J.1 PPI MEDIC SOW - Amendment 0001.pdf

PLAN PROGRAM INTEGRITY

MEDICARE DRUG INTEGRITY

CONTRACTOR

Statement of Work

Centers for Medicare & Medicaid Services August November 2019

PLAN PROGRAM INTEGRITY MEDICARE DRUG INTEGRITY

CONTRACTOR

STATEMENT OF WORK

I. SCOPE

The overall strategy for the Plan Program Integrity Medicare Drug Integrity Contractor (PPI MEDIC) is to conduct Medicare Parts C and Part D proactive data analysis and identify program vulnerabilities. These preliminary findings shall be provided to the Medicare Advantage (MA) and Prescription Drug Plans (PDPs) for further review, analysis, corrective actions as needed and support their overall fraud, waste and abuse (FWA) monitoring efforts. The PPI MEDIC shall coordinate with The Centers for Medicare & Medicaid Services (CMS) staff, CMS contractors, and other stakeholders as needed and as directed by the CMS Contracting Officer’s Representative (COR), in collaboration with Business Function Leads (BFLs) to perform this program integrity work.

A. Background

CMS’ authority to enter into a contract for and conduct the work associated with the PPI MEDIC is derived from the following legislation:

The Medicare Prescription Drug, Improvement and Modernization Act of 2003 (MMA) Title I of the MMA (P.L. 108-173) was signed into law on December 8, 2003. The MMA established a new voluntary outpatient prescription drug benefit under Part D of Title XVIII of the Social Security Act (the Act). The prescription drug benefit, referred to as Medicare Part D, as well as an employer subsidy for qualified retiree health plans, began on January 1, 2006.

CMS has contracted with licensed, risk-bearing entities to administer the prescription drug benefit. These Part D plans are referred to as stand-alone, risk-bearing PDPs. Many Medicare managed care plans also added a Part D benefit to their existing program. These plans are known as Medicare Advantage Prescription Drug Plans (MA-PDPs). All Part D plans must offer a standard drug benefit, but may also vary the benefit offering within defined parameters.

Title II of the MMA modified and renamed the Medicare+Choice program established under Part C of Title XVIII of the Act. The program is now called the MA program. The MMA also introduced a new process for determining beneficiary premiums and benefits for 2006 and future years under which MA organizations will submit a “bid” reflecting their revenue needs for covering the benefits they plan to offer. This new process applied to all MA plans beginning in 2006.

The final rule implementing Part D and regulating the MA program are available by searching in the Federal Register online database at https://www.federalregister.gov/public-inspection or otherwise in 42 CFR Part 422.

The Patient Protection and Affordable Care Act (ACA) The Patient Protection and ACA (P.L. 111-148) was enacted on March 23, 2010. The Health Care and Education Reconciliation Act (P.L. 111-152) was enacted on March 20, 2010 and modified a number of the Medicare provisions in P.L. 111-148 as well as added several new provisions. The Patient Protection and ACA and the Health Care and Education Reconciliation Act are collectively referred to as the ACA of 2010. The ACA includes significant reforms of the private health insurance industry as well as the Medicare and Medicaid programs. The ACA strengthens program integrity efforts across Medicare, including Parts C (managed care) and Part D (prescription drug program). The program integrity provisions throughout the ACA, and particularly in Title VI, outline expectations for proactive detection and prevention of FWA, as well as robust program management, performance measurement, and reporting.

Medicare Integrity Program (MIP) The Health Insurance Portability and Accountability Act of 1996 (HIPAA, Public Law 104-191) was enacted on August 21, 1996. Section 202 of Public Law 104-191 added a new section, §1893, to the Social Security Act that establishes the MIP. CMS will enter into this contract under MIP Discretionary.

B. Purpose

In order to ensure the protection of the Medicare Trust Fund, CMS is interested in contracting with outside an outside entity to support CMS’ audit, oversight and antifraud and abuse efforts associated with the Prescription Drug Benefit (Part D), and the MA Program. This entity will hereafter be referred to as the PPI MEDIC. The PPI MEDIC is a national contractor.

The PPI MEDIC shall provide a coordinated strategy to conduct proactive and reactive data analysis and identification of inappropriate payments, and potential program vulnerabilities in Medicare Parts C and Part D. The primary goal of the PPI MEDIC is to analyze Parts C and Part D data, conduct audits of plans, provide outreach and education and ensure compliance with regulatory requirements. Services under this Statement of Work (SOW) shall provide a full range of statistical, analytical, and/or professional business functions to CMS. Services shall also address program focal areas in management, administration, operation and oversight of the Medicare Parts C and D programs. Services shall include, but are not limited to:

https://www.federalregister.gov/public-inspection

• Transition the Part C and Part D FWA detection and prevention workload from previous contractor;

• Perform proactive and reactive data analysis that may result in an audit (program, pharmacy, desk/ plan sponsor self- audit, etc.);

• Identify high risk plan sponsors, pharmacies, providers, and beneficiaries in Medicare Parts C and D;

• Develop and validate new and existing methodologies for the early detection and prevention of abusive use of services, as well as possible fraud and abuse schemes;

• Proactively educate providers about aberrant billing, prescribing, and other provider/supplier/pharmacy statistical practices through reporting and other mechanisms;

• Manage and evaluate plan related complaints and Requests for Information (RFIs);

• Identify and report on vulnerabilities that are emerging in Medicare Parts C and D;

• Develop presentations and provide presentation materials and ad hoc reports to CMS for training or informational purposes;

• Provide programmatic and operational input;

• Advise the One PI and other systems of use on data needs and methods to detect FWA in Part

C and Part D via membership in the Program Integrity Data Users Group (PIDUG);

• Establish and maintain a positive working and networking relationship with internal and external stakeholders, including MA plans, Part D plan sponsors, States, Law Enforcement (LE); and

• Work collaboratively with the other CMS contractors as directed by CMS.

