Virtual Audit Management System

VAMS as an application hosts TeamMate Software (developed by Wolters Klewer (WK)) in 2 separate infrastructures to satisfy different business group needs from CMS to accommodate Affordable Care Act (ACA) and No Surprises Transparency (NST).

ACA infrastructure used to include Teammate AM version 12.6 which is changed to TeamMate (TM) Plus which is a web-based application.

Each software version of TM Plus exists in their own Amazon Web Services (AWS) Boundaries and do not have any dependencies nor integrations with each.

The Virtual Audit Management System (VAMS) is a system used by Centers for Medicare & Medicaid Services/Center for Consumer Information and Insurance Oversight (CMS/CCIIO) to provision and maintain a leading Commercial Off the shelf (COTS) product for the ACA/CMS No Surprises & Transparency Act System (NST) auditing of healthcare entities. The auditing COTS product being utilized by CMS is known as TeamMate Plus, from the Wolters Kluwer organization.

CMS’ auditing activities are crucial operations to ensure compliance and reduce fraud, helping to save the Federal government significant funds. CMS/CCIIO conducts various audits/reviews over several healthcare entities to ensure compliance with the regulations issued as part of the ACA and NST. CCIIO uses the National Association of Insurance Commissioners (NAIC) Market Regulation Handbook to conduct Federal Market Conduct Examinations.

VAMS collects documentation from Qualified Health Plans (QHPs) and non-QHPs to allow for audit and additional review in accordance with the ACA. The documents include details of operations, such as operations and maintenance manuals, insurance form filings and insurance rates documentation. To access VAMS, there are a limited number of registered users that input a user ID and password. User IDs and passwords are created in the AWSCLOUD Active Directory system. The users must provide their name, email address and telephone number to create a user ID and password. The Issuer Oversight Compliance Reviews database in TeamMate does include Personally Identifiable Information (PII) and Protected health information (PHI). Agents and Broker data may include spreadsheets with names and positions, and practice addresses. 

The following PII is included in the system: 

License Number; Social Security Number (SSN);
E-Mail Address;
Medical Notes;
Date of Birth;
Mailing Address;
Financial Account Info;
Passport Number;
Name;
Mother’s Maiden Name;
Phone Numbers;
Certificates;
Military Status;
Taxpayer ID;
Photographic Identifiers;
Medical Records Numbers;
Legal Documents;
Employment Status;
Date of Death;
Therapy Records;
Other (User credentials- user ID and password, Provider Tax ID Number).

 VAMS TM Plus which is a web-based application is only accessible on the CMS network (CMS Zscaler). Since non-CMS contractors do not have access to CMSNET, they need the CMS Zscaler to be able to access the application. Users must have an Enterprise User Administration (EUA) ID and a list of Job codes assigned to their EUA profile. Additionally, The CMS TeamMate Champion (TM Plus admin user) will need to create an account for the new user in TM+ using the following information from the user. First Name, Last Name, Email, EUA ID - (as username), Phone Number.

Information within VAMS is stored for 10 years or until CMS requires to hold in the system. 

VAMS hosts software developed by Wolters Kluwer called TeamMate Plus which is an audit management tool that allows CCIIO to create and manage the analysis, audits, examinations, form filings, rate review analysis and the associated documents and work papers of Health Plans and conduct investigations.  Additionally, to access VAMS, users input a user ID and password. This information is maintained for as long as the user requires access for job functions.  For TM Plus, users will use their EUA ID within Identity Management (IDM) to login and access the software. Finally, information may include the following details: policy number, certificate number (identifies a member under a group health insurance master contract) subscriber ID, name, diagnostic and procedure codes, address, member ID, enrollment or termination dates, Provider name, Provider address, provider Tax ID Number (in some cases, depending on what the Issuer submits).

