Draft CPIC SOW.pdf

Attachment 4.1 CPIC

Page

MEDICARE ADVANTAGE PROGRAM INTEGRITY

PLAN OVERSIGHT CONTRACTOR

STATEMENT OF WORK

I. Scope

The Part C Program Integrity Contractor (CPIC), acting as an independent Contractor and not as an agent of the government, shall perform fraud, waste, and abuse (FWA) detection, deterrence, and prevention activities for Medicare Part C. The CPIC shall furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the government, as needed to perform the work described in this Statement of Work (SOW). The CPIC’s work includes data analyses, audits, and reviews of Medicare Advantage Organizations (MAOs), assessment of fraud leads from various sources, investigative actions, administrative remedies, and law enforcement and other appropriate referrals. The CPIC shall coordinate with staff from the Centers for Medicare & Medicaid Services (CMS), other CMS contractors, and other stakeholders as needed and as directed by the CMS Contracting Officer’s Representative (COR), in collaboration with Business Function Leads (BFL), to perform this program integrity work.

II. Purpose of this Contractor

The purpose of CPIC is to perform FWA detection and prevention activities to proactively deter fraud, waste, and abuse in Medicare Part C. The CPIC shall perform their responsibilities under the direction of CMS. The CPIC shall develop and conduct audits and investigations thoroughly and in a timely manner and take immediate action to ensure that the Medicare Trust Fund is protected. The CPIC shall use or interact with CMS-required systems as needed in the performance of its functions. Further, the CPIC shall coordinate its activities not only with CMS, but also with agencies at the federal, state, and local levels of government as well as other CMS partners and contractors.

III. Background

The CMS has traditionally used two contractors to carryout program integrity work in Medicare Parts C and D. The Investigations Medicare Drug Integrity Contractor (I-MEDIC) focused on program integrity efforts, and the Plan Program Integrity (PPI-MEDIC) focused on plan audits and Medicare Part C and D analysis. This contract will consolidate the Part C program integrity work previously performed by the I-MEDIC and PPI-MEDIC. In the base year, PPI MEDIC shall transition its Part C work to CPIC. At the conclusion of I-MEDIC contract, I-MEDIC shall transition its Part C work to CPIC. Another contract (XXXXXXXXX, “MEDIC”) will consolidate the Part D program integrity work.

A. General Responsibilities

The CPIC’s primary role is to perform plan audits and provider investigations to detect, prevent, and deter FWA in Medicare Part C.

B. Statutes, Regulations, and Documents

The CPIC shall perform the requirements of this contract in accordance with applicable federal laws, regulations, Medicare Internet-Only Manuals (Pub. #100-08; #100-16; #100-18), and CMS requirement documents to assure the integrity of the Medicare Part C program. The following is a non-exhaustive list of the applicable documents:

Medicare Integrity Program Section 1893 of the Social Security Act Patient Protection and Affordable Care Act and Health Care and Education Reconciliation Act

Full text

Health Insurance Portability and Accountability Act Full text Medicare Prescription Drug, Improvement, and Modernization Act

Full text

Medicare Program Integrity Regulations 42 CFR Part 420 Medicare Advantage Program Regulations 42 CFR Part 422 Medicare Prescription Drug Benefit Regulations 42 CFR Part 423 Medicare Manuals Medicare Manuals

For purposes of this contract, CPIC shall immediately contact the COR and/or the Contracting Officer (CO) if discrepancies are identified between these sources. The CPIC shall identify any budgetary concerns that may occur as a result of any conflict. Moreover, in accordance with CMS policy, the Contractor cannot assert clinical review judgment to override, supersede, or disregard a Medicare policy requirement.

IV. Tasks

A. Task A: MAO Oversight and Technical Assistance

1. Subtask A1: Program Integrity Focused Audits

MA plan sponsors must adopt and implement an effective compliance program, which must include measures that prevent, detect, and correct fraud, waste, and abuse in accordance with 42 CFR § 422.503. The CPIC shall develop and conduct audits of MAOs to ensure they are complying with regulations and sub-regulatory guidance regarding their FWA efforts and appropriately identifying and responding to program integrity risks. At CMS’s discretion, the CPIC shall address program integrity risks identified by CMS using program integrity-focused audits.

