Healthcare Privacy & HIPAA BotDATE: May 7, 2026 at 03:25PM
SOURCE: PsychBilling Coach In the News by Susan Frager
-------------------------------------------------
TITLE: What’s this Medicare eligibility attestation demand?
URL: https://psychbillingcoach.com/news/medicare-eligibility-attestation/
Your clearinghouse may have been bugging you for the last month about a deadline on May 11, 2026, with respect to Medicare eligibility and something called HETS. What the HECK is HETS? Will you get paid after Monday if you don’t get this done…whatever this is?
HETS stands for HIPAA Eligibility Transaction System, in other words the system Medicare uses when you inquire about the eligibility of an Original Medicare client. I introduced HETS briefly last September when discussing “Death by 1,000 Cuts” – a thousand onerous tasks continually placed onto clinicians by insurance payers or government Powers That Be.
Now, apparently, it’s 1,001.
What if I don’t make the May 11th deadline?
Good news: nothing terrible will happen if you don’t make Monday’s deadline. You might be temporarily blocked from accessing Medicare eligibility via your EHR/clearinghouse connection, though, until you attest.
You will not be kicked off Medicare, and your claims will still be paid.
Does it apply to me?
If you’re enrolled to bill Original Medicare, then a HETS attestation is required if you’re going to be conducting eligibility inquiries via an EHR/clearinghouse connection.
Why is Medicare eligibility a good thing to have?
When accepting a Medicare client, I can’t think of anything more crucial than to verify their eligibility. And yet, mental health clinicians I consult with often don’t know this tool is available.
Medicare eligibility returns give you vital information:
• Date of eligibility for Medicare.
•
• Does the client have Part B? Not everyone enrolls in Part B at age 65.
•
• Date of last Coordination of Benefits update.
•
• Is Medicare the primary payer? If not, you’ll need the “MSP type code” for billing purposes and the eligibility inquiry will give that to you.
•
• Is the client enrolled in an “Advantage” or PACE plan? If yes, the Medicare eligibility will tell you who the “Advantage” or PACE payer is.
•
• Is the client a Qualified Medicare Beneficiary (QMB)? You can’t collect any patient responsibility amounts (coinsurance or deductible) if your client is QMB-enrolled.
•
• Deductible status, for non-QMB clients.
•
• Is the client a Railroad Medicare beneficiary?
•
Can I get eligibility another way?
All Medicare Administrative Contractors (MACs) have online portals you can use to obtain eligibility. If you’re a portal user, the HETS attestation is contained within the registration process for the portal. At various intervals thereafter, the portal will make you re-attest before gaining eligibility information. So if you’re obtaining Medicare eligibility via a MAC portal rather than an EHR/clearinghouse, the May 11th deadline does not apply to you.
The only ways to obtain Medicare eligibility are via EHR/clearinghouse or MAC portal. CMS discontinued telephone eligibility inquiries as of March 31, 2025.
What are these rules of behavior?
One therapist I consulted with said it best: “Don’t be stupid.”
Click here to read the HETS Rules of Behavior, but it can be summarized in two words: Follow HIPAA!
There’s a bit more to it if you utilize an offshore individual or entity who has access to Medicare eligibility data.
Why is this such a big deal?
When a Medicare beneficiary’s ID number (MBI) is compromised, it can be used fraudulently. Identity theft and/or data breaches are common, and when this happens, CMS has to issue new MBI’s to all beneficiaries whose information was breached. Recently, this happened to about 1.3 million people with Medicare, who will now be receiving new ID numbers.
Wanna know how it happened? Apparently, it had something to do with Elon and DOGE. The story first broke in the Washington Post on April 30th. Here’s a link to the story, but there’s a subscriber-only paywall.
And the database DOGE apparently exposed, was a database of healthcare professionals! Which means not only was it your MBI which was disclosed, but also your social security number and, potentially other information about your practice which can be used to fraudulently submit Medicare claims under your provider number. If you think you might have been affected, click here to read what to do and how to protect yourself.
Tip for everyone: if a client’s Medicare claims all of a sudden deny stating that you used an invalid MBI, the first thing to do is ask your client if they were sent a new card. Clients may think that Medicare automatically updates you as to their new number but naturally, that would be too easy. Can’t have THAT!
Big Brother is watching…
From the Rules of Behavior:
“The Centers for Medicare & Medicaid Services (CMS) monitors inquiries in HETS, and we’ll contact you if we find discrepancies. For example, we’ll check if you submit a high ratio of eligibility inquiries compared to your Fee-for-Service (FFS) claims. If we suspect improper use or if you violate these rules of behavior, we may suspend you, place you on a corrective action plan, or refer you for investigation and you could be subject to other penalties, including civil or criminal actions.”