Additionally, while CMS’ oversight strategy is to monitor and address program integrity, identifying overall program vulnerabilities and ensuring plan sponsors’ adherence to regulatory requirements, technical assistance is necessary to assist the Agency in meeting these oversight responsibilities.

C. Technical Considerations

1. In order to implement effective proactive data analysis projects on potentially inappropriate Medicare Parts C and Part D payments, the PPI MEDIC shall:

• Access data from a variety of sources (a list of possible sources is located in Task 2, “Access Systems,” section of Specific Requirements);

• Develop and run reports on the data included in the CMS systems. In order to run reports, the PPI MEDIC shall be familiar with data analysis packages such as Statistical Analysis Software (SAS) and Structured Query Language (SQL); and

• Institute ongoing monitoring and modification of data analysis project plan components through the PPI MEDIC’s internal quality improvement and quality assurance (QA) initiatives.

2. In order to facilitate data analysis, the PPI MEDIC shall have the ability to store and secure sensitive data by meeting requirements of the CMS Business Partners System Security Manual

(BPSSM) and the CMS core security requirements. In order to gain the required connectivity, the PPI MEDIC shall have:

• Network connectivity with properly defined routing that conforms with CMS IT requirements; and

• Scalable storage capabilities.

3. Prescription Drug Event (PDE) data is currently housed within CMS’ Integrated Data Repository (IDR). The Office of Information Security (OIS) supported tools for accessing the IDR are Cognos and SAS/Access Interface to Teradata. Users of this data must have One Program Integrity (One PI) training and be proficient in all software skills identified by OIS in order to be granted access to the IDR. The OIS preferred method for accessing PDE data for users not proficient in SAS is Business Objects. Business Objects is a business intelligence tool that draws on data from the IDR to develop queries/reports to support analysis. The dataset can be produced in several formats, including MS Excel, HTML, or Text Delimited.

The file types produced by Business Objects are standard file types which can be read into a multiple of software packages; this gives the user the flexibility to analyze the data using their preferred analytical tools.

4. The PPI MEDIC must have available sufficient hardware, software, and personnel with analytical skills to meet requirements for identifying problems efficiently and developing and implementing corrective actions. The following are minimum resource requirements for conducting data analysis:

Data Processing Hardware

PPI MEDIC must have adequate equipment for data analysis includes facilities to process data (i.e., personal computers) and to store data (i.e., tape drive, disk drives, etc.). In addition, the PPI MEDIC must have telecommunication capabilities to interact with the CMS Data Center.

These capabilities shall include having Automated Ground Network System via a required T1 line.

Data Processing Software

CMS will provide the PPI MEDIC with software to allow communication with the CMS Data Center. The PPI MEDIC shall run their data analyses at the CMS Data Center or using the One PI Systems Integrator tool.

Personnel

The PPI MEDIC shall have staff with appropriate training, expertise, and skills to support application of software and conduct systemic analyses and clinical evaluation of data and medical records. The PPI MEDIC is required to have staff with clinical expertise (e.g., registered nurses, pharmacists) and a mix of skills in programming, statistics, and data analysis (e.g., trending and profiling of National Council for Prescription Drug Programs (NCPDP) codes), as well as staff who have training in developing analytical and sampling strategies for overpayment projections.

5. The PPI MEDIC is required to have an internal tracking system that shall be accessible to CMS and have reporting and functional capabilities to include, but not be limited to the following:

• Track all PPI MEDIC workload information or actions related to Analytics, Audits, and required tasks outlined in this SOW

• Compile data and information for reporting

II. REQUIREMENTS

Independently, and not as an agent of the Government, the Contractor shall furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the requirements described in this SOW.

The PPI MEDIC is responsible for conducting data analysis to identify inappropriate payments, confirming and validating the deletion of PDE records by the plans when an inappropriate payment is identified, and identify program vulnerabilities.

• Review Parts A and B claims, Part C encounter data and PDE data, to determine appropriateness of payments made by the plans. Coordinate with stakeholders, including the Investigations MEDIC, MA, Part D plans and other program integrity contractors when necessary.

• Initiate and maintain networking and outreach activities to ensure effective interaction and exchange of information with internal components, as well as outside groups.

• Collaborate with other CMS contractors when allegations pertaining to FWA are identified and require further investigation.

A. General Requirements

Audits

Although not all inclusive, the PPI MEDIC may be required under the SOW to perform the following activities to ensure program integrity in the Medicare Parts C and D programs:

• Assist CMS in developing a list of entities for auditing purposes that may require future monitoring based upon past history.

