(Medicare Claims Processing Manual)

 Section 1173 required the adoption of standards for transactions, code sets, and unique health identifiers for each individual, employer, health plan, and health care provider.    Section 1174 required th e adoption of standards for designated transactions, except electronic attachments.    Section 1175 prohibited health plans from refusing to conduct a transaction as a standard transaction, and delaying the processing and or adversely affecting its processing.    Section 1176 established civil monetary penalties for violation of the provisions of Part C of Title XI.    Section 1177 established penalties for any person that knowingly misuses a unique health identifier, or obtains or discloses individually  identifiable health information.    Section 1178 indicated provisions of Part C of Title XI of the Act, as well as any standards or implementation specifications adopted under them generally supersede contrary provisions of State law.    Section 1179 makes these provisions of the Act inapplicable to financial institutions or anyone acting on behalf of a financial institution when authorizing, processing, clearing, selling, billing, transferring, reconciling, or collecting payments for financial institutions.   HIPAA mandates all covered entities to comply with the use and maintenance of certain standards.  More recently the passing of The America Reinvestment and Recovery Act (ARRA) has further enhanced the definitions and requirements mandated under HIPAA.   20.2 - The America Reinvestment and Recovery Act ( ARRA)  (Rev. 2803, Issued: 10- 28-13, Effective: 09- 17-13, Implementation: 09- 17-13)  The purposes of this Act is to provide guidance with the development of nationwide health information technology infrastruct ure that allows for the electronic use and exchange of information that:   (1) ensures that each patients health information is secure and protected, in accordance with applicable law;   (2) improves health care quality, reduces medical errors, reduces heal th disparities, and advances the delivery of patient centered medical care;   (3) reduces health care costs resulting from inefficiency, medical errors, inappropriate care, duplicative care, and incomplete information;   (4) provides appropriate information to help guide medical decisions at the time and place of care;   (5) ensures the inclusion of meaningful public input in such development of such infrastructure;   (6) improves the coordination of care and information among hospitals, laboratories, physician  offices, and other entities through an effective infrastructure for the secure and authorized exchange of health care information;   (7) improves public health activities and facilitates the early identification and rapid response to public health threats and emergencies, including bio terror events and infectious disease outbreaks;   (8) facilitates health and clinical research and health care quality;   (9) promotes early detection, prevention, and management of chronic diseases;   (10) promotes a more eff ective marketplace, greater competition, greater systems analysis, increased consumer choice, and improved outcomes in health care services; and   (11) improves efforts to reduce health disparities   The term covered entity has the meaning of a health care provider that conducts certain transactions in electronic form, a health care clearinghouse, and a health plan.  ARRA extends all requirements applicable to covered entities to their business associates.   A business associate as defined by CFR 45, Part 160.103 is, with respect to a covered entity, a person who:    performs, or assists in performing a function or activity involving the disclosure of individually identifiable health information, except as a member of the covered entitys workforce.  Relevant  activities include:  o claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, billing, benefit management, practice management, and re -pricing; or   o provision of legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services.   A covered entity may be a business associate of another covered entity.   Therefore, in compliance with ARRA, a business associate of a covered entity must comp ly with the same requirements as a covered entity.   20.3 - HIPAA and ARRA on Security and Privacy (Rev. 2803, Issued: 10- 28-13, Effective: 09- 17-13, Implementation: 09- 17-13)  Two aspects of the HIPAA and ARRA legislation are pertinent to this chapter:   1. Ensuring the security of electronic data transmitted between covered entities, and  2. Ensuring the privacy of individuals who are the subject of electronic information being transmitted between covered entities.   The ARRA legislation states the following in re ference to actions to be taken by a covered entity or their business associate in case of a breach of protected health information:   H.R. 1 -146, Subtitle D, Part 1, Section 13402 states that a  [covered entity or a] business associate of a covered entity that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured protected health information shall, following the discovery of a breach of such information, notify the covered entity of such breach. Such notice shall include the identification of each individual whose unsecured protected health information has been, or is reasonably believed by the business associate to have been, accessed, acquired, or disclosed during such breach. See section 40.1.2.2 for a description of Medicare security and privacy requirements.   20.4 - Administrative Simplification and Compliance Act (ASCA)  (Rev. 2803, Issued: 10- 28-13, Effective: 09- 17-13, Implementation: 09- 17-13)  The Administrative Simplification Compliance Act (ASCA) prohibits payment of services or supplies that a provider did not bill to Medicare electronically. Providers is used in a generic sense here and refers equally to physicians, suppliers, and other health care providers. Providers are required t o self -assess to determine whether they meet certain permitted exceptions to this electronic billing requirement.   ASCA self -assessable situations are described in the ASCA self assessment page in this section of the CMS web site. In some cases, providers are required to submit a written request to their Medicare contractor to receive permission to submit some or all of their claims on paper.   A/B MACs and DME MACs are required to contact providers that appear to be submitting high numbers of paper claims to verify that those providers meet one or more of the exception criteria for continued submission of their claims on paper.  