CPIC SOW 12.12.24_DRAFT SOW.docx

Part C Program Integrity Contractor (CPIC)

STATEMENT OF WORK

Table of Contents

4 PI Support Request ………………………………………………………………………………………………. 16

5 CMS Systems and Data Support ………………………………………………………………………………….. 18

Scope The Part C Program Integrity Contractor (CPIC), acting as an independent contractor and not as an agent of the government, shall perform fraud, waste, and abuse (FWA) detection, deterrence, and prevention activities for Medicare Part C. The CPIC shall furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the government, as needed to perform the work described in this Statement of Work (SOW). The CPIC’s work includes data analyses, audits and reviews of Medicare Advantage Organizations (MAOs) (including Medicare Advantage Prescription Drug (MA-PD) plans), outreach and education, and referrals to law enforcement and other appropriate entities. The CPIC shall coordinate with staff from the Centers for Medicare & Medicaid Services (CMS), other CMS contractors, and other stakeholders as needed and as directed by the CMS Contracting Officer’s Representative (COR), in collaboration with Business Function Leads (BFL), to perform this program integrity work.

Purpose of this Contractor The purpose of the CPIC is to provide oversight of the Medicare Part C program. The CPIC shall perform FWA detection and prevention activities to proactively deter FWA in Medicare Part C. The CPIC shall perform their responsibilities under the direction of CMS. The CPIC shall develop and conduct data analysis and audits thoroughly and in a timely manner and take immediate action to ensure that the Medicare Trust Fund is protected. The CPIC shall use or interact with CMS-required systems as needed in the performance of its functions. Further, the CPIC shall coordinate its activities not only with CMS, but also with agencies at the federal, state, and local levels of government as well as other CMS partners and contractors.

Background CMS has traditionally used the Plan Program Integrity Medicare Drug Integrity Contractor (PPI-MEDIC) for Medicare Part C and D plan oversight, including audits, outreach and education, and data analysis. The CPIC will perform the Part C audits, outreach and education, and data analysis work previously performed by the PPI-MEDIC. Another contract, the Medicare Drug Integrity Contractor (MEDIC), will perform the Part D audits, outreach and education, and data analysis work.

Statutes, Regulations, and Documents The CPIC shall perform the requirements of this contract in accordance with applicable federal laws, regulations, Medicare Internet-Only Manuals (Pub. #100-08; #100-16; #100-18), and CMS requirement documents to assure the integrity of the Medicare Part C program. The following is a non-exhaustive list of the applicable documents:

For purposes of this contract, the CPIC shall immediately contact the COR and/or the Contracting Officer (CO) if discrepancies are identified among these sources. The CPIC shall identify any budgetary concerns that may occur as a result of any conflict. Moreover, in accordance with CMS policy, the Contractor cannot assert clinical review judgment to override, supersede, or disregard a Medicare policy requirement.

Performance Constraints

1.4.1 Record Retention - General Requirements

The CPIC shall establish and maintain a continuing program for the economical and efficient management of records. The CPIC’s records management program must provide for:

Effective controls over the creation, organization, maintenance, use, and disposition of all the CMS health insurance claims and non-claims records.

Development and application of standards, procedures, and techniques designed to ensure the maintenance and security of records of continuing value, and to facilitate the segregation and disposal of all records of temporary value. The CPIC should (1) provide for the continued analysis and improvement of record classification and indexing systems, the use of filing equipment and supplies, and the reproduction and transportation of records, and (2) ensure that records are maintained economically and efficiently for maximum usefulness.

Physically safeguarding identifiable personal information (Privacy Act (PA)) and protected health information (Health Insurance Portability and Accountability Act of 1996 (HIPAA)).

Storage and servicing of records in a safe and secure environment that meets the requirements outlined in 36 FR 1228.222.

The files established by the CPIC should be available for periodic review by CMS. In addition, all records and procedures documenting the CPIC’s programs for controlling the creation, maintenance, and use of current records, for the selective retention of records of continuing value, and for the disposal of non-current records, should be available for periodic review by CMS.

Definition of Files Files are papers, folders of papers, photographs, photographic copies, magnetic tapes, or other recorded information regardless of physical form or characteristics, accumulated or maintained in filing equipment, boxes, or shelves, and occupying office or storage space. Stocks of publications and blank forms are not included in this definition.

Implementing Files Management and Retention Protocols Adequate records management controls over the creation of CPIC files must ensure that important policies and decisions are adequately recorded, routine operational paperwork is kept to a minimum, and the accumulation of unnecessary files is prevented. Effective techniques in this area include the application of systems for the control of correspondence and forms, the minimizing of duplicate files, and the disposal without filing of transitory material that has no value for record purposes.