• Use established or self-developed data systems to efficiently and proactively evaluate inappropriate activity that may be present in entities involved in the Part D prescription drug benefit (including Part D Plans and their subcontractors and Part D providers, beneficiaries, prescribers), and MA plans. This includes, but is not limited to, monitoring drug utilization patterns and analyzing data to detect outliers, off-label drug use, inappropriate coverage of drugs, and inappropriate changes in formularies.

• Conduct reviews and audits (this includes self-audits, national audits and PI audits) of participating entities as necessary (including entities that CMS indicates may warrant future monitoring and where indicated by unexplained spikes in utilization).

Outreach & Conferences

The PPI MEDIC shall serve in a support role and shall participate in training and education activities as directed by the COR. The PPI MEDIC shall also prepare presentations and participate in conferences as directed by the COR. Occasionally, the PPI MEDIC shall be required to present to external entities, such as plans and LE. Presentations to external entities are subject to approval by the COR.

CMS will not reimburse contractors or subcontractors for entrance fees, registration fees or any conference charge to attend conferences or trainings if the contractor is marketing their business at that conference or representing more than one company. This includes, but is not limited to:

marketing kiosk, giveaways, company specific informational packets, company informational material, marketing material, etc. (this excludes any CMS supplied materials to be given at the conference). CMS paid travel to conferences and trainings are purely informational/educational, as the contractor is representing CMS as the PPI MEDIC. This is not meant to exclude participation of the PPI MEDIC or their subcontractors at trainings or conferences; each contractor can use their own funding to attend and participate at conferences, trainings and market their business.

However, if CMS is funding the trip, then the PPI MEDIC is there to support the work they provide CMS as the PPI MEDIC.

Coordination

The PPI MEDIC's success in safeguarding the Medicare Trust Fund depends on a close and coordinated working relationship between internal components and external organizations.

The PPI MEDIC and its partners shall work together and communicate frequently in order to keep each other apprised of potential areas of vulnerability and to avoid duplication of efforts.

As needed, the PPI MEDIC shall work with and coordinate with external entities including, but not limited to:

• Collaborate with the Investigations MEDIC on Medicare Parts C and D complaints and investigations; The PPI MEDIC may receive potential Part D and MA fraud complaints from a variety of sources.

o If the PPI MEDIC receives any complaints (or inquires) that it is not responsible for handling, the PPI MEDIC shall refer the complainant to the Investigative MEDIC.

o Any referrals that are forwarded to the Investigationsive MEDIC will be documented in the PPI MEDIC’s internal tracking system.

• Provide support to LE agencies for investigations of potential fraud and abuse involving

Medicare Parts C and D plans.

o All RFIs will be tracked in the PPI MEDIC’s internal tracking system.

o Develop complaints related to allegations of plan sponsor fraud with the exception of immediate advisements.

• Provide technical assistance to CMS (e.g. development and tracking of correspondence, interpretation of Medicare Parts C and D policy, etc.).

• Develop and execute Joint Operating Agreements (JOAs) with entities that require routine communication and collaboration, such as the Investigations MEDIC and Unified Program Integrity Contractor. Additional stakeholders may be identified by CMS.

• Interact with the CMS COR, Subject Matter Experts (SMEs), and/or BFLs both within the Center for Program Integrity (CPI) and across the Agency. The contractor shall also work with CMS Field and Regional Offices to coordinate FWA activities.

• Understand the goals and techniques of fraud detection and control in general as they relate to their own areas of responsibility.

• Facilitate and participate in meetings with program staff from CMS and other CMS contractors and/or stakeholders.

Constraints/Assumptions

In general, the PPI MEDIC shall possess, at a minimum, the following specialized expertise:

• Thorough understanding of Title XVIII of the Social Security Act

• Thorough understanding of the ACA

• Thorough understanding and subject matter expertise of Titles I and II of the MMA, Medicare Part C and Part D

• Knowledge of operations and management of MA Organizations

• Knowledge of the Parts C and D Audit Guides and program strategy

• Knowledge of pharmacy benefits operations and management and how they relate to

Medicare Parts C and D

• Knowledge of CMS’ annual Part C and Part D regulatory changes

• Knowledge of CMS’ annual call letter

• Knowledge of the MA deeming program

• Ability to evaluate an organization’s (i.e., plan sponsor’s) FWA actions using data analysis

• Experience conducting fraud audits of, or for, governmental agencies

• Ability to communicate with CMS via an internet connection in order to access the Health

Plan Management System (HPMS)

• Thorough understanding of HIPAA and Privacy requirements

1. The PPI MEDIC shall furnish the necessary services and qualified personnel, facilities, equipment, materials, and supplies not otherwise provided by the government as needed to perform the requirements set forth in this SOW.

2. The PPI MEDIC shall perform requirements as defined in this SOW in accordance with applicable Medicare laws, Medicare regulations, Medicare manuals, the Federal Managers Financial Integrity Act, Generally Accepted Government Auditing Standards (GAGAS), the Chief Financial Officer Act of 1990, and others as may be identified herein.

3. The PPI MEDIC shall continuously evaluate the effectiveness of all actions.

4. All travel is subject to preapproval by the COR (i.e. onsite audits, travel to CMS, etc.).

5. The CMS Analysis, Reporting, and Tracking System (CMS ARTS) and IBM Connections are the systems utilized by CMS to track and analyze the PPI MEDIC costs, hours, workload, deliverables and other features as may be developed. CMS ARTS and IBM Connections training will be provided to the PPI MEDIC at a mutually agreeable date and location. All significant CMS ARTS changes will be communicated to the PPI MEDIC via the News/Updates feature of CMS ARTS.

