Security - HETS 270/271

The Center for Medicare & Medicaid Services (CMS) is committed to maintaining the integrity and security of health care data in accordance with applicable laws and regulations. Disclosure of Medicare Beneficiary eligibility data is restricted under the provisions of the Privacy Act of 1974 and the Health Insurance Portability and Accountability Act of 1996 (HIPAA.) The Provider Medicare Beneficiary eligibility transaction is to be used for conducting Medicare business only. Providers interested in utilizing the HETS 270/271 application are advised to become familiar with the security related documents on this page and understand that CMS monitors the transaction for aberrant behavior.  Refer to Section 10.3 of the Medicare Claims Processing Manual in the Downloads section below.

Current Transaction Audit Process

CMS conducts audits of the HETS 270/271 application transactions. Components of these audits ensure that submitters are complying with the requirement to only submit 270 eligibility requests for valid, active Medicare Providers and/or Suppliers.

CMS has set a 99.5% match requirement to allow for occasional typographic errors associated with Provider numbers, lags in Provider enrollment and updates to data. Therefore, CMS conducts audits requiring that no more than 0.5% of NPI numbers can be in error, and that at least 99.5% of all transactions submitted contain a valid, authenticated Medicare NPI.

Below are some common Provider number errors:

• Dashes in the Provider number
• Terminated Provider number

All submitters are responsible for ensuring that only current/valid NPI numbers are submitted.

HETS 270/271 Suspension Procedures

• If a submitter fails audit criteria, access will automatically be suspended for the 24 hour period following the audit. The Medicare Customer Assistance Regarding Eligibility (MCARE) Help Desk will notify submitters of their suspension through an email.
• After three such suspensions, access will be terminated until a written Corrective Action Plan (CAP) outlining steps that will be taken to improve future audit results is submitted and accepted by CMS.  The MCARE Help Desk will provide a CAP template, when appropriate.
• Submitters with repeated terminations will face penalties up to and including permanent suspension of HETS 270/271 application trading privileges.

Per the Trading Partner Agreement (refer to the Related Links Inside CMS section below), all HETS 270/271 application submitters must take the necessary steps to ensure that only valid, active Medicare Providers receive Beneficiary eligibility information. Your cooperation in this endeavor is vital.

AAA Error Audit Process

CMS produces and evaluates routine reports on the Medicare HETS 270/271 application's submitter volume and error rates. 

Eligibility submitters whose error rates are higher than the published, tolerated Medicare HETS 270/271 application error rate are further evaluated for security risks, including compliance with the Medicare HETS 270/271 application's Eligibility Rules of Behavior.

Submitters who do not comply with CMS security requirements and/or the Eligibility Rules of Behavior will be contacted by the MCARE Help Desk.  These submitters will be advised that their overall error rate and trading practices must improve to an acceptable level within 14 calendar days or their trading access will be suspended.  These submitters will also be asked to submit a written CAP to CMS within 14 calendar days of notification.  The written CAP should include:

1. Restatement of understanding of Medicare HETS 270/271 application's Eligibility Rules of Behavior from the organization
2. Specific steps the submitter will take to improve trading practices and overall error rates and expected error rate reduction   

If the submitter fails to submit a CAP and/or show the required improvement within 14 calendar days of the initial notice, CMS will suspend the submitter's eligibility trading access.

If you have questions about these audits or suspension procedures, please contact the MCARE Help Desk immediately.

Medicare Customer Assistance Regarding Eligibility (MCARE) Help Desk

1-866-324-7315