The following actions are generally basic to such a files management program, which the CPIC is expected to establish.

· Standardize classification and filing schemes to:

· Achieve maximum uniformity and ease in maintaining and using program records

· Facilitate disposal of records in accordance with applicable records disposal schedules

· Facilitate possible later consolidation of identical type files presently maintained at different locations

· Formally authorized official file locations. Prohibit the maintenance of files at unauthorized locations.

· Standardize reference service procedures to facilitate the finding charge out, and refiling of records.

· Establish and implement standards and procedures issued by CMS for:

· Classifying, indexing, and filing records

· Providing reference services to filed records

· Locating active files to facilitate use of the records

· Reviewing the program periodically to determine the adequacy of the system and its effectiveness in meeting requests

· Ensure that the standards, guides, and instructions developed for the files management program are readily available to all employees concerned with the files operations. In addition, pertinent information for users of files and reference services should be given the widest possible dissemination.

· File accumulations of papers received at file locations on a daily basis.

· Audit periodically a representative sample of the files for duplications, misclassification, or misfiles.

· Establish and maintain a separately identified process to log all cases/files for which CMS/OGC has issued a Litigation Hold. This log shall include at a minimum, documentation of the date received and the status of the litigation hold; current, revised, and/or lifted. Litigation Holds remain in effect until expressly advised by CMS/OGC that it has been lifted. The CPIC shall submit verification by submitting a copy of the log and an attestation statement/document that the Litigation Hold log is current and accurate to the COR in accordance with the Deliverables Schedule.

The methods used in maintaining, using, and disposing of these files vary with the CPIC. These methods depend on the filing and control methods established (e.g., health insurance claim number, date, name, or other sequence) to record requests from beneficiaries and others; to furnish replies; to check on overdue cases; to control cases for completion of processing; to control cases requiring some type of investigation or additional documentation; to retain completed cases for history or other reference; to maintain records for audits; to preserve and maintain documents, records, data, or files pertaining to Litigation Hold requests; and to schedule records for transfer to other storage areas. Other variances may be due to computer or clerical practices, workload volume, and other considerations.

The obligation to preserve documents shall be ongoing. Accordingly, should managers/supervisors become aware of employee or contractor transitions, they shall assess whether those changes involve document custodians for this matter, and if so, the name(s) of the transitioning employee(s) or contractor(s) should be shared with OGC:

1. Employee Departures: Special care should be taken to ensure that potentially relevant ESI (including the e-mails) of former employees and employees who are departing or scheduled to depart, is preserved, and not deleted. If a departed employee was a document custodian of potentially responsive information, (1) please list the departed custodian’s name and (2) date of departure on the component’s litigation hold certification form (following consultation as needed with your component executive officer or business operations staff).

2. Contract Transitions (if applicable): If a contract is ending or documents are being transitioned from one contractor to another, special care should be taken to ensure responsive information is preserved. The contractor that takes possession of the responsive information must receive this litigation hold notice and any supplemental preservation instructions and should be identified to the lead OGC attorney.

3. Additions: New or additional employees or contractors who generate or possess responsive information should also receive this litigation hold notice and any supplemental preservation instructions and should be identified to OGC.

Scanning and Imaging of Files Material The CPIC shall refer to IOM Pub. 100-08 for file & document retention requirements. The CPIC is authorized to scan/image files material such as computer printouts, canceled checks, and financial records. If the CPIC obtains an original source document, they are permitted to transfer an accumulation of these documents to the UCM system after scanning/imaging and verification of the quality and completeness of the file(s). If the UCM is not an available option for storage of certain documents, the CPIC shall store the documents in their contractor legacy tracking system and/or contractor hard drive(s). Once scanning/imaging and verification of the quality and completeness of the file(s) are completed, the CPIC is authorized to discard the physical file(s). When scanning material, the CPIC shall follow the procedures below. For microfilm, the CPIC shall follow parallel procedures to scanning. The CPIC shall ensure the integrity of imaged documents with appropriate procedures to scan, index, retrieve, and read or access documents for the life of the record.

Scanning Procedures A contractor who scans/images paper records:

· Must always be able to demonstrate the imaged version is an exact copy of the paper document,

· Document the steps taken to image the original document,

· Establish and implement a certification/quality assurance process to ensure the imaged information is an identical replication of the paper document in every way,

· Retain the scanned image as the “recordkeeping copy” for the required retention period, and

· Maintain accessibility and the ability to read documents in accordance with changes in technology.

