Unified Case Management Next Generation

• Significant System Management Change
• PIA Validation (PIA Refresh/Annual Review)

The UCM application is undergoing a modernization using a bi-modal delivery model that will allow CPI to innovate and modernize UCM while sustaining current program commitments and release schedules. As part of this modernization, the application will incrementally migrate from the current Baltimore Data Center to the CMS AWS infrastructure, resulting in a shared or transitioning of inherited security controls that relate to the infrastructure and enterprise services.  

The initial, January 2021, release included a new, minor functionality called the Compromised Number Record, and it is domiciled in the CMS AWS cloud infrastructure. The second major release, in May 2021, introduced Major Case Coordination (MCC), which refers to the process of selecting, preparing, prioritizing, organizing, and decision recording of high-profile cases as a result of the MCC Meetings. MCC in UCM NexGen provides the capability to streamline the overall MCC process, and allow the user to select, schedule, prioritize, and record decisions in real-time and generate exports all within the UCM NexGen application. UCM NexGen provides users with a Medical Record Review (MRR) capability to initiate a Medical Review, track the progress of a Medical Review, complete and close-out a Medical Review, and summarize the findings of the Medical Review. Lead Management will allow users to initiate, assign, and prioritize cases based on correlated UCM data.

UCM will maintain connectivity to the CMS systems FPS and OnePI. UCM NexGen interfaces with these systems to retrieve financials, provider locations, and key information required to decide the actions against the providers reviewed during processing of cases.  

All access to UCM NexGen continues to be provided from the CMS Enterprise Portal. The UCM user base will not change through the migration from UCM 1.0. UCM will continue to utilize the existing CMS enterprise authentication method (IDM).

The primary purpose of this system is to collect and maintain information to: (1) Identify a violation or violations of a provision of the Social Security Act or a related penal or civil provision of the United States Code related to Medicare, Medicaid, Health Maintenance Organization (HMO)/Managed Care, and Children's Health Insurance Program have been committed; (2) determine if CMS has made a proper payment as prescribed under applicable sections of the Act; (3) determine whether these programs have been abused; 4) coordinate investigations related to Medicare, Medicaid, HMO/Managed Care and Children's Health Insurance Program (CHIP); (5) prevent duplications of investigatory efforts; and (6) provide case file material to the HHS Office of Inspector General and other federal law enforcement agencies when a case is referred for fraud investigation. UCM will share PII data with CMS legacy systems One Program Integrity (OnePI) and Fraud Prevention System (FPS).

The user ID and password will be collected for internal system users. The management and maintenance of the user information to create user accounts for UCM is handled within CMS' Enterprise User Administration (EUA) and CMS ID Management (IDM).

• Social Security Number
• Name
• E-Mail Address
• Phone Numbers
• Medical Notes
• Foreign Activities
• Mailing Address
• Financial Account Info
• Device Identifiers
• Other - Unique Provider Identification Number (UPIN), National Provider Identifier (NPI), User ID and Password

• Employees
• Business Partners/Contacts (Federal, state, local agencies)
• Vendors/Suppliers/Contractors

The PII is used for CMS fraud, waste and abuse investigations for supporting efforts to protect healthcare expenditures by supporting program integrity functions and combating fraud, waste and abuse in Medicare and Medicaid.

The PII for internal system users is used to gain system access to support system operations.

Sections 1816(a) and 1842(a) of the Social Security Act provide that public or private entities and agencies may participate in the administration of the Medicare program under agreements or contracts entered with CMS. These Medicare Contractors are known as Fiscal Intermediaries (FIs) and Carriers. FIs have primarily processed bills and made payments for all facilities (hospitals, Skilled Nursing Facilities (SNFs), Ambulatory Surgical Centers (ASCs), etc.). Carriers have primarily processed claims and made payments for all Part B services billed by a physician or supplier.

As part of these contractual duties, FIs and Carriers were charged to perform program integrity activities. These activities include, among other things, reviewing claims to make coverage determinations and auditing provider cost reports. FIs and Carriers performed the entire range of claims processing functions, including entering data, establishing computer edits to identify potential duplicate claims, and mailing notices to beneficiaries and providers.  In addition, FIs and Carriers had as part of their responsibilities to deter and detect potential fraud and/or abuse.
Section 4241 of the Small Business Jobs Act of 2010 (Public Law 111-240) mandates the use of predictive modeling and other analytic technologies to identify and prevent fraud, waste, and abuse in the Medicare Fee-for-Service (FFS) program.

