What is it? – A Centers for Medicare & Medicaid Services (CMS) undertaking to remove the social security number-based Health Insurance Claim Number (HICN) from Medicare cards as required by 2015’s Medical Access and CHIP Reauthorization Act (MACRA). CMS’s goal is to decrease Medicare beneficiaries’ vulnerability to identity theft, both medical and personal, by removing the SSN-based HICN from their Medicare identification cards and replacing the HICN with a new Medicare Beneficiary Identifier (MBI) which does not involve the SSN or other personal information.
Why is it needed? – To address the ever-growing problem of beneficiary medical identity theft. Since the start of the Medicare program, the social security number has been the basis for the program’s beneficiary identifier, the HICN. CMS uses this number in its interaction with the Social Security Administration (SSA), Railroad Retirement Board (RRB), states, Medicare providers, Medicare plans, and so on. In other words, millions of individual SSNs are used countless times in the day-to-day operation of all of these programs, and in today’s world of identity theft that is an ominous situation.
What will happen? – Per MACRA mandate, CMS must issue all Medicare cards with the new MBI by April of 2019. While working toward this goal, CMS must strive to minimize disruption to current Medicare operations, while at the same time minimizing inconvenience to current providers and beneficiaries. The conversion must not negatively impact current data exchanges with the multitude of CMS business partners.
A carefully planned roll-out of the SSNRI is vital for a successful implementation, as CMS has identified nearly 90 different entities or groups that currently receive, store, use, and/or provide an HICN today. Involved parties include government partners, states, beneficiaries, providers, billing agencies, advocacy groups, data warehouses, and so on. CMS’s duties to accomplish this task include analyzing current complex systems, conducting extensive public outreach and education activities, and analyzing the countless number of changes that will be necessary to implement the change across the large number of systems and processes. All of this has to happen while the current system continues to operate uninterrupted, ensuring beneficiaries have access to care and payment processes are maintained for the providers of this care.
What will the MBI look like? – Per the CMS, the MBI will have the following characteristics:
- The same number of characters as the current HICN, 11, but visibly different from the HICN
- Contain a mix of capitalized alpha and numeric characters throughout its 11-character length
- Occupy the same field as the HICN on transactions
- Be unique to each beneficiary
- Be easy to read while limiting the possibility of letters being interpreted as numbers
- Not contain any embedded intelligence or special characters
- Not contain inappropriate combinations of numbers or letters
- Not contain lowercase letters
CMS will use an MBI generator to assign 150 million MBIs in the initial enumeration (60 million active and 90 million deceased/archived) and generate an MBI for each new Medicare beneficiary. CMS will create a new MBI for any Medicare beneficiary whose identity has been compromised.
CMS has established a transition period during which either the HICN or MBI will be accepted from providers, beneficiaries, plans, and other external partners. This transition period is set to run from April, 2018 through December, 2019. CMS systems and processes will be updated to accept the MBI as of April 1, 2018, as well as continuing to accept the HICN. As of January 1, 2020, CMS systems will only accept the MBI.
CMS does not plan to share the MBI with providers; providers will have to obtain the MBI from their patients. This is in keeping with CMS efforts to reduce Medicare fraud and identity theft.