The methods used in imaging files may vary with the contractor. These variations depend on the type of equipment used and methods used to prepare documents for imaging. All scanned/imaged documents shall be tampering proof. Once a scan/image is verified as an exact copy of the original paper document, only then can the original paper document be destroyed, and the scanned/imaged copy is certified as the “recordkeeping copy.”

Certifying images as an exact copy of the paper document means there is a quality assurance process in place that verifies that the images are legible. Each contractor is responsible for establishing their own quality assurance procedures. Below is an example of a quality assurance process.

Standard Procedures for Document Imaging Quality Assurance

The staff member(s) performing the actual scan will:

· Observe that all pages successfully pass through scanner and that image displayed on the imaging software preview screen appear accurate.

· Affix a sticker marked “Scanned” to the top page, write the current date on the sticker and place on top of a pile of scanned material.

The staff member(s) responsible for these records will have immediate access to the images, from their desktops, using the imaging software. They will have 30 days to use and review the images. If any problem is detected, the paper will be retrieved and rescanned. After 30 days, the paper copies are subject to proper disposal.

Retention of Records

Records the CPIC Shall Retain for 10 Years

The CPIC shall retain the following records for 10 years:

Cost Reports and Administrative Budget Estimates - Form 1524 and attachments, contractor’s initial budget requests, supplemental budget requests, notice of budget approvals, interim expenditure reports, final administrative cost proposals, supporting schedules correspondence, and audit reports.

Program Integrity (PI) Documentation & Files – Files/documents shall be retained for 10 years. However, files/documents shall be retained indefinitely and shall not be destroyed if they relate to a current investigation or litigation/negotiation. This will satisfy evidentiary needs and discovery obligations critical to the agency’s litigation interests.

All documentation the CPIC solicits from plan sponsors and first tier, downstream or related entities - The CPIC shall retain a copy of all documentation submitted after claims submission for 10 years.

Destruction of Records The CPIC is required to retain all records for 10 years. Records that are not under active litigation or negotiation shall be destroyed 10 years after the claim is submitted and is cut off annually. The CPIC is authorized to return records or certify destruction of documents after 10 years. Files that need to be returned to CMS will need to be coordinated with the COR and Records Retention office.

Tasks The CPIC shall perform a range of FWA proactive data analysis of Medicare data to support oversight of MAOs. The CPIC shall analyze the applicable data, including data from multiple health care databases that are both internal and external to CMS, when performing their work. While awaiting data sources that may not be fully available, the CPIC shall collaborate with CMS to determine innovative approaches so the most complete and accurate data becomes available to perform data analysis work in pursuit of strong program integrity. This requirement applies to all the following tasks.

Program Integrity (PI) Audits MAOs shall adopt and implement an effective compliance program, which shall include measures that prevent, detect, and correct FWA in accordance with 42 CFR § 422.503. The CPIC shall develop and conduct audits of MAOs to ensure they are complying with statute, federal regulatory and sub-regulatory guidance regarding their FWA efforts and appropriately identifying and responding to program integrity risks. At CMS’s discretion, the CPIC shall address program integrity risks identified by CMS using PI Audits.

The CPIC shall assist CMS in conducting risk assessments to identify plans that may not have an effective FWA program. The CPIC shall coordinate with various entities throughout the course of an audit in an effort to obtain relevant information. When applicable, the CPIC shall coordinate its auditing efforts with other entities, such as the MEDIC. The CPIC shall develop and update as necessary an audit plan for each audit. The plan shall include the audit methodology and timeline necessary to meet approved audit objectives. The CPIC, as directed by CMS, shall accompany CMS to conduct virtual and onsite audits of plans to review documentation and systems related to the risk assessments. This may include reviewing documentation, systems, and procedures related to investigations, proactive data projects, potential FWA complaints, requests for information (RFIs), referrals, and effective compliance with reporting requirements for the Health Plan Management System (HPMS) PI Portal. The CPIC shall complete the audit and prepare an audit report including the findings, observations, and promising practices identified during the audit, recommendations to plan sponsors , and recommendations to CMS for enhanced regulatory requirements to address deficiencies that could not be addressed during the audit. The CPIC shall conduct post-audit activities to ensure continual improvement for the PI Audits process (e.g., lessons learned, etc.) and provide a report regarding lessons learned to CMS.

Reports At CMS’s direction, the CPIC shall be required to produce data analytics reports to MAOs to assist plan sponsors in their FWA efforts. These reports shall educate plan sponsors about aberrant billing and other information related to the data analysis projects. Proactive data analysis reports can include such topics as utilization trends for certain high-risk items and services and lists of outlier providers. These reports shall include detailed data in table and figure form, long-form descriptions of what the data is showing, a discussion of whether these trends may relate to larger industry developments (e.g., new technologies, medical equipment, or drugs), and instructions for appropriate use of the data by the MAO.