6. System Security

The contractor shall comply with section 1411(g) of the ACA, The Privacy Act of 1974 and any subsequent statutory revisions, such as HIPAA, as required in the privacy and security standards adopted by CMS and as required by 45 C.F.R. § 155.260 and with all other data security requirements herein.

The Privacy Act of 1974 requires CMS to account for all disclosures of personally identifiable information (PII). CMS uses the Data Use Agreement (DUA) to account for all such disclosures. The contractor shall enter into a DUA with CMS.

The contractor shall complete the CMS DUA form (see applicable documents) and submit it to the COR for review. The COR will then coordinate with the CMS Privacy Officer for authorization and assigning of a DUA number. If additional data not identified in the DUA is required, the contractor shall complete an update DUA to add datasets to obtain access to that information, as applicable. The DUA is updated at least annually.

Applicable Documents CMS DUA Forms http://www.cms.gov/cmsforms/do wnload s/cms-r-0235.pdf

At the conclusion of the use of CMS data or the expiration of the DUA, or the end of the Period of Performance (whichever comes first), the contractor shall enter and submit to CMS a Certificate of Destruction (COD). The COD certifies that the contractor has destroyed the data covered by the DUA and that data has not been used for any other purpose outside of what was covered in the DUA.

7. The PPI MEDIC shall perform the functions below and have written standard operating procedures for:

• Retaining education materials/communications, other correspondence and fraud documentation concerning specific issues that are easily retrievable;

• Maintaining communication and information flowing between the PPI MEDIC, Part

D and Part C plans, CMS, etc.; and

• Entering complaints timely in the PPI MEDIC’s electronic system.

http://www.cms.gov/cmsforms/downloads/cms-r-0235.pdf

B. Specific Requirements

Task 1: Transition

Transition and Implementation Requirements

Work performed as a PPI MEDIC shall occur in two phases: transition and fully operational. The transition period shall last ninety (90) calendar days. During this time, the PPI MEDIC shall train its staff and successfully prepare its operations for the fully operational period. At the conclusion of the transition period, the fully operational period begins. The PPI MEDIC shall assume all functions prescribed in this SOW during the fully operational period.

The PPI MEDIC shall develop and submit a Project Management Plan that defines the milestones, resources, and constraints of the project and addresses how the PPI MEDIC proposes to meet the requirements of this SOW by the fully operational date.

All project plans shall be modified and updated continuously after these initial submissions to reflect any major changes in the project. A major change is defined as something that shifts the work or plan by at least thirty (30) calendar days. When changes are identified, a draft plan shall be submitted to the COR for review within five (5) business days of identifying the change. The COR will provide comments to the PPI MEDIC within ten (10) business days, and the final plan shall be due five (5) business days after receipt of COR comments.

Kickoff Meeting and Transition Activities

CMS will arrange a Kickoff Meeting with the contractor after award to review the SOW and answer any questions that the contractor has to ensure that both the PPI MEDIC and CMS have a joint understanding of all work, timeframes and deliverables required. The PPI MEDIC shall work with CMS to compile the agenda for this meeting. The PPI MEDIC shall be prepared to provide CMS with a brief presentation outlining their proposal for completing the requirements of the SOW. The PPI MEDIC shall take minutes during this meeting and submit them to the COR within three (3) business days after the Kickoff Meeting. This meeting shall be scheduled as soon as possible but not later than fifteen (15) business days after the date of award.

Transition Meetings When applicable, the incoming PPI MEDIC and outgoing contractor shall work together to transition activities from the outgoing contractor (NBI MEDIC) to the incoming one (PPI MEDIC). The incoming PPI MEDIC shall review all transition deliverables from the outgoing contractor and provide their COR with any comments on the deliverables within the ninety (90) day transition period.

At the first transition meeting, the outgoing contractor and incoming PPI MEDIC will work with CMS to develop final transition planning documents. The final transition planning documents shall include, at a minimum, the following information:

Contact List: A list of transition workgroup members and their contact information will be submitted by the outgoing contractor five (5) business days after the first transition meeting.

Transition Deliverables List: A list of all deliverables necessary to ensure a smooth transition between the outgoing contractor and incoming PPI MEDIC and the dates on which the deliverables shall be sent to the incoming PPI MEDIC. This will be submitted by the outgoing contractor ten (10) business days after the first transition meeting.

Workload Release Dates and Transfer Procedures The outgoing contractor and incoming PPI MEDIC must work jointly and with CMS to develop packing and forwarding procedures for the transfer of records during the transition. The incoming PPI MEDIC must be responsible for receiving, accepting and verifying the contents of these packages. The above information must be incorporated into the Project Management Plan by the

PPI MEDIC.