The CPIC shall assist CMS in conducting risk assessments to identify plans that may not have an effective FWA program. The CPIC shall coordinate with various entities throughout the course of an audit in an effort to obtain relevant information. When applicable, such as for audits of MA- PDs, the CPIC shall coordinate its auditing efforts with other entities, such as the MEDIC. The CPIC shall develop and update as necessary an audit plan for each audit. The plan shall include the audit methodology and steps and timeframe necessary to meet approved audit objectives. The CPIC, as directed by CMS, shall accompany CMS to conduct virtual and onsite audits of plans to review documentation and systems related to the risk assessments. This may include reviewing documentation, systems, and procedures related to investigations, proactive data projects, and https://www.ssa.gov/OP_Home/ssact/title18/1893.htm https://www.healthcare.gov/where-can-i-read-the-affordable-care-act/ https://www.govinfo.gov/content/pkg/PLAW-104publ191/pdf/PLAW-104publ191.pdf https://www.congress.gov/108/plaws/publ173/PLAW-108publ173.pdf https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-420 https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-422 https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-423 https://www.cms.gov/medicare/regulations-guidance/manuals potential FWA complaints. The CPIC shall complete the audit and prepare an audit report including the findings and any recommendations to plan sponsors as a result of the audit. The CPIC shall conduct post-audit activities to ensure continual improvement for the PI Focused Audits process (e.g., lessons learned, etc.) and provide a report regarding lessons learned to CMS.

2. Subtask A2: MAO Technical Assistance

The CPIC shall perform a range of FWA proactive data analysis of Medicare data to support audits of MAOs. The CPIC shall analyze the applicable data, including data from multiple health care databases, internal and external to CMS, when performing their work. Examples of data sources for the work to be performed by the CPIC can include those listed in Section VI. While awaiting data sources that may not be fully available, the CPIC shall collaborate with CMS to determine innovative approaches so that the most complete and accurate data possible becomes available to perform data analysis work in pursuit of strong program integrity.

3. Subtask A3: Reports

At CMS’s direction, the CPIC shall be required to produce data analytics reports to MAOs to assist plan sponsors in their FWA efforts. These reports shall educate plan sponsors about aberrant billing and other information related to the data analysis projects. Proactive data analysis reports can include such topics as utilization trends for certain high-risk items and services and lists of outlier providers. These reports shall include detailed data in table and figure form, long-form descriptions of what the data is showing, a discussion of whether these trends may relate to larger industry developments (e.g., new technologies or drugs), and instructions for appropriate use of the data by the MAO.

4. Subtask A4: Peer Activity Reports

At CMS’s direction, the CPIC shall be required to produce Peer Activity Reports (PARs). PARs compare a provider/supplier’s utilization trends and payment patterns for various procedures or services to their peers on a city, county, state, and national level. The goal of PARs is to help CMS, plan sponsors, and other related entities analyze claims and other data for outliers and aberrant behavior. The CPIC shall develop potential areas for study and maintain an inventory of these areas for prioritization and risk assessment purposes. The CPIC shall develop PAR plans, including PAR topics, statistical methodologies, study timeframes, a communication plan, and evaluation methodologies. PAR topics and methodology are subject to change at CMS’ discretion. PAR analyses shall be based on Medicare Part C encounter data or other data the contractor may have access to. The CPIC shall communicate PAR results to providers. This communication may include letters, emails, memos etc., created by CMS and the CPIC. The CPIC shall be responsible for responding to questions from providers and suppliers about the PARs. When applicable, such as for PARs of certain prescribers, the CPIC shall coordinate its auditing efforts with other entities, such as the MEDIC.

5. Subtask A5: Plan Sponsor Alerts

Plan Sponsor Alerts (PSAs) are issued by CMS to plan sponsors when trends have been identified that may be associated with FWA of the Medicare Parts C and D programs. The CPIC shall identify topics for PSAs based on its work. CMS may, at its discretion, identify topics for PSAs as well.

When the CPIC or CMS identifies an appropriate topic for a PSA, the CPIC shall provide CMS with a PSA plan, including a description of the issue identified; supporting information, such as data analyses; and timeframes for drafting and issuing the PSA. If a PSA plan is approved, the CPIC shall draft the PSA and submit it to CMS for approval and dissemination. The CPIC shall be responsible for collecting, tracking, and responding to any inquiries from plan sponsors as a result of PSAs. When applicable, such as for PSAs of certain prescription drugs, the CPIC shall coordinate its auditing efforts with other entities, such as the MEDIC.

6. Subtask A65 Plan Sponsor Targeted Compliance Notifications

Plan Sponsor Targeted Compliance Notifications (TCNs) are issued by CMS to plan sponsors whose audit results are indicative of noncompliance to CMS-issued guidance. The CPIC shall identify topics for TCNs based on its work. CMS may, at its discretion, identify topics for TCNs as well. When the CPIC or CMS identifies an appropriate topic for a TCN, the CPIC shall provide CMS with a TCN plan, including a description of the issue identified; supporting information, such as audit results; and timeframes for drafting and issuing the TCN. If a TCN plan is approved, the CPIC shall draft the TCN, submit it to CMS for approval, and if approved, the CPIC shall disseminate the TCN through Payment Recovery Information System (PRIS) to the plans. The CPIC shall be responsible for collecting, tracking, and responding to any inquiries from plan sponsors as a result of TCNs.

