The fee-for-service  portion of the Medicare program (Parts A and B) processes approximately  a billion claims each year from about 1.5 million providers who deliver and  bill Medicare for health care services and supplies. CMS’s Implementation of HETS to Assist Providers

To assist providers with verifying beneficiaries’ eligibility for services  under Medicare, and in response to HIPAA requirements, CMS provided  an electronic mechanism that allowed providers to access real-time data  at the point care is scheduled or delivered. CMS officials stated that the agency does not receive any  payments for the use of HETS, nor does the agency require Medicare  providers to use HETS to verify eligibility prior to filing claims  CMS intended for HETS to be used by health care providers; health care  clearinghouses, which are entities that provide electronic data exchange  services for their customers;  and Medicare Administrative Contractors (MACs) that assist CMS in processing claims. As of June 2012, CMS reported that 244 entities were using the  system; these included 130 providers, 10 Medicare Administrative  Contractors, and 104 clearinghouses that conduct query and response   The agency further reported  transactions for about 400,000 providers.that, during the first 6 months of 2012, the system processed more than  380 million transactions from these users. System performance data showed that, since May 2011, HETS has been  consistently providing service to its users 24 hours a day, 7 days a week,  except during regularly scheduled maintenance periods, which occur on  Monday mornings from midnight until 5:00 a.m. (CMS sometimes  schedules additional outages for system maintenance and upgrades,  usually during one or two weekends each month.) E-Government Act of 2002, Pub L. No. occurring between 8:00 a.m. and 4:00 p.m. eastern time, Monday through  Friday. Users of the system told us that since CMS completed hardware and  software improvements in spring 2011, they have been satisfied with its  operational status. In this  regard, CMS projected the increase in transaction volume to continue at a  rate of about 40 percent for the next several years. The officials we spoke with also described several technical  improvements they intend to take to increase the system’s capacity to  handle growing numbers of transactions, including some consistent with  the contractors’ evaluations. CMS’s plans also  identified a step to, by the end of August 2012, migrate the current HETS  database to a new operating platform that is scalable to accommodate  the expected increase in transaction volume. Among other things, these include activities to support the current  system until the redesigned system is implemented, including  development of tools that enable the HETS contractors to proactively  monitor system components, additional services to enhance production  capacity, and automated processes for starting up and shutting down the  application. For example, CMS documented in the HETS Rules  of Behavior that users must adhere to the authorized purposes for  requesting Medicare beneficiary eligibility data. By establishing practices and procedures intended to protect the privacy  of Medicare beneficiaries’ personal health information, and assessing the  impact and risks associated with the use of HETS, CMS took required  steps to address privacy principles reflected by HIPAA, the HIPAA rules,  and the Privacy Act and has acted in accordance with OMB’s guidance  for protecting personally identifiable information. According to officials in  HHS’s Office for Civil Rights, no violations of the HIPAA Privacy Rule  resulting from the use and disclosure of data provided by HETS have  been reported since the system was implemented. Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) identify the operational status of HETS, (2)  identify any steps CMS has taken to ensure users’ satisfaction and plans  to take to ensure the performance of the system supports future  requirements, and (3) describe CMS’s policies, processes, and  procedures for protecting the privacy of beneficiary eligibility data  provided by the system. To identify the operational status of HETS, we collected and analyzed  documentation from program officials that described the use and daily  operations of the system, such as reports on incoming transaction  volume, response time, and downtime, along with documents that  describe outcomes of the system, such as reported problems. We also discussed with the  users their experiences with other automated eligibility verification  systems provided by commercial health insurers. To identify the steps that CMS has taken to ensure that HETS users  remain satisfied with the performance of the system and that the agency  plans to take to ensure the system provides the level of service needed to  support future requirements, we reviewed agency documents, such as  project timelines and system release notes, and reports of users’ calls to  the help desk. Finally, to describe the policies, processes, and procedures established  by CMS to ensure that the privacy of beneficiary eligibility data is  protected, we evaluated agency documentation such as HETS privacy  impact and risk assessments, and agreements with users that describe  CMS’s and users’ responsibilities and requirements for protecting the  data processed and provided by the system. Appendix II: HETS Transaction Volumes and Response Times

