Privacy Act of 1974; Matching Program

Issuing agencies

Abstract

In accordance with subsection (e)(12) of the Privacy Act of 1974, as amended, the Department of Health and Human Services (HHS), Centers for Medicare & Medicaid Services (CMS), is providing notice of a computer matching program between CMS and the Department of Veterans Affairs (VA), Veterans Health Administration (VHA). The purpose of the matching program is to identify beneficiaries enrolled in both Medicare and VHA health care and to identify medical claims for which both agencies made payment for the same health care services. Under this agreement, the VHA will provide CMS with a finder file on a recurring basis, of all Veteran beneficiaries enrolled in VHA health care that CMS will use to identify dually enrolled beneficiaries. CMS and VHA will use the results of the matching program to recover duplicate payments, improve payment accuracy, and identify potential fraud, waste, and abuse.

Full Text

<html>
<head>
<title>Federal Register, Volume 91 Issue 202 (Wednesday, October 21, 2026)</title>
</head>
<body><pre>
[Federal Register Volume 91, Number 202 (Wednesday, October 21, 2026)]
[Notices]
[Pages 66560-66561]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2026-21491]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services


Privacy Act of 1974; Matching Program

AGENCY: The Department of Health and Human Services (HHS), Centers for 
Medicare & Medicaid Services (CMS).

ACTION: Notice of a new matching program.

-----------------------------------------------------------------------

SUMMARY: In accordance with subsection (e)(12) of the Privacy Act of 
1974, as amended, the Department of Health and Human Services (HHS), 
Centers for Medicare & Medicaid Services (CMS), is providing notice of 
a computer matching program between CMS and the Department of Veterans 
Affairs (VA), Veterans Health Administration (VHA).
    The purpose of the matching program is to identify beneficiaries 
enrolled in both Medicare and VHA health care and to identify medical 
claims for which both agencies made payment for the same health care 
services. Under this agreement, the VHA will provide CMS with a finder 
file on a recurring basis, of all Veteran beneficiaries enrolled in VHA 
health care that CMS will use to identify dually enrolled 
beneficiaries. CMS and VHA will use the results of the matching program 
to recover duplicate payments, improve payment accuracy, and identify 
potential fraud, waste, and abuse.

DATES: The deadline for comments on this notice is November 20, 2026. 
The matching program will commence not sooner than 30 days after 
publication of this notice, provided no comments are received that 
warrant a change to this notice. The matching program will remain in 
effect for 18 months from its effective date, unless one of the parties 
to the agreement advises the other by written request to terminate or 
modify the agreement. The agreement is subject to renewal by the HHS 
Data Integrity Board for 12 additional months if the matching program 
will be conducted without any change and each party to the agreement 
certifies that the program has been conducted in compliance with the 
agreement:

ADDRESSES: Interested parties may submit written comments on this 
notice, by mail or email, to the CMS Privacy Officer, Division of 
Security, Privacy Policy & Oversight, Information Security & Privacy 
Group, Office of Information Technology, Centers for Medicare & 
Medicaid Services, Location: N1-14-56, 7500 Security Blvd., Baltimore, 
MD 21244-1850, to <a href="/cdn-cgi/l/email-protection#67050615050615064903020a0817120b081427040a14490f0f1449000811"><span class="__cf_email__" data-cfemail="06646774646774672862636b6976736a697546656b75286e6e7528616970">[email&#160;protected]</span></a>.

FOR FURTHER INFORMATION CONTACT: If you have questions about the 
matching program, you may contact Richard Mazur, Government Technical 
Lead, Division of Medicare Secondary Payer Operations, Office of 
Financial Management, Centers for Medicare & Medicaid Services, CMS, at 
(410) 786-1418 or by email: <a href="/cdn-cgi/l/email-protection#84d6ede7ece5f6e0aac9e5fef1f6b6c4e7e9f7aaececf7aae3ebf2"><span class="__cf_email__" data-cfemail="a9fbc0cac1c8dbcd87e4c8d3dcdb9be9cac4da87c1c1da87cec6df">[email&#160;protected]</span></a>.

SUPPLEMENTARY INFORMATION: The Privacy Act of 1974, as amended (5 
U.S.C. 552a) provides certain protections for individuals applying for 
and receiving federal benefits. The law governs the use of computer 
matching by federal agencies when records in a system of records 
(meaning, federal agency records about individuals retrieved by name or 
other personal identifier) are matched with records of other federal or 
non-federal agencies. The Privacy Act requires agencies involved in a 
matching program to:
    1. Enter into a written agreement, which must be prepared in 
accordance with the Privacy Act, approved by the Data Integrity Board 
of each source and recipient federal agency, provided to Congress and 
the Department of the Treasury and made available to the public, as 
required by 5 U.S.C. 552a(o), (u)(3)(A), and (u)(4).
    2. Notify the individuals whose information will be used in the 
matching program that the information they provide is subject to 
verification through matching, as required by 5 U.S.C. 552a(o)(1)(D).
    3. Verify match findings before suspending, terminating, reducing, 
or making a final denial of an individual's benefits or payments or 
taking other adverse action against the individual, as required by 5 
U.S.C. 552a(p).
    4. Report the matching program to Congress and the OMB, in advance 
and annually, as required by 5 U.S.C. 552a(o) (2)(A)(i), (r), and 
(u)(3)(D).
    5. Publish advance notice of the matching program in the Federal 
Register as required by 5 U.S.C. 552a(e)(12).
    This matching program meets these requirements.