• In-person
• Online

• Within the OPDIV
• Other Federal Entities

• Other - Medical Providers

• Within HHS: Data is shared with other CMS legacy systems. The information within the UCM system is used for investigative purposes.
• Other Federal Agency/Agencies: Department of Justice (DOJ). The information within the UCM system is used for investigative purposes.
• State or Local Agency/Agencies: State agencies overseeing Medicaid programs. The information within the UCM system is used for investigative purposes.

Information is posted to the UCM system by CMS approved contractors and investigators. Thus, UCM does not directly collect personal information from individuals for the UCM system and does not have a process in place to notify individuals that their personal information will be collected.

UCM Systems administrator's user ID and password is collected to authenticate their access to the system.  Because this collection is required for them to conduct their required tasks no formal notice is provided to them. The management and maintenance of the user information to create user accounts for UCM is handled within CMS' Enterprise User Administration (EUA) and Enterprise ID Management (IDM).

The UCM system does not directly interact with individuals to collect their information. As the information posted in the UCM system is used for investigative purposes, there is no option given to individuals to object to the information collection or to opt out.

The collection of this data is required under the Social Security Act for the participation of individuals in the Medicare and Medicaid services.  Access to the data can only be obtained through the CMS internal network and requires identification and authorization through CMS EUA and IDM processes.

UCM Systems administrator user ID and password is collected to authenticate their access to the system.  Because this collection is required for them to conduct their required tasks no opt-out option is available.

The UCM system has no process to notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system. The information in the database is posted by CMS approved contractors and investigators. The UCM system obtains the data from the CMS Shared Services system, CMS One Program Integrity System (OnePI), and the CMS Fraud Prevention System (FPS), therefore these systems as the system of record of the data, they will notify and obtain consent from individuals as major changes occur to the system and the associated data.

UCM Systems administrator user ID and password is collected to authenticate their access to the system.  Because this collection is required for them to conduct their required tasks, no formal notice is provided to them when there is a major change to the system. 

CMS System of Records Notification Process.   Access to the data can only be obtained through the CMS internal network and requires identification and authorization through CMS EUA and EIDM processes.

CMS System of Records Notification Process.

The information is aggregated to support statistical analysis and fraud, waste, and abuse investigations.  Information about an individual is processed in support of these investigations.

NOTIFICATION PROCEDURE: For purpose of access, the subject individual should write to the system manager who will require the system name, social security number (SSN) or UPIN, address, date of birth, and sex, and for verification purposes, the subject individual’s name (woman’s maiden name, if applicable). Furnishing the SSN is voluntary, but it may make searching for a record easier and prevent delay.

RECORD ACCESS PROCEDURE: For purpose of access, use the same procedures outlined in Notification Procedures above. Requestors should also reasonably specify the record contents being sought. (These procedures are in accordance with Department regulation 45 CFR 5b.5(a)(2)).

CONTESTING RECORD PROCEDURES: The subject individual should contact the system manager named above and reasonably identify the record and specify the information to be contested. State the corrective action sought and the reasons for the correction with supporting justification. (These procedures are in accordance with Department regulation 45 CFR 5b.7).

UCM Systems administrator's user ID and password is collected to authenticate their access to the system. In the event the user's credentials are inaccurate the administrators and system users must contact the UCM service desk to initiate resolution of the issue. The concerns of the administrators and system users will be directly considered, investigated and resolved over the phone or through email exchange on a one-on-one bases by the UCM service desk personnel as required.

