CMS SSN 200680.docx

Sources Sought Notice 200680 HHS-Risk Adjustment Data Validation

THIS IS NOT A FORMAL REQUEST FOR QUOTE (RFQ) AND DOES NOT COMMIT THE CENTERS FOR MEDICARE & MEDICAID SERVICES (CMS) TO AWARD A CONTRACT NOW OR IN THE FUTURE

This is a SOURCES SOUGHT NOTICE (SSN) to determine the availability of small businesses on the GSA Professional Services Schedule (e.g., 8(a), service-disabled veteran owned small business, HUBZone small business, small disadvantaged business, veteran-owned small business, and women-owned small business) that have the capability to support CMS operations for the Risk Adjustment Data Validation program (authorized by the PPACA), called HHS-RADV, operated by CCIIO’s Payment Policy and Financial Management Group (PPFMG). This contract will be responsible for the Second Validation Audit (SVA) and related activities as part of the HHS-RADV program.

A. Background

On March 23, 2010, the President signed into law the Patient Protection and Affordable Care Act (P.L. 111-148). On March 30, 2010, the Health Care and Education Reconciliation Act of 2010 (P.L. 111-152) was signed into law. The two laws are collectively referred to as the Affordable Care Act or the PPACA. The Department of Health and Human Services (HHS) Centers for Medicare & Medicaid Services (CMS) is responsible for the management and oversight of large portions of the PPACA. The PPACA assists millions of Americans in obtaining affordable health care services and allows more employers to offer insurance coverage in a cost effective manner to their employees. The Center for Consumer Information and Insurance Oversight (CCIIO) was created to oversee significant components of the PPACA and in this role promulgated regulations for the establishment and practices of Health Insurance Exchanges and premium stabilization programs, financial programs and various market reforms established by the PPACA.

Risk adjustment is a permanent program created by Section 1343 of the PPACA and applies to all non-grandfathered, individual and small group issuers both inside and outside of the Exchange. The primary goal of the risk adjustment program is to spread the financial risk borne by health insurance issuers. This helps ensure that premiums remain stable and that issuers are able to offer a variety of plans to meet the needs of a diverse population. The risk adjustment program intends to provide payments to health insurance issuers that attract higher risk populations by transferring funds from plans that enroll the lower risk individuals to plans that enroll the higher risk individuals.

CMS developed a risk adjustment methodology, to be used when CMS operates risk adjustment on behalf of a State[footnoteRef:2], to determine average actuarial risk of risk adjustment covered plans in that State. Utilizing this risk adjustment methodology, CMS calculates individual enrollees’ risk scores and determines the average actuarial risk of a plan. CMS calculates corresponding charges and payments upon comparison of plan average actuarial risk to the State average actuarial risk. Extensive reporting and analytics are produced as part of normal operations as well as for ad-hoc reporting and analysis. The calculations and transfers of funds for the risk adjustment program are performed annually after the end of each benefit year, with results for the prior year reported to issuers by June 30th. [2: HHS currently operates risk adjustment for all states and the District of Columbia.]

CMS utilizes the External Data Gathering Environment (EDGE) to collect data required to operationalize the risk adjustment program. All issuers of risk adjustment covered plans are required to establish an EDGE server for the data submission of enrollment and claims data for the risk adjustment program.

PPFMG operates multiple audit programs to ensure compliance with the rules and regulations of each of its program. These audit programs are one important component of the overall PPFMG program integrity framework. One of these programs is the Risk Adjustment Data Validation program. This Sources Sought Notice is seeking to determine capabilities of potential CMS contractors to support the Second Validation Audit (SVA) and related activities as part of the HHS-RADV program.

The purpose of the HHS risk adjustment data validation (HHS-RADV) audit is to promote confidence in the budget neutral payment transfer risk adjustment methodology by ensuring the integrity and quality of data provided by issuers in state market risk pools where HHS operates the risk adjustment program.

In the 2014 final Payment Notice, HHS defines a six-stage data validation program when operating risk adjustment on behalf of a state. The six stages are:

· Sample Selection;

· Initial Validation Audit (IVA);

· Second Validation Audit (SVA);

· Error Estimation;

· Appeals; and

· Payment Adjustments.

CMS requires issuers to hire an independent auditor (IVA Entity) to conduct the initial validation audit on a sample of enrollees’ risk adjustment data. The initial validation audit includes enrollment & demographic validation, claims validation, prescriptions drug category (RXC) validation, and health status validation via medical record review and diagnosis abstraction. CMS requires that issuers provide these audit entities with all source system information required to validate risk adjustment data accuracy. The IVA entities are required to conduct the initial data validation process, in accordance with CMS-established requirements, to verify the accuracy of issuer-submitted risk adjustment data.

