CMS Pub. 100-08, ch. 4, § 4.2.2.7

This section applies to UPICs.

To ensure a high level of security for the UPIC functions, the UPIC shall develop,

implement, operate, and maintain security policies and procedures that meet and

conform to the requirements of the Business Partners System Security Manual (BPSSM)

and the CMS Informational Security Acceptable Risk Safeguards (ISARS). Further, the

UPIC shall adequately inform and train all UPIC employees to follow UPIC security

policies and procedures so that the information the UPIC obtain is confidential.

Note: The data UPICs collect in administering UPIC contracts belong to CMS. Thus, the

UPICs collect and use individually identifiable information on behalf of the Medicare

program to routinely perform the business functions necessary for administering the

Medicare program, such as MR and program integrity activities to prevent fraud, waste,

and abuse. Consequently, any disclosure of individually identifiable information without

prior consent from the individual to whom the information pertains, or without statutory

or contract authority, requires CMS’ prior approval.

This section discusses broad security requirements that UPICs shall follow. The

requirements listed below are in the BPSSM or ARS. There are several exceptions. The

first is requirement A (concerning UPIC operations), which addresses several broad

requirements; CMS has included requirement A here for emphasis and clarification. Two

others are in requirement B (concerning sensitive information) and requirement G

(concerning telephone security). Requirements B and G relate to security issues that are

not systems related and are not in the BPSSM.

A. Unified Program Integrity Contractor Operations

• The UPIC shall conduct their activities in areas not accessible to the general

public.

• The UPIC shall completely segregate itself from all other operations.

Segregation shall include floor-to-ceiling walls and/or other measures

described in ARS Appendix B PE-3 and CMS-2 that prevent unauthorized

persons access to or inadvertent observation of sensitive and investigative

information.

• Other requirements regarding UPIC operations shall include sections 3.1,

3.1.2, 4.2, 4.2.5, and 4.2.6 of the BPSSM.

B. Handling and Physical Security of Sensitive and Investigative Material

Refer to ARS Appendix B PE-3 and CMS-1 for definitions of sensitive and investigative

material.

In addition, the UPIC shall follow the requirements provided below:

• Establish a policy that employees shall discuss specific allegations of fraud

only within the context of their professional duties and only with those who

have a valid need to know, which includes (this is not an exhaustive list):

- Appropriate CMS personnel

- UPIC staff

- MAC MR staff

- UPIC or MAC audit staff

- UPIC or MAC data analysis staff

- UPIC or MAC senior management

- UPIC or MAC corporate counsel

• The ARSs require that:

- The following workstation security requirements are specified and

implemented: (1) what workstation functions can be performed, (2) the

manner in which those functions are to be performed, and (3) the

physical attributes of the surroundings of a specific workstation or class

of workstation that can access sensitive CMS information. CMS

requires that for UPICs all local workstations as well as workstations

used at home by UPICs comply with these requirements.

- If UPIC employees are authorized to work at home on sensitive data,

they shall observe the same security practices that they observe at the

office. These shall address such items as viruses, virtual private

networks, and protection of sensitive data, including printed

documents.

- Users are prohibited from installing desktop modems.

- The connection of portable computing or portable network devices on

the CMS claims processing network is restricted to approved devices

only. Removable hard drives and/or a Federal Information Processing

Standards (FIPS)-approved method of cryptography shall be employed

to protect information residing on portable and mobile information

systems.

- Alternate work sites are those areas where employees, subcontractors,

consultants, auditors, etc. perform work associated duties. The most

common alternate work site is an employee’s home. However, there

may be other alternate work sites such as training centers, specialized

work areas, processing centers, etc. For alternate work site equipment

controls, (1) only CMS Business Partner-owned computers and

software are used to process, access, and store sensitive information;

(2) a specific room or area that has the appropriate space and facilities

is used; (3) means are available to facilitate communication with the

managers or other members of the Business Partner Security staff in

case of security problems; (4) locking file cabinets or desk drawers; (5)

“locking hardware” to secure IT equipment to larger objects such as

desks or tables; and (6) smaller Business Partner- owned equipment is

locked in a storage cabinet or desk when not in use. If wireless

networks are used at alternate work sites, wireless base stations are

placed away from outside walls to minimize transmission of data

outside of the building.

The UPIC shall also adhere to the following:

• Ensure the mailroom, general correspondence, and telephone inquiries

procedures maintain confidentiality whenever the UPIC receives

correspondence, telephone calls, or other communication alleging fraud.

Further, all internal written operating procedures shall clearly state security

procedures.

• Direct mailroom staff not to open UPIC mail in the mailroom unless the UPIC

has requested the mailroom do so for safety and health precautions.

Alternately, if mailroom staff opens UPIC mail, mailroom staff shall not read

the contents.

• For mail processing sites separate from the UPIC, the UPIC shall minimize the

handling of UPIC mail by multiple parties before delivery to the UPIC.

• The UPIC shall mark mail to CMS Central Office or to another UPIC

“personal and confidential” and address it to a specific person.

• Where more specialized instructions do not prohibit UPIC employees, they

may retain sensitive and investigative materials at their desks, in office work

baskets, and at other points in the office during the course of the normal work

day. Regardless of other requirements, the employees shall restrict access to

sensitive and investigative materials, and UPIC staff shall not leave such

material unattended.

