DEPARTMENT OF HEALTH & HUMAN SERVICES 
Centers for Medicare & Medicaid Services 
7500 Security Boulevard, Mail Stop S2-26-12 
Baltimore, Maryland   21244-1850 
 
 
 
     
  Medicaid and CHIP FAQs: Identification of Medicaid Beneficiaries Third Party Resources and 
Coordination of Benefits with Medicaid 
Updated September 11, 2014  
 
 
Q1:  What are the parameters of the Social Security Act related to the liability of health 
insurers and other third parties in paying for health care services provided to Medicaid 
beneficiaries? 
 
A1:  The Social Security Act (the Act) generally requires health insurers and other third 
parties that are legally liable to pay for health care services received by Medicaid 
beneficiaries to pay for the services that are primary to Medicaid.  However, state 
Medicaid agencies might mistakenly pay claims for which a third party may be liable, 
because they are not aware of the existence of other coverage. 
 
  The Deficit Reduction Act of 2005 (DRA) made a number of changes to  title XIX of the 
Social Security Act  intended to strengthen state Medicaid programs ability to identify 
and collect from third party payers that are legally responsible to pay claims primary to 
Medicaid. 
 
  Specifically, section 6035 of the DRA amended section 1902(a) (25) of the Act: 
 
(1) To clarify which specific entities are considered third parties and 
health insurers that may be liable for payment and that cannot 
discriminate against individuals on the basis of Medicaid eligibility; and, 
 
(2) To require that states pass laws requiring health insurers: 
(a) To provide the state with the coverage, eligibility, and claims data 
needed by the state to identify potentially liable third parties, 
including, at a minimum, name, address, and ID number; 
(b) To honor the assignment to the state of a Medicaid beneficiarys right 
to payment by insurers for health care items or services; and, 
  (c) Not to deny such assignment or refuse to pay claims submitted by 
Medicaid based on procedural reasons (e.g., the failure of the 
beneficiary to present his/her insurance card at the point of sale, or 
the states failure to submit an electronic, as opposed to a paper, 
claim). 
 
   
 
  Clarifying Entities Considered to Be Third Parties and Health Insurers 
 
Q2:  How are third parties defined in the Social Security Act (the Act) and what 
changes did the Deficit Reduction Act of 2005 (DRA) make to that definition? 
 
A2:  Section 1902(a)(25)(A) of the Act requires states to take all reasonable measures to 
ascertain the legal liability of third parties for health care items and services provided 
to Medicaid beneficiaries.  The DRA did not change the definition of third parties, but 
rather clarified the entities subject to the provisions of section 1902(a) (25) (A) and (G) 
of the Act.  Section 6035(a) of the DRA amended section 1902(a)(25)(A) of the Act to 
clarify that the third parties subject to the provisions of 1902(a)(25) include:  (1) self-
insured plans, (2) pharmacy benefits managers (PBM), and (3) other parties that are, 
by statute, contract, or agreement, legally responsible for payment of a claim for a 
health care item or service, including workers compensation, automobile insurance, 
and liability insurance plans.  The DRA also replaced reference to a health maintenance 
organization with a managed care organization (MCO) in identifying the types of 
third parties to which the provisions of section 1902(a) (25) apply. 
 
  Section 1902(a) (25) (G) of the Act prohibits health insurers from taking an individuals 
Medicaid status into account in enrollment or payment decisions.   
 
Q3:  How does section 1902(a) (25) of the Social Security Act (the Act) define health 
insurers? 
   
A3:  Section 1902(a) (25) (I) of the Act defines health insurers to include self-insured plans, 
group health plans (as defined in section 607(l) of the Employee Retirement Income 
Security Act of 1974 (ERISA)), service benefit plans, managed care organizations (MCOs), 
pharmacy benefit managers (PBMs), and other parties that are, by statute, contract, or 
agreement, legally responsible for payment of a claim for a health care item or service.  
Workers compensation, automobile insurance, and liability insurance plans all are 
included within the definition of health insurers for purposes of this section and the 
requisite state laws which must be enacted pursuant to it.   
 