CMS contracts with the second validation audit entity (SVA Entity) to conduct a second level review and oversight of the findings from the IVA process. The goals of the second validation audit are to confirm compliance with risk adjustment program and audit requirements, verify audit findings, and compute an estimate of issuer-level error in accordance with CMS requirements. These HHS-RADV determined issuer-level error rates are then used to adjust issuers’ plan liability risk scores used in risk adjustment transfer calculations.

HHS conducted two pilot years of HHS-RADV for the 2015 and 2016 benefit years to give HHS and issuers experience with how the audits would be conducted prior to applying HHS-RADV results to adjust issuers’ risk scores and risk adjustment transfers in the applicable state market risk pool. The 2017 benefit year HHS-RADV was the first non-pilot year, and resulted in adjustments to issuers’ risk scores and risk adjustment transfers as a result of HHS-RADV findings. The Summary Report of 2017 Benefit Year HHS-RADV Adjustments to Risk Adjustment Transfers released on August 1, 2019 is available at:

https://www.cms.gov/CCIIO/Programs-and-Initiatives/Premium-Stabilization-Programs/Downloads/BY2017-HHSRADV-Adjustments-to-RA-Transfers-Summary-Report.pdf

HHS-RADV is a six step process. The first step in the HHS-RADV process is the selection of a sample of an issuer's enrollees whose risk adjustment data from the EDGE server will be validated by the IVA Entity. For the audit, HHS applies a sampling methodology to choose a statistically valid sample of enrollees based on the enrollee-level risk score distributions for each issuer. HHS designed the sampling methodology to ensure that the sample covers critical subpopulations of enrollees for each issuer by dividing each issuer’s population into 10 strata, representing different age and risk score bands, and sampling from each stratum. Based on sample size precision analyses and calculations using proxy error rate data from the MA-RADV program, issuers of sufficient size currently have a sample size of 200 enrollees across all state market risk pools and risk adjustment covered plans. The second step of the HHS-RADV process is the IVA. The issuer must ensure that its selected IVA Entity is reasonably capable of performing this task, and is reasonably free of conflicts of interest, and is therefore able to conduct the IVA in an impartial manner. HHS expects issuers to ensure that the IVA is conducted in the following manner:

· The issuer provides the IVA Entity with demographics and enrollment documentation, medical and pharmacy claims data for risk adjustment drug categories (RXCs) validation, and medical record documentation to validate issuer-submitted risk adjustment data for each enrollee in the sample The issuer and IVA Entity determine a timeline and information transfer methodology that satisfies data security and privacy requirements and enables the IVA Entity to meet HHS-established timelines; and

· The IVA Entity validates the data of each enrollee in the sample in accordance with the standards established by HHS.

Once these steps are completed, the IVA Entity provides HHS with the final results from the IVA and all requested information for HHS to complete the SVA.

Under the third step of HHS-RADV, HHS retains an SVA Entity to conduct the SVA to verify the accuracy of the findings of the IVA. HHS selects a subsample of the IVA sample of enrollees for review. When the SVA Entity performs the data validation audit of the enrollee subsample, the SVA Entity adheres to the same audit standards applicable to the IVA, but only reviews enrollee information that was submitted to HHS at the conclusion of the IVA by the issuer and the IVA Entity.

HHS selects a subsample of enrollees for the SVA Entity review using a sampling methodology that allows for pairwise means testing to detect any statistical difference between the IVA and SVA results. If the pairwise means test results suggest that the difference in enrollee results between the IVA and SVA is not statistically significant, HHS uses the IVA results for error estimation and calculation of adjustments to the issuer’s PLRS (and subsequently risk adjustment payments and charges), if the issuer is determined to be an outlier. If the pairwise means test results suggest a statistical difference based on the initial SVA sample, the SVA Entity would perform another validation audit on a larger subsample of the enrollees previously subject to the IVA. HHS then repeats pairwise means testing. If a statistical difference is still found between the IVA and the SVA of the larger subsample, the SVA sample is expanded to larger subsample sizes with pairwise means testing repeated for each such expansion until the full SVA subsample of 100 enrollees is reviewed. If a statistical difference is still found between the IVA and the expanded SVA sample(s) (up to 100 enrollees), HHS will use the SVA results rather than the IVA results for error estimation and calculation of adjustments to the issuer’s PLRS, (and subsequently risk adjustment payments and charges), if the issuer is determined to be an outlier.

