CMS Pub. 100-06, ch. 4, § 110

The Centers for Medicare & Medicaid Services (CMS) is addressing instances of identity theft confirmed

by the Investigating Unit (IU) through a CMS-approved identity theft victim validation and remediation

process. For purposes of this instruction, the IU is the Unified Program Integrity Contractor (UPIC) and

the CMS Center for Program Integrity (CPI).

When the IU confirms, by letter, to the contractor that a victim’s overpayment(s) resulted from identity

theft:

• The contractor shall immediately discontinue ALL collection efforts on the overpayment(s).

These collection efforts shall include recoupments, sending demand letters, and referring the

overpayment(s) to Treasury.

• Contractors not utilizing the Healthcare Integrated General Ledger Accounting System (HIGLAS)

shall recall the overpayment(s) if it was referred to Treasury.

• The contractor shall update the Shared System, HIGLAS, and ViPS Medicare System (VMS), as

appropriate, for all affected claims and accounts receivables (ARs) within 5 business days from

the confirmation receipt date.

• Contractors utilizing HIGLAS shall adjust down the AR(s) with the “DELETE/ADJ TO ZERO”

activity code and close the AR(s) by changing the AR status code “CLO-ERR.” The

“DELETE/ADJ TO ZERO” activity code will systematically recall the overpayment(s) if it was

referred to Treasury.

• Contractors not utilizing HIGLAS shall adjust down the related AR(s) to $0.00 and change the

status to closed.

• The contractor shall refund any monies within 30 calendar days that were recouped or paid to

satisfy the overpayment(s).

• The contractor shall request CMS to provide a revised (corrected) IRS Form(s) 1099-C if the

original IRS Form(s) 1099-C included the overpayment(s).

o The contractor shall send the request to MedicareOverpayments@cms.hhs.gov with

"Corrected IRS Form(s) 1099-C Request for Confirmed ID Theft" in the subject field.

o The contractor shall include in its request, a copy of the IU identity theft confirmation

letter and the amount(s) that shall be corrected.

o The contractor shall issue the revised (corrected) IRS Form(s) 1099-C to the victim.

• The contractor shall issue a revised (corrected) IRS Form 1099-MISC if the original IRS Form

1099-MISC issued to the victim contained amounts related to confirmed identity theft.

• The contractor shall notify the victim, by letter, of all activity associated with the overpayment(s)

of the confirmed identity theft case. This activity shall include items such as notice of the

rescission of the overpayment(s), the revision of the IRS Forms 1099-C and/or 1099-MISC, and

the recall of the overpayment(s) from Treasury. The letter shall also include all claim/document

control numbers of all affected claims and all original accounts receivable amounts (principal and

interest) that were adjusted down.