See Section 90 below for further details regarding ASCA requirements, or access www.cms.gov/ElectronicBillingEDITrans for further information on ASCA enforcement reviews, the self assessment, and the waiver application.   30 - EDI Enrollment and Registration (AKA Trading Partner Agreements)  (Rev. 2803, Issued: 10- 28-13, Effective: 09-17-13, Implementation: 09-17-13)  Medicare FFS Trading Partner Agreement is comprised of two forms: 1) EDI Registration and 2) EDI Enrollment.  The forms are identified under CMS form 10164 and can be accessed at:  EDI Registration - http s://www.cms.gov/cmsforms/downloads/CMS10164A.pdf and  EDI Enrollment - https://www.cms.gov/cmsforms/downloads/CMS10164B.pdf    A/B MACs and CEDI must use these two forms, or their own orga nization specific forms given they are comparable in terms of content, to transmit data files electronically between themselves and their trading partners.   EDI registration and enrollment shall be instituted by the A/B MACs and CEDI and shall accomplish the following:  1. Document the specific type of transactions and transmission methods to be utilized and secure authorizations from the provider or other trading partner requesting to exchange electronic administrative transactions, and   2. Designate the A/B MA Cs and CEDI with whom the provider or other trading partner agrees to engage in EDI and implements standard policies and practices to ensure the security and integrity of the information to be exchanged.  Under HIPAA, EDI applies to all covered entities tr ansmitting the following administrative transactions: ASC X12 837 institutional claim and ASC X12 837 professional claim, ASC X12 835 remittance advice, ASC X12 270/271 eligibility, ASC X12 276/277 claim status and NCPDP claim (and others that are not used by Medicare at this time).  Beginning on January 1, 2012, A/B MCs and CEDI will also use the ASC X12 TA1 interchange acknowledgment, ASC X12 999 implementation acknowledgment and ASC X12 277CA claim acknowledgment error handling transactions.  In addition, CEDI and DME MACs will also use the NCPDP standard transmission response transaction. Entities who prepare and submit the CMS 1500 or CMS 1450 paper claim forms do not need to complete an EDI registration.  30.1 - EDI Enrollment  (Rev.: 4388; Issued: 09-06-19; Effective: 10-07-19; Implementation: 10-07-19)   A/B MACs and CEDI are required to furnish new providers that request Medicare claim privileges information on EDI.  A/B MACs and CEDI are required to assess the capability of entities to submit data electronically, establish their qualifications (see test requirements in 50), and enroll and assign submitter EDI identification numbers to those approved to use EDI.  All providers are required to submit their claims electronically, per ASCA, unless they qualify for a waiver (see section 90 below).   The EDI enrollment process for the Medicare beneficiary inquiry system HETS (HIPAA Eligibility Transaction  System (HETS 270/271)) is currently a separate process. Information on the EDI enrollment process for HETS can be found on the CMS HETSHelp website ( http://www.cms.gov/HETSHelp/).  A provider must obtain an NPI and furnish that NPI to their A/B MAC and CEDI prior to completion of an initial EDI Enrollment Agreement and issuance of an initial EDI number and password by that contractor.  The A/B MACs and CEDI are required to verify tha t NPI is active in the Provider Enrollment, Chain and Ownership System (PECOS) . If the A/B MAC or CEDI is not able to verify the NPI as active in PECOS, the EDI Enrollment Agreement is denied and the provider is encouraged to contact the A/B MAC provider e nrollment department (for Medicare Part A and Part B providers) or the National Supplier Clearinghouse (for DME suppliers) to resolve the issue.  Once the NPI is properly verified, the provider can reapply the EDI Enrollment Agreement.  A providers EDI number and password serve as a providers electronic signature and the provider would be liable if any entity with which the provider improperly shared the ID and password performed an illegal action while using that ID and password.  A providers EDI access  number and password are not part of the capital property of the providers operation, and may not be given to a new owner of the providers operation.  A new owner must obtain their own EDI access number and password.  When leaving the Medicare Program, a provider must notify their MAC to deactivate the EDI number.  If providers elect to submit/receive transactions electronically using a third party such as a billing agent or a clearinghouse, the A/B MACs or CEDI must notify those providers that they are r equired to have an agreement signed by that third party.  The third party must agree to meet the same Medicare security and privacy requirements that apply to the provider in regard to viewing or use of Medicare beneficiary data.  (These agreements are not to be submitted to Medicare, but are to be retained by the providers.)  The providers must also be informed that they are not permitted to share their personal EDI access number and password with any billing agent or  clearinghouse.  Providers must also not share their personal EDI access number to anyone on their own staff who does not need to see the data for completion of a valid electronic claim, to process a remittance advice for a claim, to verify beneficiary eligibility, or to determine the status of  a claim.  No other non-staff individuals or entities may be permitted to use a providers EDI number and password to access Medicare systems.  Clearinghouse and other third party representatives must obtain and use their own unique EDI access number and password from those A/B MACs or CEDI to whom they will send or receive EDI transactions.  For a complete reference to security requirements see section 40.1.2.2 below and refer to the Appendix A CMSR High Impact Level Data document (sections IA -2 and SA -9) located on the CMS website https://www.cms.gov/Research -Statistics -Data- and-Systems/CMS -Information -Technology/CIO- Directives -and-Policies/CIO -IT-Policy -Library -Items/STANDARD- ARS -Acceptable- Risk-Safeguards.html .  30.2 - New Enrollments and Maintenance of Existing Enrollments  (Rev. 4202, Issued: 01- 18-19, Effective: 02-19-19, Implementation: 02-19-19)  The term Medicare beneficiary identifier (Mbi) is a general term describing a beneficiarys Medicare identification number. For purposes of this manual, Medicare beneficiary identifier references both the Health Insurance Claim Number (HICN) and the Medicare Beneficiary Identifier (MBI) during the new Medicare card transition period and after for certain business areas that will continue to use the HICN as part of their processes.