J.8 MAC Security Incident and Reportable Event Reporting and Response.docx

MEDICARE ADMINISTRATIVE CONTRACTOR (MAC)

SECURITY INCIDENT AND REPORTABLE EVENT REPORTING AND RESPONSE

Attachment J.8 MAC Security Incident and Reportable Event Reporting and Response

RFP # 75FCMC19R0041

The Centers for Medicare & Medicaid Services’ (CMS) business associates (contractors), including MACs, are required to report Security Incidents and Reportable Events to CMS.

January 10, 2019 Page 2 of 2

SECURITY INCIDENTS

For the MACs specifically, the fundamental requirement is documented in the Business Partner System Security Manual (BPSSM). The BPSSM is released as an Internet Only Manual (IOM) Publication 100-17.

BPSSM Section 3.6 “Security Incident Reporting and Response” contains information for defining, categorizing and reporting security incidents. Much of the information in this section is taken from the applicable CMS Risk Management Handbooks (RMH) found on the Information Security and Privacy Library. These procedures can be found at:

http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html

All incidents shall be reported to the CMS Help Desk within the timeframes listed in the BPSSM. Whether the CMS Help Desk is initially contacted via telephone or email, the Health and Human Services (HHS) Security Incident Report Template (See applicable RMH for current form) shall be completed and submitted via email to both the CMS Help Desk (CMS_IT_Service_Desk@cms.hhs.gov) and to the Medicare Contractor Management Group Security Incident Mailbox (Security_Incident@cms.hhs.gov ).

For security incidents involving breaches of Personally Identifiable Information (PII) and Protected Health Information (PHI), CMS requires each MAC to submit an incident report to CMS within one hour of discovery / detection of a suspected or confirmed breach of PII or PHI.

The Final Rule for Modifications to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, Enforcement, and Breach Notifications Rules Under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules released in the Federal Register on January 25, 2013, require a Covered Entity (i.e., CMS) to notify individuals of a breach without unreasonable delay but in no case later than 60 calendar days from the discovery of the breach. The timeframe for notification to beneficiaries begins with the date the MAC submits the incident report to CMS. To remain in compliance with the final rule, each MAC shall submit a final incident report which completely documents its investigation of the breach no later than 40 calendar days from the date of the initial submission. Upon receipt of the final report, CMS will conduct a risk assessment of the breach to determine if notification is warranted. If CMS deems a notification to the beneficiary(s) is warranted CMS will coordinate with the MAC on the notification.

REPORTABLE EVENTS

A Reportable Event is defined as anything that involves: (1) a matter that a reasonable person would consider a violation of criminal, civil or administrative laws applicable to any Medicare contract or Federal health care program; or (2) integrity violations, including any known probable or suspected violation of any Medicare contract term or provision. Reportable Events are reported to CMS via a notification to the Contracting Officer Representative (COR) within 30 days of discovery / detection.

Although breaches of PII / PHI can be classified as both a security incident and a reportable event, given they are administrative violations of HIPAA, CMS has determined that breaches of PII / PHI are only to be reported as a security occurrence (e.g., a PII / PHI breach) following the instructions in the first part of this document (Security Incidents).

To recap, Reportable events not consisting of breaches of PII / PHI are reported within 30 days of discovery / detection via a notification to the COR.