The CMS Medicare Identifier Initiative and Its Medicare Secondary Payer Impact

By Mark Popolizio

In April 2018, the Centers for Medicare and Medicaid Services (CMS) began replacing all Medicare cards with a new, unique 11-byte Medicare Beneficiary Identifier (MBI) number. The change is part of CMS’ Social Security Number Removal Initiative (SSNRI) as mandated under the Medicare Access and CHIP Reauthorization Act (MACRA) of 2015.1 This law requires CMS to discontinue all SSN-based Health Insurance Claim Number (HICN) Medicare identifiers and reissue all Medicare cards with a new MBI by April 2019.

Overview of the changes

The main goal behind the SSNRI/MBI initiative is “to help prevent fraud, combat identity theft, and safeguard taxpayer dollars.”2 Each beneficiary will be assigned a new MBI number and issued a new Medicare card as part of the initiative. This undertaking will reportedly require CMS to make changes to more than 75 internal systems.

With few exceptions, the new MBI number will be required in dealing with Medicare on such items as billing, eligibility status, and claim status. New MBI numbers will be issued to all existing, deceased, and new beneficiaries. CMS estimates it will assign 150 million MBI numbers in the initial enumeration—including 60 million active and 90 million deceased or archived beneficiaries. New beneficiaries will automatically be assigned an MBI number.

CMS is currently engaged in a massive and multifaceted educational outreach campaign to stakeholders, including beneficiaries, medical providers, billing groups, state Medicaid agencies, and the Medicare Secondary Payer (MSP) community. CMS releases regular MBI updates and has held (and continues to hold) stakeholder-specific open forum calls. In addition, CMS has established two websites, www.cms.gov/newcard and http://go.cms.gov/ssnri, that provide information and updates regarding the initiative.

The MBI transition period runs from April 1, 2018, through December 31, 2019. During this time, either the HICN or the MBI can be exchanged with CMS. However, starting January 1, 2020, CMS will require only MBI numbers (with limited exceptions, such as in relation to MSP activities discussed below) to be used in communicating with CMS. Click here to view CMS’ MBI implementation timeline.

New MBI format and Medicare cards

The new MBI, similar to the current HICN, will consist of 11 characters. Each MBI will be randomly assigned using a nonintelligent alphanumeric number unique to each beneficiary (i.e., husband and wife will now have their own MBI number). Certain character positions will always be numbers or letters, while other positions will be either a letter or a number. You can review CMS’ explanation of its MBI format here. A replica of what the new Medicare card will look like is available here.

New Medicare card rollout process

CMS began issuing new MBI-based Medicare cards in April 2018. Under MACRA, CMS has until April 2019 to complete the process. CMS will begin mailing new Medicare cards based on geographic location via seven separate release “waves.” Click here to review CMS’ release schedule.

Medicare Secondary Payer impact

While mandatory use of the new MBI number will be required in the majority of situations starting January 2020, MACRA provides an exception for Medicare Secondary Payer data exchanges and related processes.3 CMS notes that the main objective behind this exception is to minimize the SSNRI’s impact for MSP stakeholders in dealing with CMS on secondary payer–related activities. In general, MSP stakeholders will be able to continue to use the SSN or HICN in communicating with CMS as part of MSP processes.

On January 11, 2017, CMS held an MSP-specific “Social Security Number Removal Initiative (SSNRI) Impacts Upon Medicare Secondary Payer (MSP) Stakeholders” open door forum, which discussed how the SSNRI/MBI will affect MSP compliance activities (access the recording here). To date, this forum has been CMS’ primary communication to the MSP community, and the information outlined in this section is taken primarily from the January 2017 session.

CMS has advised that there will be no file format changes to any input or response files used as part of the MSP data exchange process. However, all “references to the term ‘HICN’” will be replaced with “Medicare ID” and applied to all MSP processes and reflected in all documentation on the Coordination of Benefits & Recovery (COB&R) website. Further, CMS noted that after January 1, 2020, Section 111 responsible reporting entities (RREs) and Voluntary Data Sharing Agreement (VDSA) employer participants may provide any of the following to the Benefits Coordination & Recovery Center (BCRC) as the beneficiary identifier for MSP reporting purposes: MBI, full SSN, five-byte SSN (for non-group health), HICN, or Railroad Retirement Board (RRB) Medicare number.

In terms of specific impact on individual aspects of MSP compliance, CMS outlined the following general points in its MSP open forum call:

Section 111 Reporting

  • For the Section 111 response file process, the BCRC will return the most current identifier in what is currently the HICN field. This could be the MBI number starting in April 2018. If an RRE updates a preexisting MSP record with an MBI number that results in a coverage case, then the resulting conditional payment letters (CPLs), conditional payment notices (CPNs), or other outbound correspondence will contain the MBI number. This will apply even if the original Section 111 record submitted included the HICN.
  • CMS encourages Section 111 RREs and VDSA employer participants that receive the MBI in the MSP or non-MSP response files or via query-only response files to begin using the MBI number to report future updates on their covered individuals.

WCMSAs

  • CMS will use whatever beneficiary identifier was submitted as part of the Workers’ Compensation Medicare Set-Aside (WCMSA) proposal/submission.

CPLs, CPNs, and Demand Letters

  • CMS will use the HICN/RRB Medicare or MBI number based on the beneficiary number that was most recently reported to CMS that resulted in the creation of an MSP record and recovery case.

Treasury Demands

  • CMS indicated that all correspondence from the U.S. Treasury Department relating to MSP debts will no longer contain the HICN or the MBI number. Instead, this correspondence will contain a specific “recovery case ID” number.

Portals (MSPRP, CRCP, and WCMSAP)

  • Parties may enter the HICN/RRB Medicare or MBI number in the renamed Medicare ID report or view specific case information. Further, the SSN may be used if the MBI number or the HICN is not available. According to CMS, the system supporting each portal will know by the configuration of the identifier entered which ID is being entered for accessing the case.

Overall, MACRA’s MSP exception gives MSP stakeholders flexibility in providing CMS with different Medicare identifiers going forward. As noted, RREs will start to receive MBI numbers from CMS, which should be helpful in identifying a particular claimant’s new MBI number and could then be used going forward in dealing with CMS on secondary payer activities if RREs and other applicable parties elect to do so.

As with any new process, we will need to see exactly how this will all unfold in practice. In the meantime, it is critical that RREs and other affected parties are aware of these changes and make any necessary adjustments to current practices, systems, and processes.

ISO Claims Partners will continue to monitor developments on the SSNRI/MBI front and provide updates as warranted. To listen to my recent webinar on this topic, click here.

1. Public Law 114-10, 114th Congress, April 16, 2015.

2. CMS Administrator Seema Verma, CMS Press Release, September 14, 2017.

3. Per CMS’ website, other areas also exempted from mandatory use of the MBI include appeals, claim status query, span-date claims, incoming premium payments, adjustments for certain processing systems, and certain reports such as Disproportionate Share Hospital data requests, Provider Statistical and Reimbursement Report, and Accountable Care Organization reports.

Mark Popolizio is vice president of MSP compliance policy at ISO Claims Partners, a Verisk business, which provides Medicare compliance and claims resolution services to many of the largest property/casualty insurance companies as well as to self-insured companies and third-party administrators.