Task 2: Systems Access/Maintenance

The contractor shall access and maintain access to the following systems, as approved by the COR, to identify high risk plans/sponsors, analyze complaint data, identify program vulnerabilities and conduct investigations for referral to LE, participate in user testing, business process modeling, business requirements and additional business needs as required, the contractor shall access and maintain access to the following systems:

• One PI

• HPMS

• IDR

• CMS Secure Email System to send CMS and other contractors sensitive data such as beneficiary information

• MBD - provides enrollment information for all Medicare beneficiaries

• MARx - provides Part D beneficiary enrollment information

• Licenses for relevant prescription drug data sets (for example, First Databank, Medispan, NCPDP, Redbook)

• Plan Finder Tool data which houses information about Part D plan benefit packages and drug prices

• Risk Adjustment Payment System and any other risk-adjustment systems

• NCH

Task 3: PIDUG

The PPI MEDIC shall also have representatives participate in the planning group for the One PI System, called the PIDUG. The planning group meets quarterly. These representatives shall advise and work with the One PI Systems Integrator as it builds the One PI portal and the One PI Data Repository and advises on the IDR.

Task 4: IDR User Group

The PPI MEDIC shall host and facilitate the IDR User Group on an “as needed” basis and as determined by the COR. This forum is used to share issues and solve problems that occur in the use of the IDR for specific PPI MEDIC tasks.

Task 5: Analytics: Data and Ad Hoc Analysis

The PPI MEDIC shall make use of available data and apply innovative analytical methodologies, to proactively identify and mitigate FWA in the Part C and Part D programs.

The goals of the PPI MEDIC data analysis program are to identify risks to the Medicare program.

Analysis of data shall include, but is not limited to:

• Identification of areas of vulnerability for FWA in the Parts C and D, programs

• Identification of potential incidents of FWA currently occurring in the Parts C and D programs

• Identification of potential inappropriate payments under the Part D program

The PPI MEDIC shall be required to produce reports to MA and Part D plan sponsors related to proactive data analysis, e.g. the high risk pharmacy assessment to assist the plan sponsor in its FWA efforts. These analytic activities shall include, but shall not be limited to: (a) Utilizing programming languages, software applications, algorithms, etc., to produce and manipulate data and datasets, and (b) Understanding the relevant data, and the ability to explain the impact that the data has on the Part C and Part D programs. The PPI MEDIC shall employ robust data analysis methodologies that aid CMS in the early detection of FWA in Part C and Part D. At CMS’ discretion, the PPI MEDIC shall educate and/or communicate to providers and/or plan sponsors about aberrant billing, prescribing, and other provider/supplier/pharmacy statistical practices related to the data analysis projects.

The PPI MEDIC shall also have access to Medicare Part C encounter data. This data will be integrated into all operations (audits, clinical reviews, Fraud Prevention Tool, proactive data analysis, and vulnerabilities). The PPI MEDIC shall use Part C encounter data to assist in reviewing the appropriateness of Part D payments by validating the diagnosis of MA-PD enrollees.

The PPI MEDIC shall provide input regarding the Data Analysis Projects and Models for the FWA Tracking Tool, which is hosted in HPMS.

The PPI MEDIC shall provide ad-hoc data analysis in a timely manner. CMS is frequently asked to provide prompt responses to Executive Branch inquires and Legislative Branch inquiries and requests. In addition, the PPI MEDIC shall provide prompt data analysis as directed by the COR in support of CMS’ participation in Office of Inspector General (OIG) and Government Accountability Office (GAO) entrance and exit conferences.

The PPI MEDIC shall generate proactive data analysis projects to further increase the payment recoveries and address issues, such as abusive prescribing and patient harm.

Additionally, the PPI MEDIC shall support reviews of medical information, such as procedure codes, diagnosis codes, drug compendia, and medical records.

To enhance the proactive data analysis work, additional third party sources may be needed to help bolster the work product. For example, this shall include Part D drug information from Wolters Kluwers (First Databank Part D Module) and Drug Enforcement Administration Registration information available from the National Technical Information Service.

CMS may need information on an ad hoc basis regarding the program integrity activities of Part D, and MA sponsors and/or their subcontractors. This may include raw data or specific ad hoc reports. The PPI MEDIC shall provide such information upon request.

As a result of data analysis, the PPI MEDIC shall develop and submit the following reports:

Drug Trend Analysis Report The PPI MEDIC shall develop a quarterly report that will analyze PDE records to detect sudden increases in specific drug utilization and total Medicare Part D drug spending for PDE records.

Outlier Prescriber of Schedule II Substance Report The PPI MEDIC shall create a quarterly report that scores individual prescribers across specialties and geographic areas for Schedule II controlled substances using High, Medium, and Low categories.

Pharmacy Risk Report The PPI MEDIC shall develop a fraud risk assessment of pharmacies using High, Medium, and Low categories based off of a data-analysis project the PPI MEDIC creates.

Pharmacy and Prescriber Spike Reports The PPI MEDIC shall develop a pharmacy and a prescriber spike analysis report to detect unusual billing trends of nationwide pharmacies and prescribers and identify pharmacies and prescribers with sudden increases.

Task 6: Audits

All audits, including approved audit topics and new audit ideas, shall contain at least:

• Audit strategy and timeline

• The data methodology

• The audit notice to the plans

• Tracking all communication with the plans (see Task 11 for additional details)

• Identifying the universes to be included in the audit

• Reviewing pre-validation samples and documentation submitted by the plans

• Conducting validation sample by reviewing the audit results submitted by the plans

• Preparing close out notice to the plans

• Conducting deletion checks of the PDEs identified as inappropriately paid by the plans

• Preparing an impact calculation on the results of the audit

• Preparing close out report

This SOW requires the contractor to develop and maintain a Secure File Transfer Protocol (SFTP) to use during the audit process.

