Privacy Policy / Terms - Portal Guide

NORIDIAN PRIVACY POLICY

Policy effective and last reviewed August 13, 2024

Noridian Healthcare Solutions (Noridian) contracts with the Centers for Medicare & Medicaid Services (CMS) and is a CMS contractor under the authority granted in Sections 1842, 1862 (b) and 1874 of Title XVIII of the Social Security Act (the Act) (42 United States Code (U.S.C.) §§1395u, 1395y (b), and 1395kk).

As a CMS contractor, Noridian maintains the five (5) websites identified below, three of which are public and two that are non-public. Noridian is providing this notice to you concerning (i) how Noridian might use or disclose personally identifiable information (PII) that you might provide while visiting our public websites at http://med.noridianmedicare.com, https://noridiansmrc.com, or https://www.edissweb.com ("Noridian's Public Websites") and (ii) how we might use or disclose PII or protected health information (PHI) that a health care provider might provide when using the non-public provider portals at https://www.noridianmedicareportal.com and https://noridianexternal.myabsorb.com ("Noridian's Non-Public Websites").

Under this policy, PII means any information that alone, or in combination with other data elements, could be used to identify you, such as a name, address, telephone number, Social Security number (SSN), or other personal identifier unique to you (e.g., Medicare provider/supplier number). In general, PHI means individually identifiable health information that is created by a health care provider or other covered entity that relates to the health or condition of an individual.

Protecting your privacy is very important to us. We understand that visitors to our public websites and providers who visit our non-public provider website need to be in control of their personal information, which is why we actively protect the privacy of everyone who uses our various websites. We are telling you about the Noridian public and non-public website privacy policy, so you know what information we collect, why we collect it, and what we do with it. This policy covers the following public and non-public websites (collectively, "Noridian's Websites"):

• http://med.noridianmedicare.com (public)
• https://www.edissweb.com (public)
• https://noridiansmrc.com (public)
• https://www.noridianmedicareportal.com (non-public)
• https://noridianexternal.myabsorb.com (non-public)

How We Collect, Use, and Disclose Information on Noridian's Websites

Noridian's Public Websites:

Noridian's Public Websites may collect PII about you during your visit when you choose to provide it to us—for example, when you provide us information about you on our "Email Customer Service" or "Website Feedback" pages; when you sign up for a list serve; when you register on our site; when you register for an event; or when you participate in surveys, as described more below. You do not have to give us PII to visit Noridian's Public Websites. If you choose to provide us with PII, we will use the information you provide only as long as needed to respond to your question, grant access, or to fulfill the stated purpose of the communication. Groups of records that contain PII about an individual and are designed to be retrieved by the individual's name or other personal identifier linked to the individual will be safeguarded in accordance with the Privacy Act of 1974, Health Insurance Portability and Accountability Act of 1996 (HIPAA), CMS' Information Security Acceptable Risks Safeguards (ARS) and other CMS contract requirements.

Noridian's Non-Public Websites:

Noridian as a CMS contractor will collect PII from health care providers using the Non-Public websites if they specifically and knowingly choose to provide it to us. We will use the PII only in connection with our services as a CMS contractor, or for such purposes that we describe to you at the point of collection. For example, health care providers might submit PII in connection with their enrolling to use Noridian's secure provider portal. In such a case, Noridian will actively guard any PII they provide and will not disclose, give, sell, or transfer any such personal information to third parties. If we share demographic information with third parties, we will give them aggregate information only. By supplying Noridian with PII, the health care provider users have consented to allowing Noridian to use that PII in any way in accordance with CMS/HIPAA standards.

Noridian also collects PII to track those users registering for portal access. For health care providers to become users in the Noridian Medicare portal, they are required to enter in personal information (that is, name, work phone, email address, the provider/supplier's Tax Identification Number (TIN) or Social Security number (SSN), organization name, trading partner ID, NPI, and PTAN). This information is used to permit them continued access to the Non-Public Portal.

In addition to PII, health care providers might submit PHI in connection with the functionality provided through Noridian's secure non-public Noridian Medicare portal. We use and disclose such PHI only in connection with our role as a CMS contractor and then only as permitted or required under the HIPAA Privacy Rules and under our contract with CMS. Please see the Notice of Privacy Practices applicable to CMS contractors that is published by CMS on its website for a full description of all uses and disclosures of such PHI under the HIPAA Privacy Rule.

For more information or to ask questions about CMS's privacy practices, email Privacy@cms.hhs.gov.

Noridian's Websites Generally: Noridian may also collect PII to track those users registering for educational events. Users are required to enter in personal information (that is, name, email address, company name, and so on) when registering for most educational events, such as webinars and in-person seminars. This information is then used for continued communication with the user regarding their event registration and participation.

Users also have the option when registering on our List Serve Email newsletter to receive Medicare news and information. To complete this request, they need only supply their email address and name.

Noridian may also use an online survey to collect opinions and feedback. This online survey will appear at random to users. Survey respondents have the option of not including any PII in their comments. However, if the user has a question, there is an option to leave their email address. Noridian analyzes and uses this information to improve our website's operation and content and to improve the end user experience.