The CMS interprets other parties that are, by statute, contract, or agreement, legally 
responsible for payment of a claim to include: 
 
(1) Prepaid Inpatient Health Plans (PIHPs) and Prepaid Ambulatory Health Plans 
(PAHPs).  For purposes of Medicaid managed care, PIHPs and PAHPs are 
entities that contract with the state to deliver Medicaid-covered services; in 
that context, they would also be considered other parties that are, by 
contract, legally responsible for payment of a claim for a health care item or 
service; and, 
 
2 
  (2) Such entities as third party administrators (TPAs), fiscal intermediaries, and 
managed care contractors, which administer benefits on behalf of the risk-
bearing plan sponsor (e.g., an employer with a self-insured health plan).  
CMS recognizes that entities such as PBMs and TPAs do not necessarily have 
ultimate financial liability, but, to the extent that they are required, by 
contract or otherwise, to review claims and authorize payment by the plan 
sponsor, they are included within the definition of third party and health 
insurer for purposes of section 1902(a) (25) of the Act. 
 
Nothing in revisions to the Social Security Act made by the Deficit Reduction Act of 
2005 (DRA) imposes new liability to pay claims on entities that do not otherwise bear 
such liability.  Nor does section 1902(a) (25) of the Act negate any right of 
indemnification against a plan sponsor or other entity with ultimate liability for health 
care claims by a contracting party that pays the claims. 
 
Q4:  Are Pharmacy Benefits Managers (PBMs) and Third Party Administrators (TPAs) 
considered to be third party resources for purposes of Medicaid? 
 
A4:  Yes.  PBMs and TPAs are considered to be third parties, as clarified in section 6035(a) 
of the Deficit Reduction Act of 2005 (DRA)s amendment of section 1902(a)(25)(A) of 
the Social Security Act.   
 
PBMs, TPAs, and similar entities may not have financial liability for actual payment of 
claims, depending on the nature and extent of services to be performed for the health 
insurer, as specified in the contract.  However, if the PBM or TPA performs claims 
review and payment authorization for another third party, the PBM or TPA is expected 
to provide information to the Medicaid program, so the program can determine which 
party is the primary payer, for the purpose of coordinating benefits for the Medicaid 
beneficiary.       
 
State law enacted to implement section 6035(a) of the DRA must require the health 
insurer that contracts with a PBM, TPA, or other such entity to administer the plan to 
provide the contracted entity with such information as may be necessary to enable that 
entity to furnish the state with information about when Medicaid beneficiaries may be 
(or may have been) covered by the health insurer, the nature of the coverage, and other 
necessary information.   
 
Q5:  Are indemnity insurance policies considered to be third party resources for purposes of 
Medicaid? 
 
A5:  Indemnity policies may be considered third party resources if the policies meet certain 
criteria.  Federal Medicaid regulations at 42 CFR 433.136 define a third party as any 
individual, entity, or program that is or may be liable to pay all or part of the 
expenditures for medical assistance furnished under a state plan.  This includes private 
3 
  insurance.   Section 433.136 also defines private insurer to include any commercial 
insurance company offering health or casualty insurance to individuals or groups 
(including both experience-related insurance contracts and indemnity contracts).  
Private insurers are required to comply with the Deficit Reduction Act of 2005 (DRA) and 
related state enactments.   
   
Indemnity plans may include a variety of insurance policies such as accident, 
cancer/specified disease, dental, hospital confinement indemnity, hospital confinement 
sickness indemnity, hospital intensive care, long-term care, short-term disability, 
specified health event, and vision.  An individualized review of the various policy terms 
would be necessary to determine if they should be considered a third party resource for 
purposes of Medicaid.  If this review determines that the policy provides for payment of 
health care items and services, the policy is a third party resource and payments would 
be assigned to the Medicaid agency. 
 
An indemnity policy may be designed to pay a cash benefit to policyholders, unless the 
policyholder chooses otherwise.  The policy may state that these payments may be used 
to cover medical expenses or living expenses such as rent, child care, or groceries.  
However, the insurance company may condition payment upon the occurrence of a 
medical event.  Whenever payments are linked to specific medical events, these 
payments should be considered third party payments.  Thus, the state could seek to 
recover Medicaid payments from the policy benefits.   
 