Peer Activity Reports (PARs) At CMS’s direction, the CPIC shall be required to produce PARs. PARs compare a plan sponsor/provider/supplier’s utilization trends and payment patterns for various procedures or services to their peers on a city, county, state, and national level. The goal of PARs is to help CMS, plan sponsors, and other related entities analyze claims and other data related to outliers and other aberrant behavior and to educate the identified outliers on these patterns. The CPIC shall develop potential areas for study and maintain an inventory of these areas for prioritization and risk assessment purposes. The CPIC shall develop PAR plans, including PAR topics, statistical methodologies, study timeframes, a communication plan, and evaluation methodologies. PAR topics and methodology are subject to change at CMS’ discretion. PAR analyses shall be based on Medicare Part C encounter data or other data the contractor may have access to. The CPIC shall communicate PAR results to plan sponsors/providers/suppliers. This communication may include letters, emails, memos etc., created by CMS and the CPIC. The CPIC shall be responsible for responding to questions from plan sponsors, providers and suppliers about the PARs. When applicable, the CPIC shall coordinate its auditing efforts with other entities, such as the MEDIC.

Plan Sponsor Alerts Plan Sponsor Alerts (PSAs) are issued by CMS to plan sponsors when trends have been identified that may be associated with FWA of the Medicare Parts C and D programs. The CPIC shall identify topics for PSAs based on its work. CMS may, at its discretion, identify topics for PSAs as well. When the CPIC or CMS identifies an appropriate topic for a PSA, the CPIC shall provide CMS with a PSA plan, including a description of the issue identified; supporting information, such as data analyses; and timeframes for drafting and issuing the PSA. If a PSA plan is approved, the CPIC shall draft the PSA and submit it to CMS for approval and dissemination. The CPIC shall be responsible for collecting, tracking, and responding to any inquiries from plan sponsors as a result of PSAs. When applicable, the CPIC shall coordinate its auditing efforts with other entities, such as the MEDIC.

Plan Sponsor Targeted Compliance Notifications Plan Sponsor Targeted Compliance Notifications (TCNs) are issued by CMS to plan sponsors whose audit results are indicative of noncompliance to CMS-issued guidance. The CPIC shall identify topics for TCNs based on its work. CMS may, at its discretion, identify topics for TCNs as well. When the CPIC or CMS identifies an appropriate topic for a TCN, the CPIC shall provide CMS with a TCN plan, including a description of the issue identified; supporting information, such as audit results; and timeframes for drafting and issuing the TCN. If a TCN plan is approved, the CPIC shall draft the TCN, submit it to CMS for approval, and if approved, the CPIC shall disseminate the TCN through the Payment Recovery Information System (PRIS) Medicare Part C & D Plan Portal (PMPP) to the plans. The CPIC shall be responsible for collecting, tracking, and responding to any inquiries from plan sponsors as a result of TCNs.

CMS Part C Plan Correspondence Mailbox CMS communicates with plans through notification letters or email correspondence. CMS established a Part C Plan Correspondence Mailbox for email inquiries from plans. The CPIC will be granted access to the Part C Plan Correspondence Mailbox and shall monitor, compile, and log all communication received through the Part C Plan Correspondence Mailbox. The CPIC shall propose responses to questions from plans and disseminate responses after they have been approved by CMS. The CPIC shall coordinate with the MEDIC as appropriate to ensure any Part D-related communications are appropriately processed.

Risk Adjustment Payment Oversight The Health and Human Services Office of Inspector General (HHS-OIG) conducts audits on High-Risk Diagnosis Codes on certain MAO contracts. CMS monitors plan sponsors’ implementation of recommendations on these reports (see ). The HHS-OIG also conducts evaluations to examine the MAOs use of chart reviews and health risk assessments in risk adjustment. The contractor shall develop a strategy to include processes and procedures to assess MAO compliance with OIG audit and evaluation recommendations. Additionally, the contractor shall ensure the MAOs have taken the appropriate steps (e.g. audits and desk review) to close the OIG recommendations and develop standard correspondence with the identified MAOs to document CMS approved findings and conclusions. The CPIC may also be required, at the direction of CMS, to conduct additional audits or other oversight activities of Medicare Part C plan sponsors that are identified as at high-risk of risk adjustment overpayments.