• The UPIC staff shall safeguard all sensitive or investigative material when the

materials are being transported or sent by UPIC staff.

• The UPIC shall maintain a controlled filing system (refer to section 4.2.2.6.1).

C. Designation of a Security Officer

The security officer shall take such action as is necessary to correct breaches of the

security standards and to prevent recurrence of the breaches. In addition, the security

officer shall document the action taken and maintain that documentation for at least

seven (7) years.

Actions shall include:

• Within one (1) hour of discovering a security incident, clearly and accurately

report the incident following BPSSM requirements for reporting of security

incidents. For purposes of this requirement, a security incident is the same as

the definition in section 3.6 of the BPSSM, Incident Reporting and Response.

• Specifically, the report shall address the following where appropriate:

- Types of information about beneficiaries shall at a minimum address

whether the compromised information includes name, address, HICNs,

and date of birth;

- Types of information about providers/suppliers shall at a minimum

address if the compromised information includes name, address, and

provider/supplier ID;

- Whether LE is investigating any of the providers/suppliers with

compromised information; and

- Police reports.

• Provide additional information that CMS requests within 72 hours of the

request.

• If CMS requests, issue a Fraud Alert to all CMS Medicare contractors within

72 hours of the discovery that the data was compromised, listing the HICNs

and provider/supplier IDs that were compromised.

• Within 72 hours of discovery of a security incident, when feasible, review all

security measures and revise them if necessary so they are adequate to protect

data against physical or electronic theft.

Refer to section 3.1 of the BPSSM and Attachment 1 of this manual section (letter from

Director, Office of Financial Management, concerning security and confidentiality of

UPIC data) for additional requirements.

D. Staffing of the Unified Program Integrity Contractor and Security Training

The UPIC shall perform thorough background and character reference checks, including

at a minimum credit checks, for potential employees to verify their suitability for

employment. Specifically, background checks shall at least be at level 2- moderate risk.

(People with access to sensitive data at CMS have a level 5 risk). The UPIC may require

investigations above a level 2 if the UPIC believes the higher level is required to protect

sensitive information.

At the point the UPIC makes a hiring decision for a UPIC position, and prior to the

selected person’s starting work, the UPIC shall require the proposed candidate to fill out

a conflict of interest declaration, as well as a confidentiality statement.

Annually, the UPICs shall require existing employees to complete a conflict of interest

declaration, as well as a confidentiality statement.

At least once a year, the UPICs shall thoroughly explain to and discuss with employees

the special security considerations under which the UPIC operates. Further, this training

shall emphasize that in no instance shall employees disclose sensitive or investigative

information, even in casual conversation. The UPIC shall ensure that employees

understand the training provided.

Refer to section 2.0 of the BPSSM and ARS Appendix B AT-2, AT-3, AT-4, SA-6, MA-

5.0, PE-5.CMS.1, IR2-2.2, CP 3.1, CP 3.2, CP 3.3, and SA 3.CMS.1 for additional

training requirements.

E. Access to Unified Program Integrity Contractor Information

Refer to section 2.3.4 of the BPSSM for requirements regarding access to UPIC

information.

The UPIC shall notify the OIG if parties without a need to know are asking

inappropriate questions regarding any investigations. The UPICs shall refer all requests

from the press related to the Medicare Integrity Program to the CMS contracting officer

with a copy to the CORs and BFLs for approval prior to release. This includes, but is not

limited to, contractor initiated press releases, media questions, media interviews, and

Internet postings.

F. Computer Security

Refer to section 4.1.1 of the BPSSM for the computer security requirements.

G. Telephone and Fax Security

The UPICs shall implement phone security practices. The UPICs shall discuss

investigations only with those individuals who need to know the information and shall

not divulge information to individuals not known to the UPIC involved in the

investigation of the related issue.

Additionally, the UPICs shall only use CMS, the OIG, the DOJ, and the FBI phone

numbers that they can verify. To assist with this requirement, UPIC management shall

provide UPIC staff with a list of the names and telephone numbers of the individuals of

the authorized agencies that the UPICs deal with and shall ensure that this list is properly

maintained and periodically updated.

Employees shall be polite and brief in responding to phone calls but shall not volunteer

any information or confirm or deny that an investigation is in process. However, UPICs

shall not respond to questions concerning any case the OIG, the FBI, or any other LE

agency is investigating. The UPICs shall refer such questions to the OIG, the FBI, etc.,

as appropriate.

Finally, the UPICs shall transmit sensitive and investigative information via facsimile

(fax) lines only after the UPIC has verified that the receiving fax machine is secure.

Unless the fax machine is secure, UPICs shall make arrangements with the addressee to

have someone waiting at the receiving machine while the fax is transmitting. The UPICs

shall not transmit sensitive and investigative information via fax if the sender must delay

a feature, such as entering the information into the machine’s memory.

Each UPIC and I-MEDIC shall develop and utilize a fax cover sheet with standardized

elements to ensure consistency in messaging and to facilitate sender validation.

A standardized fax cover sheet shall include several key elements to verify the

legitimacy of the fax sent by the UPIC and/or I-MEDIC. These elements shall include:

• Official logo and address of the program integrity contractor sending the fax,

• CMS logo,

• Case number reference, and

• Verification of UPIC and I-MEDIC contact information.

See example at Exhibit 50 – UPIC and I-MEDIC Fax Cover Sheet.