Where indemnity policies do not qualify as a third party resource, any payments made 
to a Medicaid beneficiary may be countable as income for Medicaid eligibility purposes.  
 
Provision of Eligibility Coverage and Claims Data 
 
Q6:  What are the requirements  under the Social Security Act for health insurers to 
share eligibility information with state Medicaid agencies? 
 
A6:  Section 6035(b) of the Deficit Reduction Act of 2005 (DRA) created a new 
subparagraph (I) in section 1902(a)(25) of the Social Security Act (the Act), that 
requires states to establish laws that require the production of the  information 
necessary for each state Medicaid agency to determine third party liability for services 
rendered to Medicaid beneficiaries.  Specifically, section 1902(a) (25) (I) (i) of the Act 
directs  states, as a condition of receiving federal financial participation (FFP) for 
Medicaid, to have laws in effect that require health insurers doing business in their 
state to provide the state with the requisite information with respect to individuals 
who are eligible for, or are provided medical assistance, i.e., Medicaid beneficiaries.   
 
  States pass their own laws regarding the submission of health insurance information 
to implement the provisions of the DRA.  As with most federal laws that require some 
4 
  action on the part of the state to implement, states have some latitude in determining 
how best to comply.  Since the information would be provided to the state Medicaid 
agency as required by that states laws, it follows that the submission should conform 
to what is required under that state law.  Such requirements would ensure the state 
Medicaid agencys access to the information is necessary and sufficient to determine 
third party liability for care provided to Medicaid beneficiaries.  
 
Q7:  What information are health insurers required to share with state Medicaid agencies? 
 
A7  States enact laws to comply with section 1902(a) (25) (I)(i) of the Social Security Act and 
must require health insurers to provide, upon the request of the state, information to 
determine during what period Medicaid beneficiaries may be (or may have been) 
covered by the health insurer and the nature of the coverage that is or was provided.    
 
This information includes, at a minimum, four (4) data elements: the insureds name, 
address, group or member ID number, and periods of coverage.  State laws determine 
exactly what information is required to be submitted by the health plans.  Health plans 
are to provide these files to state Medicaid programs so that these programs can 
determine whether any third party payers are liable for the medical items and services 
that were, or will be, delivered to a Medicaid beneficiary.  In essence, the point of the 
information gathering is to ensure that Medicaid benefits are paid correctly. 
 
In the case of health insurers who contract with a pharmacy benefit manager (PBM) or 
other third party administrator (TPA) to administer the plan, states also will need to 
require that such insurers provide the PBM or TPA with such information as may be 
necessary to enable that entity to furnish the state with the prescribed data, or deal 
with such inquiries directly without the aid of their PBM or TPA. 
 
Q8:  How far back can state Medicaid agencies go in requesting eligibility and 
coverage information from health insurers? 
 
A8:  The Deficit Reduction Act of 2005 (DRA) requires states to have laws in effect that 
require health insurers to honor claims submitted by the Medicaid agency within 
three years of the date of service.     
 
Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule and Sharing 
of Third Party Eligibility and Coverage Information with Medicaid Programs 
 
Q9:  How may state Medicaid agencies use the data obtained from the third party insurers? 
 
A9:  State Medicaid agencies and their business associates can use the data obtained 
pursuant to the process established under section 1902(a)(25)(I) of the Social Security 
Act and applicable state laws, as permitted or required by law.  This should include the 
5 
  coordination of payments for services covered under the Medicaid state plan and 
actions to ensure that correct payment amounts are made under the Medicaid program 
and that mistaken payments are recovered.  If the appropriate legal relationships are 
established (e.g., business associate agreements under the Health Insurance Portability 
and Accountability Act of 1996 (HIPAA)), we expect that the data could be released to 
entities working under contract with a state agency for use in activities such as claims 
adjudication activities, or for the purpose of recovering improper Medicaid payments.  
State Medicaid agencies must have procedures in place  to ensure that the privacy of 
individuals is appropriately protected, and that information concerning applicants and 
beneficiaries is protected in accordance with the requirements of 42 CFR Part 431 
Subpart F and the regulations at 45 CFR Parts 160 and 164, which were promulgated 
under HIPAA and Health Information Technology for Economic and Clinical Health 
(HITECH) Act. 
 
