Privacy Notice Policy
This site is operated by Wellpoint Federal Solutions, Inc. Wellpoint Federal contracts with the Centers for Medicare & Medicaid Services (CMS) and is a CMS contractor under the authority granted in Sections 1842, 1862(b) and 1874 of Title XVIII of the Social Security Act (the act) (42 United States Code (U.S.C) §§1395u, 1395y(b), and 1395kk).
This Privacy Notice explains what information we collect, how it is used and safeguarded, when it may be disclosed, and your rights regarding Protected Health Information (PHI) and Personally Identifiable Information (PII). This privacy notice covers NGS.Medicare.com and applicable subdomains. Wellpoint Federal complies with the Privacy Act of 1974, the Health Insurance Portability and Accountability Act (HIPAA), CMS Information Security Acceptable Risk Safeguards (ARS), and applicable CMS contractual requirements.
Data Collection, Use and Disclosure
Wellpoint Federal collects PII and PHI only when voluntarily provided by individuals or when required to administer authorized CMS programs. PII is information that can identify an individual, either alone or in combination with other data.
Wellpoint Federal uses, shares, and maintains PHI and PII solely for authorized CMS purposes and applies the minimum necessary standard in accordance with CMS security and privacy requirements.
Wellpoint Federal does not sell, rent, or trade PHI or PII. Information is disclosed only as permitted or required by law, CMS contract, or valid legal process.
PHI and PII may be shared with law enforcement, CMS, or CMS-contracted entities for authorized program administration and contractual activities. All disclosures are made in accordance with the Privacy Act.
Wellpoint Federal uses third-party service providers to support website and program operations. These providers access information only on behalf of Wellpoint Federal and are subject to CMS security and privacy requirements.
If you elect to use text message (SMS) multi-factor authentication, we collect and maintain your mobile phone number solely to deliver one-time security verification codes needed to authenticate your identity and protect your account.
Personal Information You Choose to Provide
This website offers opportunities to voluntarily provide personal information, such as registering for education events, subscribing to email communications, completing surveys, or enrolling in the provider portal.
Providing personal information is optional. How ever, declining to provide information may limit access to certain website functions or services. Any PHI collected through the provider portal is submitted by providers about beneficiaries they treat and is used only for its intended and allowed purpose.
If you choose to use text message (SMS) as your multi -factor authentication (MFA) method, you consent to receive one -time security verification codes at the mobile phone number you provide. We collect and maintain your mobile phone number only to send these verification codes to authenticate your identity and help protect your account from unauthorized access.
SMS verification codes are sent on behalf of NGS.Medicare.com using a contracted third -party service provider. Your mobile phone number is shared with that provider only as necessary to deliver the SMS verification codes. The provider may use your mobile phone number only to provide this service and must safeguard it in accordance with applicable laws, regulations, and CMS contractual requirements.
No Marketing Texts: Neither NGS.Medicare.com nor its contracted service provider uses your mobile phone number to send marketing or promotional text messages.
Opting Out: You may stop using SMS authentication at any time by selecting another available MFA method in your account settings or by contacting the NGS Help Desk . If you opt out of SMS authentication, you must use another supported MFA method to access your account.
Message Frequency and Rates: Message frequency is limited to authentication events (for example, when signing in or verifying your identity). Message and data rates may apply based on your mobile carrier’s plan .
Information Automatically Collected When You Browse
When you visit this website, limited technical information that does not directly identify you may be collected automatically, such as IP address, browser and device type, date and time of access, pages visited, and interaction data.
This information is used to support system security, prevent fraud, waste or abuse, troubleshoot performance issues, and improve website functionality. Automatically collected information does not include PHI and is not used to identify individual users.
Session Recording & Replay
CMS uses session replay or similar monitoring technologies to understand how users interact with this website and to identify technical issues.
Session replay tools may capture mouse movements, clicks, scrolling behavior, and navigation activity. These tools are configured to exclude, mask, or suppress data entered into sensitive fields and are not used to collect PHI or sensitive personal information.
Visitors should not enter PHI or sensitive personal information into free-text fields unless explicitly instructed as part of an authorized CMS function. Users may opt out of session replay by not allowing cookies during time on this site.
Cookies and Tracking Technologies
Wellpoint Federal uses cookies to support essential website functionality, website performance measurement, and user experience improvements. Cookies are not used to identify individual users and are not shared for commercial purposes.
Not allowing cookies may limit certain website features and opts users out of session replay and other cookie-based technologies.
Data Retention and Safeguards
Wellpoint Federal retains PHI and PII only for the period necessary to fulfill authorized purposes and in accordance with CMS records retention schedules.
Records containing PHI or PII are safeguarded in accordance with the Privacy Act of 1974, HIPAA, CMS ARS, and CMS contractual requirements. Information is stored on secure systems, accessed only by individuals with a legitimate business need, and subject to monitoring and auditing. When no longer required, information is securely disposed of in accordance with CMS records retention policies.
Security Monitoring & Incident Response
Wellpoint Federal implements security monitoring, incident response, and breach reporting procedures consistent with CMS requirements. We monitor network traffic to identify unauthorized activity and attempt to upload or change information or other damage to the web service. Any suspected or confirmed incidents involving PHI or PII are handled in accordance with CMS incident response and breach notification requirements.
Your Rights Under HIPAA
You have the right to:
- Request access to your PHI.
- Request an amendment to your PHI.
- Request an accounting of disclosures.
- Request restrictions on certain uses or disclosures, where applicable.
Requests must be submitted in accordance with CMS and Wellpoint Federal procedures. Not all requests may be granted, as permitted by law.
Email and Fax Communications
We may provide email and fax links to further facilitate communication. Electronic mail is not necessarily secure, and we do not recommend sending confidential or personal information via email. If you send us an email with questions or comments, we may use your PII to respond to your questions or comments, and we may save your questions or comments for future reference or to comply with government records retention policies.
If you request that we email or fax information about you to someone else using email and fax capabilities in our websites, that email or fax may not also be completely secure. Please verify email addresses and fax numbers before submitting such a request.
External links
Wellpoint Federal may provide links to websites not owned or controlled by Wellpoint Federal. These links do not constitute endorsement, and Wellpoint Federal is not responsible for the privacy practices, content, or security of external websites. We link to other websites solely for your convenience and education. When you follow a link to an external site, you’re leaving Wellpoint Federal websites and the external site’s privacy and security policies will apply.
Privacy Notice Updates
Wellpoint Federal may update this Privacy Notice periodically. Any changes will be posted on this page.
Contact Information
Wellpoint Federal Solutions, Inc.
Attention Wellpoint Federal Privacy Officer
220 Virginia Ave, Indianapolis, IN 46204
Email to: NGSethicsandcompliance@elevancehealth.com
Last Updated: August 17, 2026, 1:00pm, Eastern Standard Time (EST)