Noridian's Websites may also collect certain technical information—such as IP addresses, and browser and device information—from visitors who read, browse, and/or download information from our websites. We do this so we can analyze and understand how the websites are used and how to make them more helpful.

None of Noridian's Websites collect information for commercial marketing or any purpose unrelated to our mission and goals.

PII collected via Noridian's Websites is kept on secure servers and is accessed only by staff members with a business need to use it. This information is disposed of in accordance with the Noridian Records Retention program when no longer needed. On occasion, PII collected is requested by, and shared with the CMS for use in contract activities. In accordance with CMS regulations, collected information is not disposed of; instead, it is kept on an indefinite basis. If Noridian transmits your protected data to CMS or any CMS-contracted entities, Noridian will ensure the data is encrypted according to CMS standards.

Additionally, Noridian may share the information we collect to the following categories of third parties:

• Services providers, including data analytics providers, survey providers, and payment processors, among others;
• Noridian's subsidiaries and affiliates;
• Entities that acquire us or all or substantially all our assets, or entities that engage in due diligence to consider doing so;
• The federal, state, or local governments, pursuant to relevant laws and regulations;
• Law enforcement

How We Might Use or Disclose Information Collected from Third-Party Websites

Noridian uses third-party websites to collect various types of information. Some of these third-party companies (and information about their privacy policies) are listed below. Any of your activity on these third-party websites is governed by the security and privacy policies of those websites. If you choose to use any of these third-party websites, you should review their privacy policies before such use and ensure that you understand how your information may be used and disclosed.

Noridian is not responsible for the content of linked third-party sites and does not make any representations regarding the privacy practices of, or the content or accuracy of materials on, such third-party web sites. Your use of third-party web sites is subject to the terms of use for such sites. If you decide to access third-party web sites that are linked to this Site, you do so at your own risk.

GoToWebinar
Website: http://gotowebinar.com
Privacy Policy: https://www.goto.com/company/legal/privacy

Google Analytics
Website: http://www.google.com/analytics
Privacy Policy: http://www.google.com/intl/en/policies/privacy/

General Information Applicable to Noridian's Websites

Web Server Usage

We may record information about how users access our websites. This information may include your IP address (or the DNS name associated with it) and what Web software you are using (browser and version). Information provided will be used only for statistical purposes to help improve this site. This information cannot be used to identify a specific individual.

While we make every attempt to protect the personal information that you share with us, it is important to realize that electronic mail is not secure against interception. If your communication is very sensitive, we recommend sending it by postal mail instead. Noridian will not use email as a form of communication if it involves sensitive information, unless the email is encrypted per CMS standards. Otherwise, only telephone, fax or postal services will be used for communicating sensitive information.

Cookies

A cookie is a small piece of information that is sent to your browser when you access a website. There are two kinds of cookies, a session cookie, and a persistent cookie. A session cookie is text that is stored temporarily in your computer's memory but never written to a drive. It is destroyed as soon as you close your browser. A persistent cookie is saved to a file on your hard drive. Noridian primarily uses only session cookies. A persistent cookie that expires on its own in 30 days may be used in conjunction with a website satisfaction survey, however no PII is collected. You may be able to decline using cookies, but you may be asked to re-enter previously supplied information to complete the website satisfaction survey each time you access it.

How to opt Out or Disable Cookies

If you do not wish to have temporary or persistent cookies placed on your computer, you may disable them using your Web browser. If you decide to "opt out" of cookies, you will still have access to all information and resources the Noridian website provides.

You can easily remove any cookies that have been created in the cookie folder of the most popular Internet browsers. Select the "Help" function on your browser and enter "cookies" to search for information on how to remove all or individual cookies.

Do Not Track

Our systems are not configured to recognize or respond to Do Not Track headers or signals.

External Links

Our website and publications contain numerous links to other network websites. We cannot be responsible for the privacy practices of other organizations or the content of external websites. Noridian is not responsible for the content of linked third-party sites and does not make any representations regarding the privacy practices of, or the content or accuracy of materials on, such third-party web sites. Your use of third-party web sites is subject to the terms of use for such sites. If you decide to access third-party web sites that are linked to this Site, you do so at your own risk.

Amendments to This Privacy Policy

Noridian may occasionally update this policy. Any changes we may make to this Privacy Policy will be posted here. Please check this Privacy Policy frequently. If you do not agree or consent to these changes, do not continue to use Noridian's Websites.

We Value Your Opinion

We welcome your input about our Website Privacy Policy. We encourage you to submit comments, or questions or requests (e.g., to amend or correct previously submitted PII). Please send any comments or concerns to the Noridian Medicare Privacy Officer.

Noridian Medicare Privacy Officer

Noridian has a designated privacy official who is available to answer privacy questions, for reporting privacy issues, specifically, the types of data we collect and how we use it, as well as how we share, safeguard, and dispose of collected information. You may contact the Medicare Privacy Officer by submitting your comments or questions to the following address or phone number:

Noridian Healthcare Solutions
Attn: Medicare Privacy Officer
PO Box 6055
Fargo ND 58103

PrivacyOfficer@Noridian.com
1-800-667-8519 (Privacy concerns only)
1-855-609-9960 (Noridian Medicare Portal sign in issues)