Q10:  Does a health plans submission of information from its full eligibility file, for the 
purpose of matching that information to the Medicaid eligibility file, violate the 
Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy rules? 
 
A10:  State laws determine what information is required of the health plans.  A health plans 
disclosure and use of information that is required to be submitted under state law  such 
as, information from insurer eligibility files sufficient to determine during what period 
any individual may be, or have been, covered by a health insurer and the nature of the 
coverage that is or was provided by the health insurer  is consistent with the HIPAA 
privacy provisions.  
 
Under HIPAA, both the state Medicaid agency and most health insurers are covered 
entities and must comply with the HIPAA Privacy Rule in 45 CFR Part 160 and Part 164, 
Subparts A and E.  In their capacities as covered entities under HIPAA, the state 
Medicaid agency and health insurers  are restricted from using and disclosing protected 
health information (PHI), as that term is defined in 45 CFR section 160.103, other than 
as permitted or required by the HIPAA Privacy Rule.  However, as relevant here: 
 
(1)  A covered entity may use or disclose PHI to the extent that such use or 
disclosure is required by law and the use or disclosure complies with and is 
limited to the relevant requirements of the law.  (45 CFR 164.512(a)(1))  
Under this provision, each covered entity must be limited to disclosing or 
using only the PHI necessary to meet the requirements of the law that 
compels the use or disclosure.  Anything required to be disclosed by a law 
can be disclosed without violating HIPAA under the required by law 
provisions.  Therefore, health insurers may disclose data elements in addition 
to the four minimum data elements, up to and including submission of an 
entire insurer eligibility file, to the extent such information is required to be 
submitted by state law. (45 CFR 164.512(a)) 
 
6 
  (2) Separately, a covered entity may use or disclose PHI, without the consent of 
an individual, for payment activities, including to facilitate payment.  (45 CFR 
164.502(a)(1) and 164.506)  Under HIPAA, the term payment includes 
activities undertaken by a health plan to determine or fulfill its responsibility 
for coverage and provision of benefits under the health plan.  These activities 
include determinations of eligibility or coverage, adjudication or subrogation 
of health benefits claims, and collection activities. (45 CFR 164.501)  To the 
extent plans are releasing this information to the Medicaid program for 
payment purposes; this is a separate basis for disclosure under HIPAA. 
 
(3) The HIPAA Privacy Rule generally requires covered entities to take 
reasonable steps to limit the use and disclosure of PHI to the minimum 
necessary to accomplish the intended purpose. (45 CFR 164.502(b)(1))  
However, among other limited exceptions, the minimum necessary 
requirements do not apply to uses or disclosures that are required by law 
under 45 CFR 164.512(a). 
 
Data Matching with Out-of-State Carriers 
   
Q11:  May state Medicaid agencies request information on subscribers and dependents 
covered in other states? 
 
A11:  Yes.  There is a significant amount of third party coverage derived from health plans 
licensed in a different state than where the Medicaid beneficiary resides.  This can 
commonly happen when the policyholder works in one state and lives in another 
state.  For example, there may be policyholders who are enrolled in Medicaid 
coverage in Maryland, or have dependents that are enrolled, who work in Delaware, 
the District of Columbia, Pennsylvania, Virginia, or West Virginia and also have 
coverage through their employer in that state.  This highlights the need for Medicaid 
agencies to obtain plan eligibility information from contiguous states in addition to 
collecting information in their respective state. 
 
Another example is when Medicaid-eligible children are covered by the insurance plan 
of non-custodial parents who live in a different state than their child(ren).  This 
example is not limited to contiguous states because non-custodial parents could 
reside in any state in the country.  Depending on the size, it may be beneficial for the 
state to obtain the plans entire eligibility file.  The specific geographical areas to be 
included in the data exchange should be negotiated with the plans.  We recommend 
use of a Trading Partner Agreement in the exchange of electronic data. 
 
Finally, section 1902(a)(25)(I)(i) of the Social Security Act directs states, as a condition of 
receiving federal financial participation (FFP) for Medicaid, to have laws in effect that 
require health insurers doing business in their state to provide the state with the 
7 
  requisite information with respect to individuals who are eligible for, or are provided 
medical assistance, i.e., Medicaid beneficiaries.  State law cannot reach beyond the 
entities that are doing business in their states. 
 