In other words, CMS will be using AI analytics to determine that a sufficient percentage of the Medicare eligibility inquiries you submit become actual claims for service to those beneficiaries.
What’s the “sufficient percentage?” No clue. CMS hasn’t shared that (to my knowledge). But my recommendation is that you not conduct any Medicare eligibility inquiries until a client has already scheduled an appointment. Don’t verify just based on a telephone inquiry from the client as to whether you can accept their insurance.
What if I do use an offshore vendor?
It’s not illegal, but it makes things more complex for you in terms of documenting compliance, both with the HETS Rules of Behavior and also HIPAA. And state law, if you happen to be located in Florida.
In general HIPAA terms, you as the “covered entity” are responsible for the conduct of your “business associate,” such as a biller or virtual assistant. Anyone who requires access to Protected Health Information (PHI) in order to carry out their job functions, is, by definition, a “business associate.”
If a business associate violates HIPAA, they can be held liable but you’re liable also! HIPAA mandates covered entities to carefully monitor their business associate’s compliance. Which is a lot harder to do if your business associate is located in a foreign country. And then there are legal considerations. Following US law may be the terms under which you engage this person or organization, but in reality, can there be any consequences to a foreign entity if something happens? That’s not a question I have adequate training to answer.
Making things even more snarled, some American billing / revenue cycle management entities employ offshore labor. So you might think you’re ok, not realizing that in fact there is offshoring going on. If you utilize a larger billing vendor, contact them to ask if any of their employees who view/utilize Medicare eligibility data are located outside the US and document their answer!
Getting back to your HETS attestation, CMS expects you to disclose any offshore arrangements in which foreign vendors/contractors view Medicare eligibility data and/or utilize HETS. If you have to answer “yes” to this question on the HETS attestation, I strongly recommend you utilize the services of a cybersecurity expert as well as a certified HIPAA auditor who can carefully investigate to ensure your compliance. If you utilize offshore help but obtain Medicare eligibility data via your MAC’s portal, I recommend the same actions. The HETS Rules of Behavior do apply to portal use; it’s only the attestation process which differs.
So how do I jump through this **** hoop?
By now, your EHR/clearinghouse should have sent you detailed instructions or else an alert may be on their website or when you log into your account.
This is the general workflow:
• Start by downloading your EHR/clearinghouse vendor’s instructions. You’ll need their “unique ID” in order to complete the attestation.
•
• Complete the CMS HETS Attestation via the process established by your MAC. You can find instructions for all MACs here.
•
• Notify your EHR/clearinghouse that you completed the attestation on [date].
•
• Your EHR/clearinghouse then does their part to ensure your access to HETS stays active, or is re-activated.
•
Simple Practice says they know nothing about this!
The Simple Practice EHR/clearinghouse doesn’t support Medicare eligibility transactions. If you’re a Simple Practice user, your only option for Medicare eligibility is the MAC portal, which means the May 11th deadline doesn’t apply to you.
Still running into trouble after following your clearinghouse’s instructions? You can schedule a short consultation here I’ve been churning out HETS attestations with clinicians for the last month or so!
It’s always SOMETHING, isn’t it?
URL: https://psychbillingcoach.com/news/medicare-eligibility-attestation/
Articles can be found by scrolling down the page at https://psychbillingcoach.com/news/ under the title "In the News".
-------------------------------------------------
This robot is unaffiliated with PsychBilling Coach.
Private, vetted email list for mental health professionals: https://www.clinicians-exchange.org
Unofficial Psychology Today Xitter to toot feed at Psych Today Unofficial Bot @PTUnofficialBot
Psychology news and research articles at Psychology News Robot @PTUnofficialBot
NYU Information for Practice puts out 400-500 good quality health-related research posts per week but its too much for many people, so that bot is limited to just subscribers. You can read it or subscribe at @PsychResearchBot
Since 1991 The National Psychologist has focused on keeping practicing psychologists current with news, information and items of interest. Check them out for more free articles, resources, and subscription information: https://www.nationalpsychologist.com
EMAIL DAILY DIGEST OF RSS FEEDS -- SUBSCRIBE: http://subscribe-article-digests.clinicians-exchange.org
READ ONLINE: http://read-the-rss-mega-archive.clinicians-exchange.org
It's primitive... but it works... mostly...
-------------------------------------------------
#psychology #counseling #socialwork #psychotherapy @psychotherapist @psychotherapists @psychology @socialpsych @socialwork @psychiatry #mentalhealth #psychiatry #healthcare #psychotherapist #doctors #psychotherapist #hospital #HIPAA #privacy #BAA #patientrecords #telehealth #medicalbilling #SusanFrager
One Source Medical Billing
Mediknocx Medical Billing
