(Medicare Claims Processing Manual)

40.2.2.3 - Security -Related Requirements for A/B MACs, and CEDI Arrangements With  Clearinghouses and Billing Services  (Rev. 3346, Issued: 09- 04-15, Effective: 10- 06-15, Implementation: 10- 06-15)   A billing service is an entity that markets claim preparation services to providers and should also be able to perform related transactions for providers, such as eligibility and claim status inquiries.  The billing service collects a providers claim info rmation and then bills the appropriate insurance companies, including Medicare.  A billing service may submit claims only, or provide full financial accounting and/or other services.  Billing services are considered to be provider business associates.  As such, HIPAA requires that they comply with each of the privacy and security requirements that apply directly to providers.  They are also required to ensure that they require that any clearinghouses, subcontractors or other business associates of their own that may be involved with handling of Medicare beneficiary data also meet those same security and privacy requirements.  A billing service may view beneficiary or provider data to carry out their billing obligations for a provider, when a provider authori zes them to have that access.  To qualify as a billing service, an entity must at a minimum submit initial claims on the providers behalf.   A clearinghouse transfers or moves EDI transactions for a provider or billing service, and generally translates the EDI transactions from or into a proprietary format.  (HIPAA defines a clearinghouse as a business associate of a provider or a health care plan that translates data from a non -standard format into a standard format or vice versa as preferred by their clie nts.)  A clearinghouse generally accepts multiple types of incoming transactions and sends them to various payers, including Medicare.  Clearinghouses often perform general and payer -specific edits on claims, and may handle multiple types of EDI transactio ns for a given provider.  Clearinghouses frequently reformat data for various payers, and manage acknowledgments, remittance advice transactions, and claim status and eligibility queries.   Some entities that refer to themselves as clearinghouses, however, do not edit or translate data, but simply serve as a telecommunication switch, moving transactions from point A to Point B or wherever directed under the terms of the agreement with a provider.  A clearinghouse may also be called a value added network (V AN).  A clearinghouse/VAN may not view privacy -protected Medicare data unless a signed authorization has been filed by the provider for whom the clearinghouse/VAN will submit or received Medicare EDI transactions.  For EDI, a transaction that contains indi vidually identifiable information about a Medicare beneficiary is considered to be privacy protected data.   That provider may not authorize submission or receipt of data by a third party for a Medicare beneficiary unless that beneficiary is a current patient of the provider, has scheduled an appointment, or has inquired about the receipt of supplies or services from the provider.  The provider authorization must be filed with the Medicare contractor to whom EDI transactions will be sent or from whom they wi ll be received.  In the case of a DME claim, this authorization need only be submitted to CEDI.  If multiple A/B MACs are involved, an authorization must be submitted to each.   Each clearinghouse/VAN that will submit or receive Medicare EDI transactions is  prohibited from using the EDI number or password issued to any of the providers they serve.  Each clearinghouse/VAN must obtain its own EDI number and password from each A/B MAC with which it will interact.  For, DME, each Clearinghouse/VAN must obtain it s own EDI number and password from CEDI.   Some health care providers use or may want to use more than one billing service or clearinghouse/VAN.  An A/B MAC and CEDI ability to handle more than one agent varies.  Some A/B MACs and CEDIs are able to accommod ate one or more clearinghouses/VAN for submission of a providers claims to Medicare, another agent to receive the providers remittance advice transactions, and a third clearinghouse/VAN to verify beneficiary Medicare eligibility for a provider.  Others m ay not be able to accommodate more than one agent for a provider.  A/B MACs and CEDIs are encouraged to support more than one agent for a provider, when permitted by their front end configuration.  A/B MACs and DME MACs, or other contractors if designated by CMS must notify each provider that applies for permission to obtain eligibility data electronically that:   They are permitted to view Medicare eligibility data only for patients currently being treated by or who have requested treatment or supplies from  that provider;    A provider cannot authorize a billing agent or clearinghouse to submit or obtain data from an A/B MACs and DME MACs that the provider is not entitled to personally submit or obtain;    A request for personally identifiable information for an y other Medicare beneficiaries would be a violation of Medicare and HIPAA privacy requirements, and subject to the applicable penalties for such violations.  A/B MACs, and DME MACs must notify each billing service and clearinghouse/VAN at the time of their  application for access to Medicare eligibility data and by also posting information on their web site that:   Their access is limited to submission of transactions and receipt of transactions for those providers that are their clients, but only if those providers authorized the billing agent and/or clearinghouse/VAN to submit or receive each transaction.   A billing agent or clearinghouse/VAN that has provider authorization to submit claim data for a provider cannot obtain eligibility data for that provide r unless that was specifically authorized by the provider.    Likewise, the billing agent or clearinghouse/VAN cannot be sent remittance advice transactions for a provider unless specifically authorized to do so by that provider.   Providers must submit these  authorizations to their A/B MACs, DME MACs, CEDI or other contractors if designated by CMS in writing; an A/B MAC, DME MAC, CEDI or other contractor if designated by CMS is not permitted to accept a statement signed by a billing agent or clearinghouse/VAN  alleging that they have such provider authorization on file.  An original provider signature is required on these authorizations (but an A/B MAC, DME MAC, CEDI or other contractor if designated by CMS is allowed to accept an authorization signed by a provider by fax or mail).  The A/B MAC, DME MAC, CEDI, or other contractor if designated by CMS is responsible for maintenance of files to establish system access for individual providers, identify those billing agents and clearinghouses/VAN s authorized to access systems as the agent of a specific provider, and to record those transactions for which a billing agent or clearinghouse/VAN is authorized access as the representative of a specific provider.   