CMS Pub. 100-17, ch. 117_systems_security, § 2.2

(Rev. 15)

All business partner and contractor personnel requiring access to CMS sensitive information shall

meet minimum personnel suitability standards. These suitability standards are based on a valid

need-to-know (not based on position or title) and favorable results from a background check. Each

position must be evaluated and assigned a risk and/or a sensitivity designation commensurate with

each individual’s duties and responsibilities. The background check for prospective employees shall

include, at a minimum: Social Security Number verification, identity and address verification,

national criminal database search, county criminal records search, HHS list of excluded individuals,

sex offender registry, verification of academic records when required for the position and

verification that the employee has resided in the US for 3 of the past 5 years.

When required by CMS, business partner personnel will need to complete a Federal Background

Investigation (BI). To initiate a BI, business partner personnel will need to supply personal

information to CMS via methods (fingerprint card) or systems identified by CMS. The level of

investigation for a BI varies and will be determined by the COR’s risk assessment of the person’s

role. A BI that results in a favorable outcome can result in a Personal Identity Verification (PIV)

card being issued.