RESERVED

Audits The CPIC shall create and manage a project to conduct Self-Audits for the Medicare Part C program. The CPIC shall identify topics for these audits based on its work. CMS may, at its discretion, identify topics for these audits as well. All topics are approved by CMS and require the CPIC to provide a presentation and conduct a walkthrough to applicable CMS staff.

When the CPIC or CMS identifies an appropriate topic for a Self-Audit, the CPIC shall provide CMS with an Audit Plan. The Audit Plan shall contain, at a minimum:

· Audit strategy and timeline

· Risk assessment

· Data methodology

As part of its audit work, the CPIC shall identify the universe of encounter records to be included in the audit; prepare and provide the audit notification/package; alert plans to their role in the audits; review documentation submitted by plans; and prepare and provide close out letters and audit report packages, including lessons learned and educational materials to plans.

The CPIC shall selecta high-risk encounter data record universe and conduct exploratory audits to validate program integrity concerns before the full audit is conducted.

During the course of the audits, there may be findings that warrant a referral to the Center for Medicare. The CPIC shall work with CMS to set the parameters of when such findings rise to the level to warrant such a referral. As appropriate, the CPIC shall prepare Plan Sponsor Alerts based on the audit results.

Self-Audit Self-Audits are targeted audits in which CMS requires plans to conduct reviews on their own encounter records. These are targeted audits that focus on inappropriate Medicare Part C coverage concerns.

The CPIC shall identify topics for these audits based on its work. The CPIC shall work with CMS to set the parameters (audit review period, encounter records exclusions, etc.) of the Self-Audit. The CPIC and CMS shall provide plan sponsors with a file of potentially improper encounter records based on the audit methodology and will meet with the plan to ensure an appropriate understanding of the audit and expectations. The CPIC and CMS will notify the plan to conduct the Self-Audit after a webinar and pre-validation phase, including virtual meetings with the plan sponsor.

The plan will submit Self-Audit results to the CPIC. CMS and the CPIC shall work together to validate a sample of the results of the Self-Audit by reviewing the documentation to support payment under Medicare Part C provided by plans. The CPIC will prepare and provide close out materials and ensure appropriate actions were taken by the plan. CMS may, at its discretion, provide the CPIC with existing and previously approved audit topics that shall be reused.

RESERVED

RESERVED

Outreach and Education

National FWA Training The CPIC and CMS shall host and facilitate FWA trainings to educate and promote collaboration among law enforcement, plan sponsors, program integrity contractors, and other relevant stakeholders. The trainings shall feature the latest fraud schemes, trends, data analysis, and investigations related to Medicare Part C. When appropriate, the CPIC shall coordinate with the MEDIC to incorporate Medicare Part D-related information into trainings.

Outreach and Education Missions The CPIC and CMS shall host and facilitate periodic Outreach and Education Missions to promote collaboration between law enforcement, plan sponsors, program integrity contractors, and other relevant stakeholders about specific FWA topics. Missions may be held in person or via webinar and shall feature the latest schemes, trends, data analyses, and investigations related to the topic.

Audit Protocols The CPIC shall develop audit protocols that encompass each audit conducted by CMS. The protocols shall include, but are not limited to, the CMS authority to audit, audit purpose, audit methodologies, audit milestones/steps, audit instructions, and audit expectations.

PI Portal for FWA Reporting Module The CPIC shall maintain access to the Health Plan Management System (HPMS) PI Portal for FWA Reporting module. The I-MEDIC shall develop monthly reports based on data submitted by plan sponsors to the PI Portal for FWA Reporting module within HPMS. The MEDIC shall develop quarterly reports based on the I-MEDIC monthly reports.

The I-MEDIC shall provide the monthly report which includes the following:

Information based on the complaints received through the HPMS FWA Reporting module including:

Total number of complaint submissions received broken out by each of the following reporting categories:

1. Opioid prescribing

2. Part D payment suspensions implemented by plans

3. Substantiated and suspicious activities of FWA FWA schemes and trends in identifying suspicious activities, including (1) administrative actions, (2) pertinent information related to opioid overprescribing and (3) any other data deemed appropriate.

1. Trends shall include, but not be limited to, graphs, charts, and tables as necessary to show the breakdown of complaints received by trend including, but not limited to, allegation, description, totals, and percentages.

2. Schemes shall include, but not be limited to, graphs, charts and tables as necessary to convey specific schemes that fall within the trends each month. These schemes should include the name of the scheme and a high-level description that includes pertinent details of the scheme that will assist plan sponsors with their own FWA efforts.