Authentication to VAMS requires that the user enter PII in the form of a username.  The username contains the users First Name and Last Name

• Social Security Number
• Name
• Driver's License Number
• Mother's Maiden Name
• E-Mail Address
• Phone Numbers
• Medical Notes
• Certificates
• Military Status
• Taxpayer ID
• Date of Birth
• Photographic Identifiers
• Mailing Address
• Medical Records Number
• Financial Account Info
• Legal Documents
• Employment Status
• Passport Number
• Date of Death
• Other - User credentials- user ID and password, Provider Tax ID Number Therapy Records

• Employees
• Public Citizens
• Vendors/Suppliers/Contractors
• Patients

• In-Person
• Online

• Private Sector
• Other - Contractors

Users cannot opt-out of collection or use of PII (their user credentials) because it is required to access the VAMS system.

For situations in which the system requests PII from individuals and those individuals do not have the choice to opt-out of the use or collection of their PII, individuals cannot opt-out because the information is necessary for users to be contacted. 

Major changes to the VAMS system, including a change in authentication mechanism for user credentials, will include multiple communications to the users following the VAMS Release and Version Management Plan. This plan includes emailing individuals with PII in the system to inform them of major changes that will take place.

Additionally, since the users are logged into AWS or IDM that system is responsible for notifying the users of any changes to that system's parameters 

VAMS system users can contact the Federal Exchange Program Systems (FEPS) Help Desk which is the Marketplace Service Desk at 855-267-1515 or by email at CMS_FEPS@cms.hhs.gov with any concerns regarding their user credentials. 

They can also contact the CMS Information Technology (IT) Help Desk at 1-800-562-1963 or 410-786-2580 or by email at CMS_IT_Service_Desk@cms.hhs.gov  to report PII concerns related to AWS or IDM. A user can either email or call the Help Desk. The Help Desk may engage the Exchange Operation Center (XOC), if additional support or investigation is required for resolution of the concern.

• Users - Users perform the functions of VAMS. As such, they must know each other's names and email addresses in order to complete audits, investigations and communicate with each other.
• Administrators - Administrators need to be able to update users' information, including name, email address, and phone number.
• Contractors - Direct Contractors are contracted by CMS to perform audits of Health Insurance Providers and investigations.  As such, they must know each other's names and email addresses in order to complete audits, investigations and communicate with each other.  In addition, audited records may contain PII and PHI for individual insured, for the purposes of satisfying the requirements.

Administrative controls within the system ensure that only the users with the proper permissions have access to PII within the system. Specifically, this user group (users) contains all users within the system.  Users who have not been granted the role of 'User' cannot access PII within VAMS. Access to PII is granted based on the user's role following the principles of minimum necessary and least privilege.

Access to the 'User' group is granted by System Administrators. This group is audited quarterly.

Access to PII is granted based on the user's role following the principles of minimum necessary and least privilege. Administrators must approve all system access and re-certify that access within every 365 days. Only administrators may change PII within the system. All actions are logged.

Technical controls for this access are provided through the Active Directory maintenance tool within AWSCLOUD.  Authority to use this tool is only given by the AWSCLOUD administrators.

Only the CCIIO Business owners that are identified by CMS PE workstream leads are granted the role of a CMS PE Champion within TM Plus. CMS PE Champions are able to create an account within TM Plus software/tool

All PII will be retained for as long as necessary or until system retirement.  After system retirement, data destruction will be handled per the established CMS guidelines. This will include deletion of data from physical drives, and formal documentation of data destruction with signed confirmation by the contractor and business owner.

Per National Archives Record Association approved record Disposition Authority, General Records Schedule (GRS) 24, item 13a1: Destroy/delete when 7 years 6 months, 10 years 6 months, or 20 years 6 months old, based on the maximum level of operation of the Certification Authority, or when no longer needed for business, whichever is later

The administrative controls in place to secure the PII include access control - request and authentication through the AWSCLOUD system or IDM System, periodic review of users and deletion of non-active accounts, role-based access for developers and administrators. 

The technical controls in place are firewalls that prevent unauthorized access, encrypted access when users access VAMS and computer system controls that prevent users without administrative or developer access to log into a test environment. The test environment and usable application are not joined together.

VAMS is hosted in the AWSCLOUD that employs physical controls and monitoring to restrict physical access and ensure the security of doors; the efficacy of heating and air conditioning, smoke and fire alarms, and fire suppression systems; and by employing cameras, fencing and security guards.