6.1: Self-Audits

Self-audits are targeted audits that focus on crossover claims and other inappropriate Part D coverage concerns. As a result of data analysis, the PPI MEDIC shall identify inappropriate payments and when to initiate self-audits. The PPI MEDIC shall work with CMS to set the parameters (such as, audit review time period, PDE records, etc.) of the self-audit, then will notify the plan to conduct the self-audit. The plan shall be required to submit the self-audit results to the PPI MEDIC. CMS and the PPI MEDIC shall work together to validate the results of the self-audit. All new audit ideas shall be reviewed and approved by CMS prior to development. CMS shall provide the PPI MEDIC with existing and previously approved audit topics that shall be reused.

6.2: National Audits

A national audit occurs when a specific issue is identified across many plans. The PPI MEDIC shall identify such issues, through data analysis, and when a national audit is appropriate. The PPI MEDIC shall request the appropriate documents from plans and shall receive and review documentation.

6.3: Program Integrity (PI) Audits

CMS has oversight of MA organizations and PDP’s FWA efforts. The PPI MEDIC shall assist CMS in performing risk assessments to identify plans that may not have an effective FWA program. The PPI MEDIC shall accompany CMS to conduct onsite visits of plans to review documentation and/or systems related to the risk assessments, i.e. investigations, proactive data projects, and potential FWA complaints. The PPI MEDIC shall complete the audit as a desk review and prepare an audit report.

Task 7: Presentation Materials

The PPI MEDIC is required to develop and conduct presentations and provide presentation materials and Ad Hoc reports to CMS for training or informational purposes. The PPI MEDIC may, at times and with direction from the COR, need to travel to present these materials to LE, Part C or Part D plan sponsors, conferences or workgroups. If the PPI MEDIC is asked to develop a presentation or report, a draft shall be submitted to the COR or a member of the COR team for review at least ten (10) calendar days prior to the event. The PPI MEDIC is required to immediately notify the COR if submission of the draft presentation/report within ten (10) calendar days is not feasible. The COR reserves the right to waive the ten (10) calendar day requirement, if necessary. All presentations must be 508 compliant. The PPI MEDIC may also be requested to:

• Provide a speaker or panel of speakers

• Develop an agenda

• Draft notification letters for plan attendance

• Facilitate meetings

Task 8: Identifying Vulnerabilities

Program vulnerabilities are identified flaws or weaknesses in policy and/or regulatory authority that increases the likelihood of significantmay lead to inappropriate payments being made to plan sponsors. The PPI MEDIC shall inform CMS if a vulnerability is identified in Part C and Part D programs. The PPI MEDIC shall submit the Vulnerabilities Report, listing Part C and D vulnerabilities that the PPI MEDIC identified. The PPI MEDIC shall also address, to the extent possible, the scope of the vulnerability and extent to which the vulnerability jeopardizes and impacts the Medicare Part C and D program. The PPI MEDIC may also propose solutions to CMS as to the most effective and efficient ways to address the vulnerability. The PPI MEDIC shall follow the CMS Part C and Part D vulnerability protocol that will be provided to the PPI MEDIC by the COR.

Task 9: Peer to Peer Communication Reporting

The contractor shall create and manage a provider Peer Activity Report (PAR) project for the Medicare Part C and Part D programs to protect the Medicare Trust Fund from improper payments and potential FWA. The PARs will focus on selected topics, which are subject to change, to educate providers and is intended to examine utilization trends, patterns, and generate comparative data reports for healthcare providers to show how they compare against their peers using a given taxonomy and/or category. The methodology to be used may change during the development or implementation process.

The goal of PARs is to help CMS and its partners, plan sponsors and their first-tier, downstream, and related entities, analyze claims data (and other support/data the contractor has access to) for outliers and aberrant behavior. PARs compare a provider's prescribing or suppliers’ payment patterns for various drug categories, procedures, or services to their peers on a city, county, state, and national level. Different statistical analysis shall be developed in conjunction with CMS for final approval. This project shall: (a) serve to proactively educate providers about aberrant billing, prescribing, and other provider/supplier/pharmacy statistical practices; (b) act as a sentinel effect and FWA deterrent by making providers aware that their billing practices, trends, and patterns are being monitored; and (c) eventually expect to reduce unnecessary billings.

The analyses for any given PAR analysis shall be based on Medicare Part C encounter data or Part D PDE data (or any other access the contractor can use) and can cover multiple years at CMS’ discretion. PAR analysis shall be focused to a given provider/supplier type and taxonomy. Depending on the provider/supplier type and taxonomy, the focus of the PAR will be the range of drug categories, procedures, or services commonly used.

CMS and/or PPI MEDIC shall then communicate these PARs to the providers. This communication may include letters, emails, memos etc., created by CMS and the contractor. As with the methodology the content of these letters may need to be updated throughout the process of development and implementation of the PARs project.

The contractor shall develop and maintain a database of provider statistics. The Peer to Peer database comparison shall show the statistical comparisons of a provider’s or supplier’s patterns, including but not limited to billing, prescribing, referring, etc.