A listing of all names, NPIs, organization type, date of submission, and allegation of providers and pharmacies that have been reported in the HPMS FWA Reporting module, broken out by each of the following reporting categories:

1. Opioid prescribing

2. Part D payment suspensions implemented by plans

3. Substantiated and suspicious activities of FWA The information is to by anonymized in the monthly report without identifying the source of the information Any other pertinent information

The MEDIC shall:

· Review the data submitted by plan sponsors to the PI Portal for FWA Reporting module, including:

· Payment suspensions resulting from credible allegations of fraud,

· Information on investigations; credible evidence of suspicious activities of a provider/supplier of services related to fraud; and other actions taken by the plan sponsors related to inappropriate prescribing of opioids, and

· Referrals of substantiated and suspicious activities of a provider/supplier of services related to FWA.

· Develop quarterly reports for the plan sponsors:

· Each report must include anonymized information submitted by the plans (as to not identify the source of the information) to the FWA Reporting module, including (1) information on FWA schemes and trends in identifying suspicious activities, (2) administrative actions taken, (3) pertinent information related to opioid overprescribing, and (4) any other data deemed appropriate.

· The reports will be provided to the plan sponsors no later than April 15th, July 15th, October 15th, and January 15th of each year based on the information in the FWA Reporting module, respectively, as of the preceding October 1 through December 31, January 1 through March 31, April 1 through June 30, and July 1 through September 30.

· Assist CMS with providing to the plan sponsors, through the FWA Reporting module, all providers/suppliers that:

· have been referred by the plan sponsors to the FWA Reporting module in the previous 12-month period,

· were subject of an active exclusion, payment suspension, or active revocation, and

· have been referred by the plan sponsors to the FWA Reporting module and are subject of an administrative action.

· Coordinate with the I-MEDIC and CPIC when appropriate.

· Incorporate reviewed data and fraud schemes and trends, when appropriate, in new data analysis reports and future audits.

· Use the data in the PI portal to develop new reports, audits, or other activities to promote program integrity in Part D.

· Perform and participate in user acceptance testing and other meetings as necessary with the HPMS developer and CMS stakeholders.

The CPIC shall:

Coordinate with the I-MEDIC and MEDIC on this report as requested.

Provide the MEDIC with any specific items of concern from their recent Medicare Part C reports that are related to the current identified schemes in the FWA Quarterly Report.

Incorporate reviewed data and fraud schemes and trends, when appropriate, in new data analysis reports and future audits.

Use the data in the PI portal to develop new reports, audits, or other activities to promote program integrity in Medicare Part C.

Perform and participate in user acceptance testing and other meetings as necessary with the HPMS developer and CMS stakeholders.

The CPIC, MEDIC, and I-MEDIC shall detail this communication and collaboration as it relates to this task in their Joint Operating Agreement (JOA).

Functional Requirements The CPIC shall perform various tasks to support its oversight and investigation of Medicare Part C plans and providers, including data analysis, reporting, and supporting various stakeholders that work to safeguard CMS program integrity.

Incoming Transition/Implementation Requirements The CPIC shall work with the outgoing contractors to transition all FWA detection and prevention information, documents, data, and activities. As part of the transition period, the CPIC shall immediately coordinate with the outgoing contractor regarding workload inventory and identified risks/challenges, conduct a virtual KickOff Meeting, and submit deliverables in accordance with the CPIC SOW requirements. The CPIC shall lead regular transition meetings with CMS, the outgoing contractor, and the appropriate contractors/stakeholders, and maintain minutes from those meetings. Meeting minutes shall be provided to CMS within three business days of the meeting date. The outgoing contractor may remain in effect for an additional period of time in an effort to assist the incoming contractor with any operational issues they encounter.

The CPIC shall perform the tasks required to successfully implement program integrity operations, including transition of operations from outgoing CPIC, including:

Establish connectivity and participate in training sessions (as needed) and other appropriate systems as defined in Sections 5 and 6.

Enter into a Data Use Agreement (DUA) with CMS, as referenced in Section 11.

Work with entities listed in Section 6 on establishing JOAs.

· Hire and train staff.

Conduct validation and discussion between the incoming and outgoing contractors regarding the outgoing contractor’s Outgoing Transition Plan, to include what workload shall remain open and be transitioned and what shall be closed.

· Transfer and make accessible to the incoming CPIC all appropriate data, files and information. The incoming contractor shall verify that all files and information have been received and are in a usable format.

Ensure minimal disruption to program integrity partner operations (e.g., Law Enforcement, prescribers/providers/suppliers, etc.).

· Keep all interested parties informed of the transition’s status and progress.

· Ensure transition resources are effectively and efficiently used and transition activities are completed on schedule.