   
8 
  States Use of Contractors for Data Matching and Claims Submission 
 
Q12:  May state Medicaid agencies use contractors to complete data matches with health 
insurers? 
 
A12:  Yes. State Medicaid programs may enter into data matching agreements directly with 
third parties or may obtain the services of a contractor to complete the required 
matches. Such arrangements should comply with Health Insurance Portability and 
Accountability Act of 1996 (HIPAA)s Business Associate requirements, where 
applicable.  When the state Medicaid program chooses to use a contractor to complete 
data matches, including matches as required by the Deficit Reduction Act of 2005 (DRA), 
the program delegates its authority to obtain the desired information from third parties 
to the contractor. 
 
Third parties should generally treat a request from the contractor as a request from the 
state Medicaid agency.  Third parties may request verification from the state Medicaid 
agency that the contractor is working on behalf of the agency and the scope of the 
delegated work. 
 
Medicaid Managed Care Organizations (MCOs) and Third Party Liability (TPL) 
 
Q13:  Can Medicaid Managed Care Organizations (MCOs) use a contractor to complete data 
matches with health insurers, as authorized by the state Medicaid agency? 
 
A13:  Yes. State Medicaid programs may contract with MCOs to provide health care to 
Medicaid beneficiaries, and may delegate responsibility and authority to the MCOs to 
perform third party liability TPL discovery and recovery activities, including data 
matches as required by the Deficit Reduction Act of 2005 (DRA). The Medicaid program 
may authorize the MCO to use a contractor to complete these activities.  The contract 
language between the state Medicaid agency and the MCO dictates the terms and 
conditions under which the MCO assumes TPL responsibility.  Generally, any TPL 
administration and performance standards for the MCO will be set by the state and 
should be accompanied by state oversight. 
 
When TPL responsibilities are delegated to an MCO, third parties are required to treat 
the MCO as if it were the state Medicaid agency, including: 
 
(1) Providing access to third party eligibility and claims data to identify 
individuals with third party coverage; 
 
(2) Adhering to the assignment of rights from the state to the MCO of a 
Medicaid beneficiarys right to payment by such insurers for health care 
items or services; and, 
9 
   
(3) Refraining from denying payment of claims submitted by the MCO for 
procedural reasons. 
 
Third parties may request verification from the state Medicaid agency that the MCO or 
its contractor is working on behalf of the agency and the scope of the delegated work. 
 
Requiring Third Parties to Honor the States Assignment of Rights and to Reimburse Medicaid 
Appropriately for Claims Paid by Medicaid 
 
Q14:  What is the responsibility of liable third parties regarding health insurers denials of 
Medicaid claims based on insurers procedural requirements?   
 
A14:  Under section 1902(a)(25)(H) of the Social Security Act (the Act) before passage of the 
Deficit Reduction Act of 2005 (DRA), states were required to have laws in effect that to 
the extent Medicaid payment was made, the state was considered to have acquired 
the rights of the Medicaid beneficiary to reimbursement by any other party that was 
liable for payment. However, payers sometimes deny Medicaid claims based on 
procedural requirements.  Section 1902(a)(25)(I) of the Act, added by the DRA, 
strengthens the statute by requiring states to enact laws that require health insurers: 
 
(1) To accept the states right of recovery and the assignment to the state of the 
right of a Medicaid beneficiary or other entity to payment from such party 
for an item or service for which Medicaid has made payment; and, 
 
(2) To process and, if appropriate, pay the claim for reimbursement from 
Medicaid to the same extent that the plan would have been liable had the 
plans card been used for billing at the point of sale (POS). 
 
Specifically, the state should pass laws which require an insurer to agree not to deny 
claims submitted by the state on the basis of the date of submission of the claim, the 
type or format of the claim form, or a failure to present proper documentation of 
coverage at the POS that is the basis of the claim. 
 
Whether a plan provision affecting payment for an item or service is solely 
procedural in nature or whether it defines or limits the covered benefits must 
be determined on a case-by-case basis. 
 
