and disposal controls.