CMS has safeguards in place for authorized users and monitors such users to ensure against unauthorized use. Personnel having access to the system have been trained in the Privacy Act and information security requirements. Employees who maintain records in this system are instructed not to release data until the intended recipient agrees to implement appropriate management, operational and technical safeguards sufficient to protect the confidentiality, integrity and availability of the information and information systems and to prevent unauthorized access. UCM users take required annual information security and privacy training to receive regular information on this. The UCM system also follows the CMS Acceptable Risk Safeguards which details the requirements for data inspection, integrity, accuracy, and relevancy. If the system should undergo any major significant change to the system, an information security and privacy test is applied to ensure the protection of the PII data contained in the system. Technical controls used include user identification, passwords, security tokens, firewalls, virtual private networks, and intrusion detection systems. Physical controls used include guards, identification badges, key cards, cipher locks, and closed-circuit televisions.

Any PII collected by UCM is in a read-only format.  The data will not be able to be modified or destroyed.  UCM is the aggregator of the information collected through investigations.  It is not the function of the UCM application to validate data contained within the application, any more than it is the function of a word processing application to validate the veracity of the information contained in its documents.  Therefore, UCM is not responsible for validating the data and information it aggregates from other sources. Data migration is tested based on source sample data to determine the proper importation of source data. 

User IDs and passwords are maintained external to the UCM system in the CMS EUA and IDM systems. UCM roles are administered through a UCM Lightweight Directory Access Protocol (LDAP) server. Access to the UCM LDAP is dependent on valid IDM credentials.  If a user role changes, permissions are updated in IDM and these changes are reflected in relevant LDAP provided access. As UCM NeXgen resides in the CMS Amazon Web Services (AWS) cloud environment, all physical infrastructure is managed and maintained by the CMS Cloud Team in concert with AWS.  Because UCM is not responsible for the integrity, accuracy or relevancy of non-employee PII it contains there is no mechanism or process to review the data for these attributes.

• Users: UCM users to complete Fraud, Waste and Abuse workload.
• Administrators: Management of the UCM system.
• Developers: Enhancement of the UCM system.
• Contractors: Direct Contractors for UCM operation and maintenance requirements.

All personnel using or administrating the system are either CMS employees or direct contractors. As such all users are required to complete annual CMS Security Awareness Training and Privacy Act Training.

In addition to the Security Awareness training, all UCM contractors are required to complete annual Data Security & Privacy Training and HIPAA Requirements training.

NARA Approved Disposition Authority: DAA-0440-2015-0012
Documents relating to Personal Identifiable Information (PII) and Protected Health Information (PHI) on providers and beneficiaries who have reported that their Medicare information has been compromised and suspects their Medicare information has been stolen through fraudulent methods.

DISPOSITION: Cutoff at the end of the calendar year of the completion of all legal activity. Destroy 7 years after cutoff.

NARA Disposition Authority: NC1-440-79-1/75/23/2B7 FROZEN--DO NOT DESTROY

Files accumulated as a result of allegations or complaints of program abuse or potential fraud by physicians and other providers of services pursuant to sections 206, 208, 1106, and 1107 of the Social Security Act. They consist of complaints from beneficiaries or other sources that are referred to district offices, regional offices, intermediaries, carriers, etc. Included are correspondence, forms, and other papers used in developing and investigating complaints, such as exhibits, copies of claims forms, bills, medical records, investigative reports, fiscal records, and other pertinent physician and provider records.

DISPOSITION: CMS Headquarters and Regional Offices Place in inactive file after final action on the case. Cut off inactive file at the close of the calendar year in which final action was taken, hold 2 additional years, and then transfer to a Federally approved records storage facility. Destroy after a total retention of 5 years.

Data is secured according to AWS Security Best Practices and the CMS Acceptable Risk Safeguards (ARS).

Administrative controls include:  Documented UCM System Security Plan, Contingency Plan, and Risk Assessment.

Technical Controls include:  Multifactor Authentication and Role-Based Access Control to limit access of UCM to authorized users, userIDs and passwords, RSA (product name) Tokens, firewalls, Virtual Private Networks (VPNs), Security Incident and Event Management (SIEM), static  and dynamic application security testing, vulnerability management, penetration testing, malicious code prevention and detection, host intrusion prevention and identification (HIDS), security compliance scanning, infrastructure as code (IAC).

Physical Controls Include (as applicable to TISTA's corporate environments): guards, identification badges, key cards, closed circuit TVs.  As UCM NeXgen resides in the CMS AWS cloud environment, TISTA does not manage nor maintain the system's physical infrastructure.