August 2017

Washington Scene: New Medicare ID Cards to Impact Providers
By Betty Lengyel-Gomez
For The Record
Vol. 29 No. 8 P. 26

As cybersecurity threats continue to evolve, health care organizations need to step up their security efforts. With the increased risk of identity theft posed by the use of Social Security numbers (SSNs) on Medicare cards, Congress passed and President Obama signed into law the Medicare Access and CHIP Reauthorization Act of 2015, mandating the removal of SSNs from all Medicare cards by April 2019. The Social Security Number Removal Initiative (SSNRI) is designed to strengthen patient data security measures by adjusting the Medicare beneficiary identification process.

The Centers for Medicare & Medicaid Services (CMS) has taken steps to decrease Medicare beneficiary vulnerability to identity theft. Beginning in April 2018, CMS will begin issuing new beneficiary identification cards to millions of Medicare beneficiaries. The process is scheduled to be fully implemented by April 2019. A new randomly generated Medicare Beneficiary Identifier (MBI) will replace the SSN-based Health Insurance Claim Number (HICN) on new Medicare cards for transactions such as billing, eligibility status, and claim status.

Under this new system, Medicare will assign a unique MBI and mail a new Medicare card to each person enrolled in the Medicare program. As with an SSN, the MBI is confidential and should be treated and protected as personally identifiable information.

Under CMS' current timeline, the transition to MBI will continue through the end of 2019. Until then, providers will be able to use the current ID number or the MBI. However, by January 2020, only the MBI will be used in all Medicare transactions.

Who's Impacted?
The shift to MBI is expected to have far-reaching effects. Historically, Medicare has used the HICN with stakeholders such as state Medicaid agencies, the United States Railroad Retirement Board, health plans, beneficiaries, and, most noteworthy, health care providers that bill Medicare. Providers must be prepared to support this new number format, which will comprise only numbers and uppercase letters and be 11 characters long.

This regulatory change is administrative in nature. Nonetheless, the industry must be ready for a swift transition to the MBI, with an anticipated 60 million cards to be issued over the next three years.

What challenges will providers face? The implications for physician practices include the need to accomplish the following:

• Modify processes and systems in order to be ready to submit, exchange, display, and process the MBI.

• Ensure the system is ready to accept new MBI numbers by April 2018 as well as support the HICN numbers during the transition period.

• Confirm it's possible to use the HICN after the transition period ends on January 1, 2020. This will be valuable in the few instances where it remains possible to use the HICN.

• Ensure Medicare beneficiaries are aware of the new cards.

• Implement a front-end office strategy, including educating staff on how to respond to patient inquiries. This should include creating talking points in order to assist confused Medicare patients regarding the change and what they need to do.

• Know what the new cards will look like in order to identify whether the MBI is legitimate. This will save time and prevent duplicative work.

Preparation Is Key
Given that Medicare represents the single largest payer and patient population of most health care organizations, providers can ill afford to be caught off guard.

When preparing for the SSNRI, it's important that organizations understand how and where HICNs are currently in use. Organizations should assess both patient experience and business operations, including processes, personnel, and software across hospitals, physician practices, other treatment providers, and the back office.

Examine practice management systems and business processes to determine what changes are necessary in order to meet the demands of the MBI. Implement and test those changes by April 2018 before CMS mails new Medicare cards.

As the start of the HICN-to-MBI transition in early 2018 nears, providers must be confident all systems are go. Business processes must support the move during both the transition phase and following the full switchover. IT applications, systems, and infrastructure must accept and process transactions using the new MBI.

One key aspect of preparation is raising awareness among patients, employees, and third-party business partners. Ensure partners can support the organization's data exchanges during the transition and switchover to the MBI. Also, it's critical for Medicare patients to understand the importance of the new MBI cards. Providers can play an important role in making their Medicare patients aware that CMS will be sending out new cards. This will help ensure Medicare beneficiaries and their families are on the lookout for the card and realize the need to have it available once they receive it.

Will Providers Receive Patient MBIs?
Starting in April 2018, CMS will start mailing new Medicare cards with MBIs to existing and new beneficiaries. Providers must ask their Medicare patients at the time of service whether they have a new card with an MBI. CMS will not exchange MBIs directly with providers.

CMS has stated that beginning in April 2018 through the end of the transition period, if a provider submits an HICN on the 270 eligibility transaction request, the message field on the 271 eligibility response will indicate whether a new Medicare card has been mailed to that particular patient. The message will read: "CMS mailed a Medicare card with a new Medicare Beneficiary Identifier (MBI) to this beneficiary. Medicare providers, please get the new MBI from your patient and save it in your system(s)."

CMS won't return the MBI in eligibility transaction responses to limit the possibility of medical identity theft. Beginning in October 2018 through the transition period, Medicare will return both the HICN and the MBI on every remittance advice for all claims providers submit with a valid and active patient's HICN. The MBI will be inserted in the same place where the "changed HICN" currently resides.

Help From CMS
At the end of May, CMS kicked off a multifaceted outreach campaign to help providers get ready for the new MBI. It also is conducting rigorous education and outreach to all Medicare beneficiaries and their agents in an effort to help them gain an understanding of the importance of presenting their new ID cards at the time of medical care.

In addition, practices will have the ability to look up the new MBI numbers upfront so they can submit claims or inquire about claim status. Per the CMS website, both providers and Medicare patients will be able to look up the new MBI numbers through secure web interfaces that support quick access to the MBI.

Testing
Providers can start using the MBI as soon as their patients get their new cards beginning in April 2018. CMS has indicated that it will continue to accept the HICN through the transition period, allowing providers and their billing agencies the chance to change systems if there are problems with claims submitted using the MBI.

Unfortunately, because CMS is allowing providers to use either HICNs or MBIs during the transition process, the agency will not be offering end-to-end testing with Medicare fee-for-service claims processing systems. Therefore, providers should use the transition period as a live test and make adjustments as necessary.

System validation will be key, especially during the dual-use period. Should a provider's systems recognize only the MBI or the HICN, problems such as claim denials may occur.

Early preparation can ensure providers encounter no or limited financial disruptions. Systems must be ready to process MBI numbers by April 2018 when new Medicare patients will receive MBIs instead of HICNs. When the transition period ends on January 1, 2020, providers, with a few exceptions, will need to use MBIs on claims.

For the latest information, visit http://go.cms.gov/ssnri.             

— Betty Lengyel-Gomez is a health care professional with 27 years of experience in the areas of HIT, electronic data interchange, and federal and state regulatory compliance.