Barbara Demopulos,
CMS Privacy Act Officer Division of Security, Privacy Policy & 
Oversight Information Security and Privacy Group, Office of Information 
Technology, Centers for Medicare & Medicaid Services.

Participating Agencies

    The Department of Health and Human Services (HHS), Centers for 
Medicare & Medicaid Services (CMS) is the source agency, and the 
Department of the Veterans Health Administration.

Authority for Conducting the Matching Program

    The matching program is authorized by the Privacy Act of 1974 (5 
U.S.C. 552a); section 1128J of the Social Security Act (42 U.S.C. 
1320a-7k); section 1862(a)(3) of the Social Security Act (42 U.S.C. 
1395y(a)(3)); 38 U.S.C. 1703 and 1725; 38 CFR 1.481; and other 
authorities identified in the Computer Matching Agreement.

Purpose(s)

    The matching program enables CMS and VHA to identify beneficiaries 
enrolled in both Medicare and VHA health care, identify duplicate 
payments made for the same health care services, recover improper 
payments, and support fraud, waste, and abuse detection activities.

Categories of Individuals

    Individuals whose records are involved in the matching program 
include:
    <bullet> Veterans enrolled in the Veterans Health Administration 
health care system; and
    <bullet> Medicare beneficiaries who are dually enrolled in Medicare 
and VHA health care.

[[Page 66561]]

Categories of Records

    Records exchanged under the matching program include beneficiary 
identifying information, enrollment information, claims information, 
provider identifiers, diagnosis and procedure information, dates of 
service, payment information, and other data elements necessary to 
identify duplicate payments for medical services.
    The data used in the match include the following:

VHA Beneficiary Finder File Data:
    a. Transaction type: VA Unique Person Identifier
    b. SSN
    c. Medicare Claim Number (if available)
    d. Date of Birth
    e. Beneficiary First Name
    f. Beneficiary Last Name
    g. Beneficiary Sex
    h. Enrollment time frames: effective date and/or, when applicable, 
end date
    i. Date of death (if applicable
CMS Response File Data:
    a. Action type: VA Unique Person Identifier
    b. SSN
    C. MBI
    d. Date of Birth
    e. Beneficiary First Name
    f. Beneficiary Last Name
    g. Beneficiary Sex code
    h. Medicare Enrollment time frames: Effective and termination dates
    i. Date of death

    Based on the results in each response file identifying the 
beneficiaries who are dual enrolled, VHA will provide CMS with a file 
containing medical claims that VHA paid in full or in part for those 
dually enrolled beneficiaries. CMS will match the records to its own 
claims and payment systems and return to VHA a response file containing 
claims that CMS paid in full or in part for the same service. This 
exchange includes the following data:

VHA Claims File Data Fields:
    a. Patient Information from Matched Beneficiary File (e.g., SSN, 
Date of Birth, Name, Sex)
    b. Claim Identification Fields (e.g., Claim Number, Claim Line)
    c. Service Identification Fields (e.g., Service Date, Type, Place)
    d. Additional Claim Relevant Identification Fields (e.g., Revenue 
Codes)
    e. Billing Provider Identification Fields (e.g., Name, National 
Provider Identification number).
    f. Additional Relevant Provider Identification Fields (e.g., 
Rendering Provider, Attending Provider)
    g. Procedure Codes and Modifiers
    h. Diagnosis Codes and Qualifiers
    i. Payment Identification Fields (e.g., Date, Amount, Units, 
Payment Authority)
CMS Claims File Data Fields that are Added to the VA File for Matched 
Claims:
    a. Patient Information from Matched Beneficiary File (e.g., SSN, 
Date of Birth, Name, Sex)
    b. Claim Identification Fields (e.g., Claim Number, Claim Line)
    c. Service Identification Fields (e.g., Service Date, Type, Place)
    d. Additional Claim Relevant Identification Fields (e.g., Revenue 
Codes)
    e. Billing Provider Identification Fields (e.g., Name, National 
Provider Identification number).
    f. Additional Relevant Provider Identification Fields (e.g., 
Rendering Provider, Attending Provider)
    g. Procedure Codes and Modifiers
    h. Diagnosis Codes and Qualifiers
    i. Payment Identification Fields (e.g., Date, Amount, Units)

System(s) of Records

    The data used in this matching program will be disclosed from the 
following systems of records, based on the routine uses identified:

CMS

<bullet> Common Working File (CWF), System No. 09-70-0526
<bullet> Medicare Beneficiary Database (MBD), System No. 09-70-0536
<bullet> Integrated Data Repository (IDR), System No. 09-70-0571
<bullet> National Claims History (NCH), System No. 09-70-0558

Department of Veterans Affairs

<bullet> Enrollment and Eligibility Records--VA (147VA10)
Non-VA Care (Fee) Records--VA (23VA10NB3)

[FR Doc. 2026-21491 Filed 10-20-26; 8:45 am]
BILLING CODE 4120-03-P


</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>