Medicare HETS 270/271 SOAP/MIME Submitters:
CMS announces that the Medicare HETS 270/271 application will move to a high availability environment in the first quarter of 2020. HETS 270/271 submitters that connect via SOAP or MIME will need to redirect their requests to a different destination URL at a specified date and time in order to continue utilizing HETS for Medicare eligibility. Failure to complete any of the steps described below will result in a loss of access to the HETS 270/271 eligibility system.
Introduction & Outreach
This is the first in a series of emails and targeted user communications regarding the steps that your organization (as an active HETS SOAP or MIME submitter) must take to ensure a successful transition to the new HETS environment. If your organization has any questions about this process at any point during this process, please contact the MCARE Help Desk for support.
It is important to note that there will be no functional changes to the HETS X12 270 request or 271 response structure or content during this transition. Submitters will solely focus on ensuring that their SOAP or MIME connectivity to the HETS 270/271 application is functional and working. SOAP and MIME submitters will be given an opportunity to test this connectivity well in advance of the scheduled transition to mitigate risk.
Key Changes
All HETS 270/271 submitters that connect via SOAP or MIME will, at the very least, need to change their destination URL at the designated date and time. Updated URLs appear in the new HETS 270/271 SOAP/MIME Connectivity Guide (hereafter referred to as “the new CG”). The updated SOAP URL is in Section 3.0 of the document; the updated MIME URL is in Section 4.0 of the document. Submitters will be given an opportunity to test connectivity to the new destination URLs in advance (see ‘Testing’ below) but otherwise SOAP and MIME submitters will need to continue using the existing destination URLs until they are given a specific date and time to transition to the new URL in the first quarter of 2020.
Additionally, there are several other changes being made to the HETS SOAP and MIME implementations that may impact your organization’s specific connectivity implementation. It is possible that some or none of these changes will impact your organization – so it is essential that each SOAP or MIME submitter carefully review these changes to determine if they will require updates to your HETS connection. Submitters can also use Table 1 of the new HETS SOAP/MIME Connectivity Guide to review the list of changes made in version 4-0 of the document.
- CMS has removed cipher suite TLS_RSA_WITH_3DES_EDE_CBC_SHA from the list of supported cipher suites in Section 2.2 of the new CG. If your organization currently uses this cipher suite, you will need to switch to a different cipher suite. All supported cipher suites appear in Section 2.2 of the new CG.
- SOAP only – CMS has updated Section 3.1.1 of the new CG to specify new SOAP digital signature requirements. Specifically, SOAP submitters must utilize a canonicalization method algorithm for signature that is ‘Exclusive Without Comments’. Signatures using algorithms that are ‘Exclusive With Comments’, ‘Inclusive With Comments’ or ‘Inclusive Without Comments’ will not be accepted. SOAP submitters must carefully review their current digital signature algorithm practices and determine if you will need to make changes.
- MIME only – Current HETS MIME policy states “the X12 request must be submitted as part of the MIME request and not as an attachment” (Connectivity Guide, Table 6). CMS will begin actively enforcing this policy as part of this migration. All MIME submitters must ensure that the 270 is encoded in-line to the MIME message. If an attachment is received, the transaction will be rejected. More information is available in new CG, specifically Table 6 and Section 4.2.
Please note that items 1-3 are backwards compatible with the current HETS SOAP and MIME implementations. For example - if an organization determines that they need to change their cipher suite (#1) – they can make that change at any time prior to the first quarter of 2020 (we do recommend discussing any such change with MCARE in advance to coordinate monitoring and support). The only change that requires specific timing is the change of SOAP or MIME destination URLs on a specific date and time (date & time are currently TBD) in the first quarter of 2020.
CMS emphasizes that these are connectivity/implementation changes only. There are no structural or content changes to the payload X12 270 request or 271 response. Testing will focus only on connectivity and implementation, not on X12 changes.
Testing
CMS will require all HETS SOAP and MIME submitters to test connectivity, including the Key Changes listed above, during the period December 1-31, 2019. MCARE will provide additional information as this testing window approaches, including test NPI & beneficiary information to be utilized on the 270 request. There will be no real Beneficiary data used for testing; submitters will submit mocked-up NPI and Beneficiary data supplied by MCARE for this preliminary connectivity testing. If a submitter cannot complete the preliminary connectivity testing by December 31, 2019, your organization may experience an interruption to your ability to utilize the HETS 270/271 application. Testing will be extremely limited and will be considered complete when the submitter can successfully receive a HETS 271 response. Submitters will be asked to confirm successful testing in writing; these submitters will then be considered ready for the HETS transition in the first quarter of 2020. CMS will provide the specific HETS URL transition date and time closer to the actual date.
Submitter Documentation
An updated HETS SOAP/MIME Connectivity Guide has been created for the high availability environment. This document (version 4-0) is available here: /Research-Statistics-Data-and-Systems/CMS-Information-Technology/HETSHelp/Downloads/R2020Q100HETS270271SOAPMIMEConnectivity.pdf (PDF)
The current HETS SOAP/MIME Connectivity Guide (version 3-2) that outlines all current connectivity/implementation requirements is available here: /Research-Statistics-Data-and-Systems/CMS-Information-Technology/HETSHelp/Downloads/HETS270271SOAPMIMEConnectivity.pdf (PDF)
Please contact the Help Desk if you have any questions.