Note that nothing in the DRA negates the states responsibility to provide 
proper documentation when submitting claims to the health insurer so that the 
insurer can determine that a covered service for which the insurer is liable was 
provided. 
 
10 
  Q15:  Are health plans permitted to require a National Provider Identifier (NPI) for 
transactions with Medicaid programs? 
 
A15:  No.  States typically do not meet the definition of a covered health care provider under 
45 CFR 160.103, and therefore, are not eligible to receive an NPI.  If states encounter 
situations where plans are requiring them to submit an NPI, they can submit a formal 
complaint to the Office of E-Health Standards and Services (OESS) in CMS by using the 
online Administrative Simplification Enforcement Tool (ASET).  ASET allows individuals 
or organizations to electronically file a complaint against an entity whose actions they 
believe violate an Administrative Simplification provision of the Health Insurance 
Portability and Accountability Act of 1996 (HIPAA). 
 
States may submit a formal complaint electronically at:   https://htct.hhs.gov/aset/. 
ASET users are required to register with OESS and create a user identification name 
and password.  States also may submit a paper complaint.  The form is available at: 
www.cms.hhs.gov/Enforcement/Downloads/HIPAANon-PrivacyComplaintForm.pdf. 
 
State Medicaid Programs Claiming Period 
   
Q16:  How long do states have to submit a claim for reimbursement to health insurers? 
 
A16:  Section 1902(a)(25)(I) of the Social Security Act requires states to have laws in 
effect that require health insurers to make payment as long as the claim is 
submitted by the state within three years from the date on which the item or 
service was furnished.   
 
  Some health insurers currently deny claims submitted by Medicaid if they are not filed 
within a prescribed time limit, which is applied to plan beneficiaries and providers (e.g., 
a plan might require beneficiaries and providers to submit claims within 30 days from 
date of service).  If the state Medicaid agency is unable to ascertain the existence of the 
third party coverage and submit a claim within the time limit, the insurer may attempt 
to avoid liability.   
 
  Any action by the state to enforce its rights with respect to such claim must be 
commenced within six years of the states submission of such claim.  Health insurers 
also must respond to any inquiry by a state regarding claims submitted within three 
years from the date on which the item or service was furnished.   
 
Q17:  Are states precluded from having laws that require third parties to accept claims 
beyond the 3-year filing period prescribed in the Deficit Reduction Act of 2005 
(DRA)? 
 
11 
  A17:  No.  Section 1902(a)(25)(I)(iv) of the Social Security Act requires states to pass laws that 
would require health insurers to accept claims submitted by the state within the 3-year 
period beginning with the date on which the item or service was furnished.  States are 
not precluded from having laws or regulations that would require insurers to accept 
claims for a period of time longer than three years. 
 
Medicare Billing 
 
Q18:  May Medicaid programs bill Medicare directly?  
 
A18:  No.  States typically do not meet the definition of a covered health care provider, and 
therefore, are not eligible to receive a National Provider Identifier (NPI) number to 
enable them to bill Medicare.  The NPI is the standard unique identifier for health care 
providers that CMS adopted in 2007.  At that time, Medicare revoked existing billing 
numbers previously issued to Medicaid agencies and notified Medicare carriers to stop 
enrolling Medicaid programs as Medicare providers.  Only recognized providers and 
suppliers of services that have an NPI can enroll in Medicare.  Medicare will not enroll 
state Medicaid programs, as they are not direct providers or suppliers of services.     
 
Medicaid may submit claims to health plans on behalf of Medicaid beneficiaries who 
have assigned their rights to payment from third parties (other than Medicare) to the 
Medicaid program, under the authority of sections 1912, 1902(a)(25)(H), and 
1992(a)(25)(I)(ii) of the Social Security Act.  However, Medicaid doesnt have the same 
authority to submit claims to Medicare on behalf of a dually eligible beneficiary.  The 
rights to Medicare benefits are not assignable; only the Medicare provider and the 
beneficiary may submit claims to Medicare.   
 
Medicare Filing Timeframes 
 
Q19:   Is Medicare subject to the minimum 3-year timely filing period established in section 
6035 of the Deficit Reduction Act of 2005 (DRA) for state laws that regulate health 
insurers?  
 