HETS program officials provided system-generated data that reflected the  performance of the system in terms of the numbers of transactions  processed each month and the response time in four categories.
Why GAO Did This Study

Medicare is a federal program that pays for health care services for individuals 65 years and older and certain individuals with disabilities. In 2011, Medicare covered about 48.4 million of these individuals, and total expenditures for this coverage were approximately $565 billion. CMS, the agency within the Department of Health and Human Services that administers Medicare, is responsible for ensuring that proper payments are made on behalf of the program's beneficiaries. In response to HIPAA requirements, CMS developed and implemented an information technology system to help providers determine beneficiaries' eligibility for Medicare coverage. In May 2005 CMS began offering automated services through HETS, a query and response system that provides data to users about Medicare beneficiaries and their eligibility to receive payment for health care services and supplies.
Because of the important role that HETS plays in providers having access to timely and accurate data to determine eligibility, GAO was asked to (1) identify the operational status of HETS, (2) identify any steps CMS has taken to ensure users' satisfaction and plans to take to ensure the system supports future requirements, and (3) describe CMS's policies, processes, and procedures for protecting the privacy of data provided by HETS.
To do so, GAO collected and analyzed documentation from program officials, such as reports on transaction volume and response times, agreements with users, and CMS's privacy impact and risk assessments of HETS. GAO also interviewed program officials and system users.

What GAO Found

The Centers for Medicare and Medicaid Services (CMS) currently offers to Medicare providers and Medicare Administrative Contractors the use of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Eligibility Transaction System (HETS) in a real-time data processing environment. HETS is operational 24 hours a day, 7 days a week, except during regularly scheduled maintenance Monday mornings, from midnight until 5:00 a.m., and when CMS announces other maintenance periods during one or two weekends each month. According to program officials, 244 entities were using HETS in 2012, including about 130 providers, 104 clearinghouses that provide data exchange services to about 400,000 health care providers, and 10 Medicare contractors that help CMS process claims for services. From January through June 2012, HETS processed each month an average of 1.7 million to 2.2 million queries per day with most of the queries submitted between the hours of 8:00 a.m. and 4:00 p.m. eastern time. The users with whom we spoke confirmed that operational problems they experienced with the system in 2010 and the first few months of 2011 were resolved in spring 2011 after CMS implemented several hardware and software replacements and upgrades. System performance reports for the first 6 months of 2012 showed that the average response time per transaction was less than 3 seconds. Users described experiences with the system that were consistent with these data. They told us that they are currently satisfied with the operational status of HETS and that the system provides more complete information and reliable service than other systems that they use to verify eligibility with commercial health insurers.
CMS took steps to ensure users remain satisfied with the system's performance, including notifying users in advance of system downtime, providing help desk support, and monitoring contractors' performance. The agency had also planned several technical improvements intended to increase HETS' capacity to process a growing number of transactions, which the agency projected to increase at a rate of about 40 percent each year. These plans include a redesign of the system and migration to a new database environment that is scalable to accommodate the projected increase in transaction volume. According to HETS program officials, near-term plans also include the implementation of tools to enable proactive monitoring of system components and additional services intended to enhance production capacity until the planned redesign of the system is complete.
To help protect the privacy of beneficiary eligibility data provided by HETS, CMS established policies, processes, and procedures that are intended to address principals reflected by the HIPAA Privacy Rule. For example, in its efforts to ensure proper uses and disclosures of the data, CMS documented in user agreements the authorized and unauthorized purposes for requesting Medicare beneficiary eligibility data. Additionally, the agency conducted privacy impact and risk assessments of HETS as required by the E-Government Act of 2002. Officials from the Department of Health and Human Services' Office for Civil Rights stated that no privacy violations had been reported regarding the use of the protected health data provided by HETS since its implementation in 2005.