7. Subtask A7: CMS Part C Plan Correspondence Mailbox

CMS communicates with plans through notification letters or email correspondence. CMS established a Part C Plan Correspondence Mailbox for email inquiries from plans. The CPIC will be granted access to the Part C Plan Correspondence Mailbox and shall monitor, compile, and log all communication received through the Part C Plan Correspondence Mailbox. The CPIC shall propose responses to questions from plans and disseminate responses after they have been approved by CMS. The CPIC shall coordinate with the CPIC as appropriate to ensure any Part C-related communications are appropriately processed.

8. Subtask A8: Risk Adjustment Payment Oversight

The Office of Inspector General (OIG) conducts Risk-Adjusted Data Validation-like (RADV-like) audits on certain MAO contracts. CMS monitors plan sponsors’ implementation of recommendations on these reports (see https://oig.hhs.gov/reports-and-publications/workplan/summary/wp-summary-0000422.asp). The contractor shall develop a strategy to include processes and procedures to assess MAO compliance with OIG audit recommendations. Additionally, the contractor shall ensure the MAOs have taken the appropriate steps to close the OIG recommendations and develop standard correspondence with the identified MAOs to document CMS approved findings and conclusions. The CPIC may also be required, at the direction of CMS, to conduct additional audits or other oversight activities of Part C plan sponsors that are identified as high risk of risk adjustment overpayments.

https://oig.hhs.gov/reports-and-publications/workplan/summary/wp-summary-0000422.asp https://oig.hhs.gov/reports-and-publications/workplan/summary/wp-summary-0000422.asp

9. Subtask A9: Education & Outreach

The CPIC shall host and facilitate FWA trainings to educate and promote collaboration between law enforcement, MA plan sponsors, program integrity contractors, and other relevant stakeholders. The trainings shall feature the latest schemes, trends, data analysis, and investigations related to Part C. When appropriate, the CPIC shall coordinate with the MEDIC to incorporate Part D-related information into trainings.

10. Subtask A10: PI Portal for FWA Reporting Module

The CPIC shall maintain access to the Health Plan Management System (HPMS) PI Portal for FWA Reporting module. The CPIC shall, in coordination with the MEDIC, develop quarterly reports based on data submitted by plan sponsors to the PI Portal for FWA Reporting module within HPMS. The CPIC, in coordination with the MEDIC, shall:

• Review the data submitted by plan sponsors to the PI Portal for FWA Reporting module, including:

o Payment suspensions resulting from credible allegations of fraud, o Information on investigations; credible evidence of suspicious activities of a provider/supplier of services related to fraud; and other actions taken by the plan sponsors related to inappropriate prescribing of opioids, and o Referrals of substantiated and suspicious activities of a provider/supplier of services related to FWA.

• Develop quarterly reports for the plan sponsors:

o Each report must include anonymized information submitted by the plans (as to not identify the source of the information) to the FWA Reporting module, including (1) information on FWA schemes and trends in identifying suspicious activities, (2) administrative actions taken, (3) pertinent information related to opioid overprescribing, and (4) any other data deemed appropriate.

o The reports will be provided to the plan sponsors no later than April 15th, July 15th, October 15th, and January 15th of each year based on the information in the FWA Reporting module, respectively, as of the preceding October 1 through December 31, January 1 through March 31, April 1 through June 30, and July 1 through September 30.

• Assist CMS with providing to the plan sponsors, through the FWA Reporting module, all providers/suppliers that:

o have been referred by the plan sponsors to the FWA Reporting module in the previous

12-month period, o were subject of an active exclusion, payment suspension, or active revocation, and o have been referred by the plan sponsors to the FWA Reporting module and are subject of an administrative action.

• Coordinate with the I-MEDIC and MEDIC when appropriate.

• Incorporate reviewed data and fraud schemes and trends, when appropriate, in new data analysis reports and future audits.

• Use the data in the portal to develop new reports, audits, or other activities to promote program integrity in Part C.

• Perform and participate in user acceptance testing and other meetings as necessary with the HPMS developer and CMS stakeholders.