The fourth step in the HHS-RADV process is error estimation. Using the relevant validation audit data determined in the prior step (i.e., either the IVA or SVA findings, as applicable), HHS derives issuer-level failure rates for each HCC. The HCC failure rate represents the rate at which the EDGE HCC cannot be validated during the HHS-RADV process. Then, HHS aggregates all issuers’ failure rates and creates HCC groupings, national means, and 95 percent confidence intervals at 1.96 standard deviations for that benefit year of HHS-RADV. Under this process, each HCC used in the risk adjustment program for that benefit year is organized into three HCC groupings, high, medium and low, based on the individual HCC’s failure rate across all participating issuers’ HHS-RADV results. The aggregated failure rates from each of these HCC groupings are then used to create the national means and confidence intervals for each HCC group. These national means and confidence intervals determine whether an issuer is an outlier for an HCC grouping. If an issuer’s HCC group failure rate is outside the national confidence intervals in any of three HCC groupings (low, medium, or high groupings), the issuer is determined to be an outlier. If the issuer is an outlier, its failure rates are used to calculate its error rate, which adjusts its risk score to reflect the inaccuracy of the risk score calculated during risk adjustment. If the issuer is not an outlier, the issuer is determined to have a zero error rate result for HHS-RADV for that benefit year and its risk score remains unadjusted. Later in this SSN, we describe the error estimation process in more detail.

The fifth step of HHS-RADV is the discrepancy and administrative appeals processes. There are three annual discrepancy processes – IVA sample, SVA findings and calculation of the risk score error rate. An issuer is required to confirm the information provided by HHS or file a discrepancy within a certain number of days of notification by HHS of certain HHS-RADV results. The appeal process applies to the findings of the SVA (if applicable), and the calculation of the risk score error rate.

The sixth and final step of HHS-RADV is adjusting risk adjustment transfer amounts to reflect the level of inaccuracy determined in the fourth step of error estimation. Except for exiting issuers, when an issuer is identified as an outlier, the issuer’s error rate is used to amend the issuer’s subsequent benefit year risk score that is used to calculate their risk adjustment transfer on a prospective basis, e.g. 2017 benefit year HHS-RADV results amended 2018 benefit year risk adjustment risk scores and 2018 benefit year risk adjustment transfers. Because risk adjustment is budget neutral, a change in risk score for one issuer in a state market risk pool affects the state-wide average risk score for that state market risk pool, impacting all other issuers in the state market risk pool. These changes in risk scores are then applied to adjust risk adjustment transfers for the applicable state market risk pool, and the adjustments are collected and distributed two years later.

HHS Risk Adjustment Data Validation (HHS-RADV) Timeline

The HHS-RADV process for a benefit year typically begins with developing an audit sample in the first quarter of calendar year following the close of the benefit year being audited, then proceeds with issuers performing an Initial Validation Audit (IVA) over the course of that year and submitting results by January of the following year, at which point the Contractor begins the Secondary Validation Audit (SVA). CMS publishes risk adjustment results in May for the year that has just concluded (for the year subsequent to the year being audited), and then publishes the transfer impact of HHS-RADV on those risk adjustment results in August. For example, for 2017 HHS-RADV, the Contractor performed the SVA in early 2019 and CMS published the error rates on May 31, 2019 and transfer impact results on August 1, 2019, which showed how the results of 2017 HHS-RADV would impact 2018 risk adjustment transfers.

The HHS-RADV cycle over a calendar year involves two benefit years of audit processes, in that, while the SVA is conducting the HCC failure rate and error estimation process, they are also performing analysis on issuer enrollee samples for the upcoming benefit year audit.

For the purposes of performing HHS-RADV, there are approximately 500 HIOS IDs that will be required to participate within the annual benefit year audit. This number reflects an estimation based on the annual exemptions that are applied based on CMS policy guidance. This total amount of participants may fluctuate slightly over this contract depending on regulatory or policy changes.

B. Required Knowledge, Experience and Capabilities

Each response should include examples that combine required knowledge, experience and capabilities to execute program operations. The response should also include how the firm/team can handle the volume of audits indicated below and the schedule reflected above. A mere statement that the vendor has a required capability is not sufficient. The required elements are listed below.

