Masking of Patient Control Number/Patient Account Number Field on Paper Remittance Advice Began October 1, 2019

Published 03/05/2020

On May 21, 2019, the Centers for Medicare and Medicaid Services (CMS) issued MLN Matters article MM11289, Additional Processing Instructions to Update the Standard Paper Remit (SPR) (PDF, 77 KB). The Social Security Number Fraud Prevention Act of 2017 restricts the inclusion of Social Security Numbers (SSNs) on documents sent by mail. Medicare Administrative Contractors (MACs) have been instructed, beginning October 1, 2019, to mask the Patient Control Number field (also named the Patient CNTRL Number) or the Patient Account Number (ACNT) field on Medicare Paper Remittance Advice (RA) when the field contains a HICN or SSN anywhere within the field.

Masking will replace the first five digits of the HICN or SSN with capital Xs. An SSN is defined as a nine or greater digit number (including spaces or hyphens).

HICN Examples

  • XXXXX7777A
  • XXXXX7777C1

SSN Examples

  • XXXXX1234
  • XXX-XX-1234

RRB HICN Examples

  • AXXXXX1370
  • WCAXXXXX2388

The masking requirement does not apply to RRB numbers issued before March 1964, which included an alpha prefix and 6 digits; for example, A000000.


  • Electronic Remittance Advice will not have the Patient CNTRL Number or Patient ACNT fields masked
  • Currently the Remittance Advice pulled into Palmetto GBA’s eService portal is a duplicate of the paper RA so the Patient CNTRL or Patient ACNT number is masked. Palmetto GBA is exploring ways to unmask this information when an RA is viewed through the Palmetto GBA eServices portal.
  • Providers should not reach out to the Palmetto GBA Provider Contact Center to obtain the Patient CNTRL or ACNT number. If needed, providers should reference the associated initial claim form/electronic submission to retrieve the Patient CNTRL Number or ACNT number.
  • To prevent masking, a provider may choose to change their account number structure to fewer than nine digits (including spaces and hyphens)
  • MACs will not mask a patient’s Medicare Beneficiary Identifier (MBI) when used as their Patient CNTRL Number or ACNT

Was this article helpful?