Multi-Factor Authentication (MFA) Requirement for Connexion Users

The Centers for Medicare & Medicaid Services (CMS) Identity Management (IDM) System, which is used to access applications including Connexion, the Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS) Competitive Bidding Program’s (CBP) secure portal, is requiring all users to set up an MFA device.

The projected date that requires users to set up an MFA device to be able to access the CMS IDM System is June 3, 2022. On June 3, 2022, users will not be able to access the CMS IDM System without setting up an MFA device.

When you sign in to Connexion, you must now use more than your username and password. You must set up a second factor or MFA device, such as email or text message, to verify your identity, which provides an extra layer of protection. You will select any of the displayed devices (email, text message, Google Authenticator, Interactive Voice Response (IVR), or Okta Verify) and then set up and verify that device following system prompts. The CMS IDM System recommends users set up more than one MFA device for their account.

Existing users who do not have MFA set up in the CMS IDM System will be prompted upon login to set up an MFA device.

New users will create an account through New User Registration and upon completion, receive a prompt to log back into the CMS IDM System to set up an MFA device. 

Contract suppliers must set up an MFA device beginning June 3, 2022, to complete the upcoming Form C semi-annual report, which is due no later than ten business days after July 1, 2022. 

If you have any questions setting up your MFA device, please call the Competitive Bidding Implementation Contractor (CBIC) customer service center at 877-577-5331 between 9 a.m. and 5:30 p.m. prevailing Eastern Time, Monday through Friday.

The CBIC, under contract with CMS, is the official source for information regarding the DMEPOS CBP. CMS cautions suppliers that neither CMS nor the CBIC independently reviews or verifies information about potential inaccurate information concerning the DMEPOS CBP posted on websites other than the CBIC website or CMS.gov website. Visit the CBIC website for valuable resources and tools and to subscribe to receive email updates.