Kickoff Meeting w/ CMS CMS will arrange a virtual Kickoff Meeting with the CPIC within a mutually agreed upon timeframe after the contract award. The purpose of the Kick-Off Meeting is to review and answer any questions that the CPIC has about the contract and to ensure that both the CPIC and CMS have a joint understanding of all work, timeframes, and deliverables required by the contract. The CPIC will work with CMS to compile the agenda for this meeting. The CPIC shall be prepared to provide CMS with a brief presentation outlining the CPIC’s ideas for completing the requirements of the contract. The CPIC is responsible for preparing minutes from the meeting and submitting them to CMS in accordance with the Deliverables Schedule.

Implementation Meetings The Contractor shall organize, host, and provide toll-free telecommunication lines and facilities for all implementation meetings. The meetings will be virtual and shall follow a prepared agenda and discuss the status of the major tasks, issues, deliverables, schedule, delays, problem resolution, and risk mitigation and contingencies. These meetings shall be held no less than every week, or more frequently if needed. These meetings shall include CMS representatives and all relevant stakeholders.

The Contractor shall document and submit to CMS the minutes of each implementation meeting conducted. The Contractor shall also maintain an issue log.

Outgoing Transition Requirements The CPIC shall work with the incoming contractor to transition all fraud and abuse detection and prevention information, documents, data, and activities. The CPIC shall transition out beginning four months prior to the end date of the final period of performance. The CPIC will be expected during this time to maintain operations while also meeting the below transition out activities. As part of the transition period, the CPIC shall assist the incoming contractor with transition activities, attend the incoming contractor’s Kick-Off Meeting (if needed), attend the incoming contractor’s transition meetings, and submit deliverables in accordance with the CPIC SOW requirements. The CPIC shall attend transition meetings with the incoming contractor and maintain minutes from those meetings. Meeting minutes shall be provided to CMS within three business days of the meeting date.

The incoming contractor shall assume operational responsibilities three months after the beginning of implementation. During the fourth month of transition, the outgoing CPIC shall include only minimal staffing to assist the incoming contractor with any operational issues they encounter.

The transition period shall be four months. In a successful transition:

· Validation and discussion shall be had between the incoming and outgoing contractors regarding the outgoing contractor’s Outgoing Transition Plan, to include what workload shall remain open and be transitioned and what shall be closed.

· All appropriate data, files, and information are transferred and made accessible to the incoming CPIC

· There is minimal disruption to program integrity partner operations (e.g., States, Law Enforcement, and providers/suppliers).

· There is minimal disruption of ongoing audits, reports, and other work outlined in this SOW.

· All interested parties are kept informed of the transition’s status and progress.

· Transition resources are effectively and efficiently used and transition activities are completed on schedule.

The CPIC shall develop, execute, and maintain the Outgoing Transition Plan document, which includes a detailed description of all activities required to transfer all operations. This plan shall include any risks as well as mitigation and contingency planning where appropriate. This shall serve as a project management tool for the CPIC to successfully transition the program and for CMS to effectively oversee the transition and implementation.

The Outgoing Transition Plan Document shall be submitted in accordance with the Deliverables Schedule.

Implementation Period Reporting The CPIC shall report on the status of the implementation in accordance with the Deliverables Schedule, to include the following basic work elements:

· Project Management - This element includes organizing project staff and workgroups, preparing the various plans required by CMS, conducting meetings, monitoring and reporting progress, issue/problem resolution, managing costs, and managing risk.

· Communications - Activities include communicating with program integrity partners and all other participants and stakeholders on the project to ensure all are informed of the transition, its status, progress, and how changes may affect them.

· Program Integrity Operations - This element involves activities associated with preparing, maintaining, or closing down the business environment. Tasks include preparing operational activities, due diligence, asset inventory, and interaction with other organizations involved in the transition.

· Resources/Infrastructure - Activities include personnel activities, training, and the preparation of facilities and associated infrastructure.

· Financial - This element includes banking arrangements, accounts receivable review, CMS required reporting activities and cost reporting.

· Workload/Records Transfer - This area includes file preparation, storage, and the activities associated with the actual cutover of program integrity operations and transfer of files.

· Joint Operating Agreements – This element includes the status of JOAs and any issues or problems with establishing them.

· Systems Onboarding & Access – This area includes the status of systems onboarding and any access issues.

PI Support Requests

Requests for Information from Outside Entities The CPIC shall document all requests for information from Law Enforcement and outside entities in the UCM System, and when needed for reporting/tracking purposes, the Contractor’s internal case management systems. The CPIC shall thoroughly document the details regarding the requestor, the nature of the request, any intervention by the CMS COR team, any modifications to the request, and the cost of furnishing the request.