A19:  No.  The DRA limit applies to health insurers, defined in section 1902(a)(25)(A) of the 
Social Security Act,  that are regulated by the states.  Medicare Parts A and B are not 
subject to state regulation, as they do not need to be licensed to do business in the 
states.   State law requiring health insurers to honor claims submitted within the timely 
filing period established by the state (minimum of three years) would apply to Medicare 
Part C and D plans.     
 
 
 
 
12 
  Q20:  What is Medicares general timely filing period? 
 
A20:  Sections 1814(a)(1), 1835(a)(1), and 1842(b)(3)(B) of the Social Security Act, as well as 
the Medicare regulations at 42 CFR section 424.44, specify the time limits for filing 
Medicare Fee-For-Service (FFS)--Part A and Part B--claims. 
 
The Affordable Care Act reduced the maximum period for submission of all Medicare 
FFS claims to no more than 12 months (one calendar year) after the date services were 
furnished.  This time limit policy for claims submission became effective for services 
furnished on or after January 1, 2010.  In addition, claims for services furnished prior to 
January 1, 2010, had to be submitted no later than December 31, 2010.  Section 6404 of 
the Affordable Care Act also mandated that CMS may specify exceptions to the one 
calendar year time limit for filing Medicare claims. 
 
Q21:  What are the exceptions to Medicares general timely filing period? 
 
A21:  Medicare regulations at 42 CFR section 424.44(b) allow for the following exceptions to 
the 1 calendar year time limit for filing fee for service claims:  
 
(1) Administrative error, if failure to meet the filing deadline was caused by error 
or misrepresentation of an employee, Medicare contractor, or agent of the 
Department that was performing Medicare functions and acting within the 
scope of its authority.  
 
(2) Retroactive Medicare entitlement, where a beneficiary receives notification 
of Medicare entitlement retroactive to or before the date the service was 
furnished.  For example, at the time services were furnished the beneficiary 
was not entitled to Medicare.  However, after the timely filing period has 
expired, the beneficiary subsequently receives notification of Medicare 
entitlement effective retroactively to or before the date of the furnished 
service.  
 
(3) Retroactive Medicare entitlement involving state Medicaid agencies, where a 
state Medicaid agency recoups payment from a provider or supplier 6 
months or more after the date the service was furnished to a dually eligible 
beneficiary.  For example, at the time the service was furnished, the 
beneficiary was only entitled to Medicaid and not to Medicare.  
Subsequently, the beneficiary receives notification of Medicare entitlement 
effective retroactively to or before the date of the furnished service.  The 
state Medicaid agency recoups its money from the provider or supplier and 
the provider or supplier cannot submit the claim to Medicare, because the 
timely filing limit has expired.  
 
13 
  (4) Retroactive disenrollment from a Medicare Advantage (MA) plan or Program 
of All-inclusive Care of the Elderly (PACE) provider organization, where a 
beneficiary was enrolled in an MA plan or PACE provider organization, but 
later was disenrolled from the MA plan or PACE provider organization 
retroactive to or before the date the service was furnished, and the MA plan 
or PACE provider organization recoups its payment from a provider or 
supplier 6 months or more after the date the service was furnished.  
 
TRICARE Filing Limits 
 
Q22:  Is TRICARE subject to the minimum 3-year timely filing period, established in section 
6035 of the Deficit Reduction Act of 2005 (DRA), for states that regulate health 
insurers?  
 
A22:  No.  Based upon federal authority set forth at 10 U.S.C. section 1103, Congress explicitly 
provided for preemption of state and local laws pertaining to health care financing 
methods for a contract entered into for medical and/or dental care, under Chapter 55 of 
the Armed Forces Title of the U.S. Code, by the Secretary of Defense or administering 
Department of Defense secretaries.  The preemption applies to contracts entered into 
for the purpose of administering TRICARE.   Thus, it is the position of the Department of 
Defense that TRICAREs 1-year timely filing limit is not superseded by the 3-year limit 
established in the DRA for health insurers who are regulated by the states, and that  
TRICARE is exempt, not only from the DRA timely filing requirements, but from the DRA 
requirements altogether.    
14