With authorization, a clearinghouse/VAN may send inquiries for a provider, and receive responses, but it may not view personally identifiable beneficiary data contained in those queries or responses, store it for longer than necessary to assure delivery to the provider (no longer than 30 days maximum), or use pers onally identifiable data in any reports.  The EDI data sent or received belongs ultimately to the beneficiary, not to the clearinghouse/VAN that may translate and transport the data for a provider acting on the beneficiarys behalf.   Collection agents that contract with providers to collect bad debts and third party entities that may analyze data but do not have a specific initial claim submission role or are not responsible for posting of information in a remittance advice to patient accounts may not be sent beneficiary data by an A/B MAC, DME MAC, CEDI, or other contractor if designated by CMS.  If a collection agent or such a third party has provided adequate privacy and security assurances to protect beneficiary data, the provider may share Medicare payment information with a collection agent, data analysis firm, or similar third party, but the provider would need to furnish that data to that entity agent in this situation, however.  The Medicare program may not incur costs to furnish such data to collection agencies or to other entities that perform services that do not directly support Medicare  activities.  Delinquent collection, analysis of data related to a providers operations, and expenses related to other activities not directly related to Medicare claims or payments are considered provider business expenses.  Such activities do not direct ly benefit Medicare and Medicare may not incur costs to supply data intended only for such uses.  A provider must sign a valid EDI Enrollment Form (see Section 30.1 this chapter) prior to authorizing a billing agent or clearinghouse/VAN to submit/receive a ny EDI transactions on their behalf.  A separate password and User ID is to be used for system access by each authorized provider, billing agent or clearinghouse.  A vendor provides hardware, software and/or ongoing support for total office automation or submission of electronic EDI transactions directly to individual providers, billing agent or clearinghouses/VANs.  Vendors supply the means for Medicare system access but have no right to direct access to the system of an A/B MAC, DME MAC, CEDI, or other contractor if designated by CMS.   Vendor software is normally tested when it first begins to be used by providers, billing agents or clearinghouses/VANs.  At the request of a vendor or a clearinghouse/VAN, an A/B MAC, DME MAC, CEDI or other contractor if designated by CMS may, but is not required to, test new software before a provider has agreed to begin using that software to exchange Medicare eligibility transactions with the contractor.  When testing software prior to use by a provider, an A/B MAC, DME MAC, CEDI or other contractor if designated by CMS may not furnish a software vendor who does not currently submit or receive Medicare transactions with an EDI access number or password which would permit the vendor to access to actual Medicare beneficiary data.  That software is to be tested using a test database or by other means that would not disclose actual beneficiary data to the vendor.  This EDI access limitation for testing of new software does not apply to a clearinghouse/VAN with a history of submi ssion/receipt of EDI transactions with the contractor, or when a software vendor is also a clearinghouse/VAN or a provider billing agent (in which case, testing should only involve data for beneficiaries for which the entity already submit/receives transac tions).  40.2.2.4 - Release of Medicare Data  (Rev. 2803, Issued: 10- 28-13, Effective: 09-17-13, Implementation: 09-17-13)  The CMS is required by law to protect all Medicare beneficiary -specific information from unauthorized use or disclosure.  Disclosure of Medicare beneficiary data is restricted under the provisions of the Privacy Act of 1974 and HIPAA.  CMS instructions allow release of data to providers or their authorized billing agents for the purpose of preparing an accurate claim.  Such information may not be disclosed to anyone other than the provider, supplier, or beneficiary for whom the claim was filed.  A/B MACs, DME MACs or other contractors if designated by CMS must give access to any clearinghouse that requests access to data on behalf of providers as long as they adhere to the following rules:   Each clearinghouse requesting access to eligibility data must sign a Trading Partner Agreement (TPA) and agree to adhere to CMS rules of behavior (Refer to www.cms.gov/HETSHelp);   Each provider that contracts with a clearinghouse must sign a valid EDI Enrollment Form before data can be sent to the third party (see Section 30.1);    The provider must explain the type of EDI services to be furnished by its clearinghouse in a signed statement authorizing the clearinghouses access to data;    The clearinghouse must be able to associate each inquiry with the provider making the inquiry.  That is, for each inquiry made by a provider through a clearinghouse, the clear inghouse must be able to identify the correct provider making the request for each beneficiarys information and be able to assure that responses are routed only to the provider that originated each request; and    There is no record of prior violation of a TPA by this clearinghouse with the A/B MAC, DME MAC or other contractor if designated by CMS to whom a request for access to the data is submitted that would indicate that beneficiary data could be at risk of improper disclosure if access was approved for this clearinghouse.   A. All providers and clearinghouses that wish to obtain Medicare beneficiary data must apply to A/B MACs, DME MACs or other contractor if designated by CMS for access to the records.   B. Providers and clearinghouses must submit each query to the A/B MACs, DME MACs or other contractor if designated by CMS with which they are registered.  CMS supports multiple EDI and non -EDI methods for obtaining eligibility data, including ASC X12 270/271 eligibility (see IOM Pub. 100- 04 Chapter 31 for more information on the ASC X12 270/271 eligibility transaction).   C. When an inquiry is submitted, the A/B MAC, DME MAC, HETS 270/271, or other contractor if designated by CMS must be able to ensure that:    An EDI agreement has been signed by the provider;   A TPA has been signed by the clearinghouse; and   Each inquiry identifies the provider that initiated the query and to which the response will be routed.   D. Providers must be notified that:    they may obtain eligibility data only for the approved use of pre paring accurate Medicare claims;    access to eligibility data is limited to individuals within a providers organization who are involved in claim preparation and submission; and