To be in full compliance with the Privacy Act, the CPIC must receive all requests for information in writing and must satisfy the requirements of the disclosure provision. However, subsequent requests for the same provider/supplier that are within the scope of the initial request do not have to be in writing. The CPIC shall refer requests that raise Privacy Act concerns and/or issues to the CMS COR team for further consideration.

The CPIC and the MEDIC shall coordinate to resolve and respond to requests for information that impact both Contractors’ responsibilities.

Requests for Assistance from Outside Entities The CPIC shall document all requests for assistance from law enforcement and outside entities in the UCM System, and when needed for reporting/tracking purposes, the contractor’s internal case management systems. The CPIC shall thoroughly document the details regarding the requestor, nature of the request, any intervention by the CMS COR team, any modifications to the request, and the cost of furnishing the request. As directed by CMS, the CPIC shall be prepared to serve as the lead for investigations or provide subject matter expertise and/or testimony based on the needs of CMS and law enforcement including DOJ and OIG.

The CPIC shall contact the COR/BFL for law enforcement and outside entity requests to perform medical review (MR), when applicable. The COR will review the requests and provide directions to the CPIC on whether to proceed with the MR.

The CPIC shall follow up with the requestor of information to determine if the assistance provided satisfies the request.

The CPIC and the MEDIC shall coordinate to resolve and respond to requests for assistance that impact both Contractors’ responsibilities.

Congressional Inquiries The CPIC shall respond to Congressional Inquiries. The CPIC and the MEDIC shall coordinate to resolve and respond to Congressional Inquiries that impact both contractors’ responsibilities.

Freedom of Information Act (FOIA) Requests The CPIC shall respond to FOIA requests. The CPIC and the MEDIC shall coordinate to resolve and respond to FOIA requests that impact both Contractors’ responsibilities.

Other PI Support and Requests

Requests from CMS The CPIC shall provide responses to all CMS inquiries as they relate to functional requirements as set forth in this SOW.

Other Requests from Outside Agencies and/or Entities As directed by CMS, the CPIC shall comply with federal, state, and local subpoenas and requests that are related to the work outlined in this SOW.

The CPIC shall assist with requests and/or PI related tasks for all entities the CPIC coordinates with, at the direction of CMS.

Any federal, state, and/or local support requests that are received by the CPIC shall be approved by CMS prior to the CPIC fulfilling.

CMS Systems and Data Support The CPIC shall support CMS systems and data through the execution of various tasks.

Fraud Prevention System (FPS) The CPIC shall utilize FPS when compiling quarterly reports to identify if the lead was additionally identified in FPS. The CPIC shall perform other activities related to FPS as directed by CMS.

Analytics and Investigations Collaboration Environment for Fraud, Waste and Abuse (AICE-FWA) The AICE-FWA Tracking Tool Module was developed to permit plan sponsors, CMS, law enforcement, state regulators, program integrity contractors, and other stakeholders to provide leads for possible investigations; share actions taken on providers and pharmacies suspected of FWA activity; and generate reports on high-risk providers and pharmacies.

The CPIC shall review and provide feedback during the development of AICE-FWA program integrity models. The CPIC shall also provide subject matter expertise to ensure models accurately reflect Part C policy.

Other When requested by CMS, the CPIC shall provide testing for potential enhanced data or data from sources that are unfamiliar to the Medicare perspective, and update and/or adjust previously run analytics based upon the availability of improved source data or more state-of-the-art analysis techniques.

When data required to perform necessary functions cannot be found in the Integrated Data Repository (IDR) or via One Program Integrity (OnePI), the CPIC shall offer a strategy for obtaining and analyzing data to continue the performance of their program integrity work.

Datasets, Systems, and Sources

CMS Provided Datasets and Systems The CPIC shall interact with and utilize a robust CMS dataset and CMS-provided IT toolset as directed by CMS to perform its work rather than developing its own proprietary systems and datasets. In general, the CPIC shall be prepared to use any standard interfaces available in CMS systems to avoid duplication of information and data entry and to assure the ease of accessibility of all information during contract performance. A list of CMS primary systems and datasets is below. This list is not exhaustive.

Integrated Data Repository (IDR) The CPIC shall access and use the Integrated Data Repository Cloud henceforth referred to as the IDR (https://www.cms.gov/tra/Data_Management/DM_0080_IDRC_Cloud.htm), CMS’s data warehouse for claims and related reference information to perform tasks associated with FWA prevention and detection.