· Extensive knowledge and experience in the PPACA and Exchanges, commercial individual and small group health insurance markets, Medicaid, and other relevant insurance programs in States across the country;

· Extensive knowledge of health insurance issuer operations in relation to CMS and PPACA operations with preferred knowledge of Risk Adjustment and RADV operations;

· Knowledge of applicable audit standards including but not limited to: Generally Accepted Government Auditing Standards (GAGAS), the GAO yellow book, National Association of Insurance Commissioners (NAIC), and other applicable standards that govern financial and government audits;

· Extensive knowledge of PPACA Risk Adjustment and HHS-RADV, including knowledge of the associated regulations and guidance documents applicability to the PPACA Risk Adjustment and HHS-RADV and historical knowledge of PPACA Risk Adjustment models changes and the evolution of HHS-RADV

· Expert knowledge of health insurance claims, ICD-10, and medical coding specific to risk adjustment both inpatient and outpatient

· Demonstrated knowledge and experience utilizing a variety of techniques to manipulate and analyze large data sets, including detecting duplicates, patterns, and urgent issues through data analyses;

· Knowledge of appeals processes and analysis of data assessments that may result in audit findings

· Knowledge of a variety of statistical methods and the ability to quickly design, build and test models using those methods and build the associated programming to automate those statistical methods within the current audit processes

· Knowledge of applicable federal law and regulations involved with the handling of PHI/PII and IT security standards such as The Federal Information Security Management Act of 2002.

· A proven track record of keeping to a schedule managing multiple tasks, including audits of over 500 health insurance issuers under tight schedule constraints and experience with writing with internal procedural documents like standard operating procedure on a timely basis.

· Producing public facing communications and experience providing education and technical support to educate stakeholders and respond to stakeholder questions.

C. Capability Statement Requirements

CMS requests that the respondent specifically address the requirements listed above. Respondents should provide enough information for CMS to make an informed determination of their capability to perform the work as identified above. Please remember that the potential offeror or prime contractor must be able to perform at least 50% of the labor associated with this effort. Please provide a list of contract numbers that your organization has had (if applicable) and your role on the contract (prime contractor or subcontractor). If you were a subcontractor on a particular contract, please clarify the work that you did on that contract.

Teaming Arrangements

Firms seeking to respond to this notice as a team or to rely on subcontractors to perform any portion of the work must include the above-requested information and certifications for each entity on the proposed team or each proposed subcontractor. Responses must clearly indicate the nature of the teaming arrangement.

The contractor and any subcontractors must not have any relationships or arrangements through business operations or its employees that could be considered as possibly lessening the company’s objectivity concerning any aspect of the proposed tasks. If such relationships or arrangements exist, contractors or subcontractors shall be required, during the procurement process (if one occurs), to identify potential conflicts of interest and discuss how the conflicts will be addressed and mitigated.

Given its role as the SVA entity, as a condition of receiving this award, the Contractor shall not serve as an IVA entity for any issuer under the HHS-operated risk adjustment program during the period of performance for this task order. Furthermore, the SVA entity may not support any risk adjustment (RA) work that may require engagement surrounding data collection. Any Offeror must disclose any work done within 3 years related to PPACA Risk Adjustment for health insurance issuers. The Offeror must articulate a process by which firewalls are created and maintained to avoid any COI under FAR 9.5. CMS will require submission of a conflict of interest attestation stating they will adhere to the above assumptions, and will not work as an IVA entity for any issuer subject to HHS-RADV as part of this procurement. This COI attestation will be submitted at the execution of subsequent option years.

D. Instructions for Submitting Responses to CMS

The following specific information is requested: (a) company descriptive literature; (b) specific related corporate experience; (c) experience with the type of capability expectations mentioned above; (d) references, to include points of contact, email addresses, and phone numbers; and (e) Business information outlined below.

a. DUNS

b. Company Name

c. Company Address

d. Validation of small business status under NAICS Code 541211- (size standard of $22 million)

e. Current GSA Schedules appropriate to this Sources Sought Notice

Please limit your documentation to the following Page Size, Font Type and Size, Spacing and Page Numbering. Responses shall be submitted using a Microsoft Word document with page size 8.5 by 11 inches. Font type shall be Times New Roman, size 10-12 using standard tabs and indent software features with no less than single spacing between lines. Responses are limited to no more than eight (8) pages for the entire capability statement. Cover Page is not included in the total page count.

All transmitted information marked proprietary shall be treated as such. Therefore, businesses should identify any proprietary information in their responses. Proprietary materials will neither be distributed, nor discussed with, any other organization. Information submitted in response to this will be used at the discretion of the Government. Further, the information submitted will remain confidential insofar as permitted by law, including the Freedom of Information and Privacy Acts.

Respondents should be aware that this SSN is for marketing purposes only and any responses thereto, or lack thereof, will not constitute a commitment by CMS to treat any potential offeror more or less favorably in an anticipated forthcoming solicitation and/or ultimate award. Please be advised that CMS will not respond directly to organizations submitting information in response to this SSN.

All capability statements can be submitted via e-mail to Benjamin Stidham at benjamin.stidham@cms.hhs.gov and Malissa Shin at malissa.shin@cms.hhs.gov. Responses must be submitted no later than 11:00 am EST on March 4, 2020.