CMS will assist the contractor with the development of the database to be used, providing insight and guidance where necessary. CMS shall have final say on all system capabilities, outputs, access and reports.

In addition to developing the accessible database, the contractor shall be responsible for reports and maintaining a helpdesk to field calls from providers, suppliers, prescribers, and pharmacies about the contents of the database and the reports that the database produces.

In implementing this project, the contractor shall be responsible for producing reports. This effort involves the following high-level framework:

• Developing potential areas for study and maintaining an inventory of these areas for prioritization and risk assessment purposes.

• Producing Peer-to-Peer reports utilizing Medicare Part C (when accessible and usable) and Part D national data.

• Conducting and evolving statistical analyses or sampling to improve reports when warranted.

• Assisting with Medicare Part C and Part D general policy information, such as the Managed Care and Prescription Drug Manuals, and referrals to the appropriate plan sponsors/parent organizations.

• Generating and updating provider mailing lists.

• Disseminating the PARs upon request

Task 10: Plan Sponsor Alerts

Plan Sponsor Alerts are issued by CMS when trends have been identified that may have been associated with potential FWA of the Medicare Parts C and D programs.

The PPI MEDIC shall be responsible for drafting the alert based upon the trend identified and providing background information and data results to CMS related to the issue that will be identified in the Plan Sponsor Alert. CMS will review the draft Plan Sponsor Alert, and if approved, the Plan Sponsor Alert will be disseminated through CMS’ HPMS to the plans.

The PPI MEDIC will also be responsible for collecting, tracking, and responding to any inquiries that are received from plan sponsors as a result of the alerts.

Task 11: CMS Plan Correspondence Mailbox

CMS communicates with plans through notification letters or email correspondence. CMS established a Mailbox dedicated to Plan correspondence. Plans may submit email correspondence to the established CMS Mailbox if the plan has questions or inquiries. The PPI MEDIC will be granted access to the CMS Mailbox and shall monitor, compile and log all communication received through the CMS Plan correspondence Mailbox.

Task 12: RFIs

The PPI MEDIC shall respond to RFIs received from LE, such as the OIG, or the Department of Justice. The PPI MEDIC shall submit RFI Reports that log all RFIs received and reports the status of RFIs.

Task 13: Reporting

The PPI MEDIC shall be required to submit the following reports:

Annual Lessons Learned Reports The PPI MEDIC shall submit a Lessons Learned Report thirty (30) business days prior to the end of each period of performance.

Monthly Status Reports The PPI MEDIC shall submit a monthly status report by the 20th of each month, addressing the status of all activities from the previous month’s effort. The monthly status report shall also track and analyze the PPI MEDIC’s workload statistics such as data analysis, complaints, audits, RFI, administration, QA, IT systems and security, budget variance, issues identified and resolved, and upcoming events.

Monthly Cost Reports The PPI MEDIC shall submit a monthly cost report that details all costs incurred for the previous month. A cost report as well as the voucher shall be submitted electronically by the 20th of each month into CMS ARTS. The cost report, shall be broken down for subcontractors in the same manner as it is for the prime contractor – each task shall be broken down by individual (or individual position), hours, and costs per task. To the extent that this is not possible, the prime contractor shall discuss the content of the cost reports for their subcontractors with the COR and agree on a format for the deliverable.

Freedom of Information Act (FOIA) Reports The PPI MEDIC shall submit a Contractor Summary Sheet and FOIA log in accordance with the FOIA Policy and Procedural Guide to the CMS FOIA Coordinator (with copies going to the

COR).

Task 14: Meetings and Conferences

The PPI MEDIC shall be required to establish and facilitate bi-weekly meetings with the CMS COR, SMEs and BFLs to discuss workload, such as Data Analytics and Audits, to ensure open and consistent communication on all PPI MEDIC functions.

The PPI MEDIC shall be required to provide meeting agendas, draft meeting minutes during meetings, and provide other meeting materials as requested.

C. Personnel Requirements

Key Personnel

The PPI MEDIC shall maintain key personnel positions that are dedicated as Full Time Equivalents (FTEs), with the exception of the Medical Director position. Changes in key personnel positions shall be submitted to the Contracting Officer (CO) in writing for approval within thirty (30) days prior to any change.

When key personnel positions are vacated due to unforeseen circumstances, a proposed replacement shall be submitted in writing for approval no later than thirty (30) calendar days from the date the position was vacated. Interim replacements shall be approved by CMS and shall be in place from the time the position is vacated until a permanent replacement is identified. CMS may consider a sixty (60) day interim replacement until a permanent replacement is secured.

The key personnel noted below shall possess the following minimum work experience and educational requirements.

Program Director

The Program Director shall possess:

Work Experience A minimum of ten (10) or more years of professional experience with at least three (3) years as a manager responsible for managing complex systems and work flow. Extensive knowledge of the Medicare program including Medicare Parts C and D, regulations, manuals, guidance, and pharmaceutical industry.

Educational Requirements A minimum of a bachelor’s degree from an accredited institution.

Audit Manager

The Audit Manager must possess:

Work Experience A minimum of three (3) years’ management experience in the auditing field. Knowledge of Medicare program including Parts C and D, regulations, manuals, GAGAS, coverage and payment rules. Experience auditing pharmaceutical benefit managers preferred.

