Today's briefing covers a new Privacy Act computer matching program in which the Veterans Health Administration sends CMS a recurring finder file of enrolled veterans so the two agencies can find health care services both of them paid for. The notice lists the identifiers, diagnosis and procedure codes that will move between the agencies, and comments are due by 2026-11-20.
CMS published notice of a new computer matching program with the Department of Veterans Affairs' Veterans Health Administration under subsection (e)(12) of the Privacy Act of 1974. Its purpose is to identify beneficiaries enrolled in both Medicare and VHA health care, identify claims for which both agencies paid for the same services, recover improper and duplicate payments, improve payment accuracy, and support detection of fraud, waste and abuse. The notice cites the Privacy Act, sections 1128J and 1862(a)(3) of the Social Security Act, 38 U.S.C. 1703 and 1725, and 38 CFR 1.481 as authority.
The exchange runs in two passes. VHA sends CMS a recurring finder file covering all veterans enrolled in VHA health care, with the VA Unique Person Identifier, Social Security number, Medicare claim number where available, date of birth, name, sex, enrollment dates and date of death; CMS returns a response file adding the Medicare Beneficiary Identifier and Medicare enrollment dates for those who are dually enrolled. VHA then sends the claims it paid in full or in part for those beneficiaries, and CMS matches them against its own claims and payment systems and returns the claims it paid for the same service. The claims files carry patient identifiers, claim and service identifiers, revenue codes, billing, rendering and attending provider identifiers including National Provider Identifiers, procedure codes and modifiers, diagnosis codes and qualifiers, and payment dates, amounts and units.
On the CMS side the records come from the Common Working File (09-70-0526), the Medicare Beneficiary Database (09-70-0536), the Integrated Data Repository (09-70-0571) and National Claims History (09-70-0558); on the VA side from Enrollment and Eligibility Records (147VA10) and Non-VA Care (Fee) Records (23VA10NB3). The program can start no sooner than 30 days after publication if no comments warrant a change, runs for 18 months, and can be renewed by the HHS Data Integrity Board for 12 more months if it continues unchanged and both parties certify compliance.
This is a standing, recurring flow of diagnosis- and procedure-level claims data for dually enrolled veterans between Medicare and the VHA, governed by the Privacy Act's matching rules. Those rules require the agencies to verify match findings before suspending, reducing or denying benefits or payments or taking other adverse action, and to notify individuals that their information is subject to verification through matching. Because the stated purpose is recovering duplicate payments, providers that bill both programs for the same veterans are the most likely to see follow-up, and privacy officers can use the notice's data-element and system-of-records lists to scope what is shared. Comments go to the CMS Privacy Officer by 2026-11-20.