Educational Requirements Bachelor’s degree in accounting or equivalent from an accredited institution; Master’s Degree strongly preferred. Current Certified Public Accountant (CPA) license required.

Chief Statistician

The Chief Statistician shall possess:

Work Experience A minimum of three (3) years’ experience using statistics to support corporate/business information needs. Experience in statistical detection of fraud, development of mathematical models, neural networks, and data mining or other analytical methods.

Demonstrated experience and knowledge of health care information (health claims data, ICD-10- CM codes, physician specialty codes, pharmaceutical data including NCPDP file formats and codes, provider identifiers, etc.).

Educational Requirements A minimum of a master’s degree in statistics or related discipline from an accredited institution.

Pharmacy Specialist

The Pharmacy Specialist (PS) shall possess:

Work Experience Extensive knowledge of how prescription drugs are developed and managed. The PS must have a minimum of five (5) years’ experience in prescription drug benefit management, which must include a minimum of three (3) years’ experience managing a prescription drug formulary, medication therapy management, and drug interaction program. The PS shall have experience in the development of plans and the review of claims to ensure clinically appropriate utilization. This shall include experience in claims analysis, claims data review for abnormalities, auditing of claims, and setting up edits and audits to ensure proper utilization of benefits. The PS shall also have knowledge and experience concerning the current uses of medications, new or emerging issues, issues related to electronic prescribing, among other general knowledge and experience in the prescription drug benefits. A minimum of one (1) to two (2) years’ experience working in a retail pharmacy as a licensed pharmacist is strongly preferred.

Knowledge of and experience with the Medicare program including Parts C and D, regulations, manuals, coverage and payment rules.

Educational Requirements The PS must be a board certified pharmacist with a Doctorate of Pharmacy (Pharm.D) and trained in Biochemistry, Chemistry and Pharmacokinetics. Degree must be obtained from an accredited institution. Must be licensed to practice pharmacy in a state, territory of the United States, or the District of Columbia.

Medical Director

The Medical Director must possess:

Work Experience Prior work experience in the health insurance industry, a utilization review firm, or another health care claims processing organization in a role that involved developing coverage or medical necessity policies and guidelines.

Extensive knowledge of the Medicare program, particularly the coverage and payment rules.

Extensive knowledge of managed care policies and procedures.

Public relations experience such as working with physician groups, beneficiary organizations, and/or congressional offices is preferred.

Must have practiced medicine for at least three (3) years as a board-certified doctor of medicine or doctor of Osteopathic medicine.

Educational Requirements Must be a board-certified Doctor of Medicine or Doctor of Osteopathic medicine. Degree must be obtained from an accredited institution. The Medical Director must have been board certified for at least three (3) years. All clinicians employed or retained as consultants must also be currently licensed to practice medicine in at least one U.S. state, territory, or the District of Columbia. The contractor shall ensure that the Medical Director and other physician consultants have active valid and unrestricted licenses.

D. Section 508 Requirement

Section 508 language

All reports required herein shall be submitted in electronic format and shall be compliant with Section 508 of the Rehabilitation Act of 1973. Additional information about testing documents for Section 508 compliance, including guidance and specific checklists, by application, can be found at: http://www.hhs.gov/web/508/index.html under "Making Files Accessible."

The application of these standards on the final deliverable will ensure that any individual accessing the end work product derived from the result of an audit will be able to fully access the information therein. The contractor shall comply with all applicable aspects of the Rehabilitation Act, Section 508 Accessibility Standards:

1. 29 U.S.C. 794d (Rehabilitation Act as amended)

2. 36 CFR 1194 (508 Standards)

3. FAR 39.2 (Section 508)

4. CMS Standards, policies and procedures (Section 508)

III. QUALITY ASSURANCE

The PPI MEDIC must develop and maintain a QA program. The PPI MEDIC’s QA program must be designed to ensure and improve the quality of the PPI MEDIC’s work in its entirety.

The program must also ensure the timeliness of actions and responses to CMS. The PPI MEDIC QA program shall also include industry best practices, as appropriate.

Additionally, CMS will utilize a number of QA procedures to ensure the PPI MEDIC compliance with this contract. Examples include inspection of deliverables, review of reports, and onsite progress meetings, performance evaluations, etc. QA will be addressed in PPI MEDIC activities identified herein.

The PPI MEDIC shall maintain the highest degree of quality for all activities performed throughout the period of performance of the contract. CMS will evaluate the PPI MEDIC performance using measures including, but not limited to:

o Completeness and accuracy of data analysis;

o Completeness and accuracy of all program integrity audits;

o Completeness and accuracy of all deliverables; and o Completeness and accuracy of claim and PDE reviews.

Performance Metrics

The performance metrics that will be evaluated for the PPI MEDIC include:

Performance Metric Standard

Delivery of Accurate Data Exceptional: Greater than 95% of documents related to the audits, data projects, reports, and outreach and education submitted contained no major revisions (major revisions would be data reruns/revisions that impacts the agreed upon timeline) of data required after the initial submission of the documents (i.e. audits, data projects, reports, etc.).

Very Good: 90% - 94.9% of documents related to the audits, data projects, reports, and outreach and education submitted contained no major revisions (major revisions would be data reruns/revisions that impacts the agreed upon timeline) of data required after the initial submission of the documents (i.e.

audits, data projects, reports, etc.