B. Task B: Part C Investigations and Complaints

1. Subtask B1: Lead Management

The CPIC shall partner with CMS to identify and prioritize leads for investigation. A lead is an indication that points toward a suspected instance of fraud, waste, or abuse. The CPIC shall accept leads from a variety of external sources that can include, but are not limited to: the Unified Program Integrity Contractors (UPICs), the OIG, Department of Justice (DOJ), Federal Bureau of Investigation (FBI), Assistant United States Attorney (AUSA), the 1-800-Medicare call center, CMS, the I-MEDIC, the MEDIC, the Medicare Administrative Contractors (MACs), State Medicaid Agency (SMAs), Medicaid Fraud Control Units (MFCUs), MA Plans, Part D Plans, CMS analytical contractors, Healthcare Fraud Prevention Partnership (HFPP) Trusted Third Party (TTP), fraud alerts, and direct complaints from program beneficiaries and health care providers/suppliers. Additionally, CMS may assign the CPIC leads based on referrals from other CPI data analytics contractors. The CPIC may identify leads through proactive and reactive data analysis, coordination with the SMA, CMS, and/or Law Enforcement, and through various sources which may include, but are not limited to, tips and newspaper/internet articles/publications, etc. If appropriate data becomes available, the CPIC shall monitor the Fraud Prevention System (FPS) to identify Alert Summary Reports (ASR) that warrant further review. If an ASR does not warrant further review, the CPIC shall indicate in FPS the reason for not reviewing further.

The CPIC shall develop an administrative protocol, or triage process, that governs the disposition of leads based on the likelihood of fraud, waste, and abuse identification. The protocol shall accurately link screening measures to potential fraud, waste, and abuse risk factors to assure that CPIC resources are dedicated to leads with the highest likelihood of fraud, waste, and abuse. The protocol must be flexible to allow the CPIC and CMS to address evolving fraud, waste, and abuse issues. For requirements of lead management protocols and vetting of leads, please refer to IOM Pub. 100-08.

The CPIC shall be flexible and shall have the capability to adapt to the changing landscape of fraud, waste, and abuse. The CPIC shall keep CMS informed as to the highest investigative priorities in such a way as to assure that CMS always has a full understanding of the CPIC’s highest priorities and how the CPIC is allocating its resources among these activities.

The CPIC shall coordinate its lead development efforts with other entities, such as CMS, other CMS contractors, as well as state or Federal agencies, as directed by CMS. Support to CMS FOs and ROs may include, but not be limited to, providing clinical support during field interviews and collaborating on investigations of specific providers/suppliers.

The Unified Case Management System (UCM) is the official system of record. The CPIC shall use CMS’ UCM, and when needed for reporting/tracking purposes, the contractor’s internal case management systems, to track all leads unless alternate reporting systems are specified. The UCM allows the CPIC to enter information about the initiation of a lead, follow its progress, and note specific outcomes.

Should the CPIC identify a compromised beneficiary and/or provider/supplier number through the lead management process, the CPIC shall follow the Identity Theft Investigations and Victimized Provider Waiver of Liability Process as outlined in IOM 100-08. The CPIC is required to report validated compromised Medicare beneficiary and provider numbers, per the definition in IOM 100-08, to the Compromised Number Record (CNR) in UCM. Any reported compromised numbers must meet the IOM 100-08 “compromised number” definition before submission. In addition, any validated compromised number that meets this definition is considered a high risk.

Therefore, contractors will no longer use risk or reason codes in the submission of a compromised number.

Should the CPIC have justification during the Lead Screening stage for referral to Medical Review Board, Pharmacy Review Board, Quality Improvement Organizations (QIO), etc., they shall follow the instructions outlined in IOM Pub. 100-08.

Should the CPIC identify circumstances that require Immediate Advisement to LE through the Lead Screening stage, they shall follow the process outlined in IOM Pub 100-08.

The CPIC shall also have adequate foreign language capabilities to handle all communications, to include written documents, with all beneficiaries. For other beneficiary language groups, the CPIC shall obtain foreign language support service by contract.

Workload Categories

The CPIC investigative workload shall be split into three categories/origins:

• Stakeholder Identified leads: These leads shall be identified and prioritized through collaboration with a variety of stakeholders. This workload category may also include leads found through Contractor data mining. Other examples of work included in this category may include but is not limited to:

o Contractor-developed data projects, including those that are part of the approved data analysis project management plan;

o Leads found during Contractor data mining and analysis that pertain to local Medicare and Medicaid issues;

o Leads from external sources or referrals (e.g., complaints);

o Law Enforcement referrals;

o Contractor driven innovative approaches.

• CMS generated leads: The CPIC may receive work directly from CMS in support of program integrity operations and other high priority issues. Examples include but are not limited to:

o Leads that involve urgent matters, such as provider activities that could result in patient harm;

o Congressional inquiries needing expedited analysis;

o Leads developed by other partners that are passed through CMS first (i.e. TIGER team leads);

o Quality of care concerns;

• FPSleads (if appropriate data becomes available): The leads prioritized in the FPS include vulnerabilities identified by many sources, including data models, HFPP TTP referrals, and CMS and CPIC intelligence, among others.

2. Subtask B2: Complaints

The CPIC shall receive complaints about MA plans and providers via the sources detailed in this section. The CPIC shall categorize complaints into two category tiers – Level I and Level II. Upon receipt, each complaint shall be placed in the Level I intake category. At Level I, the CPIC shall determine if the information received is within the scope of FWA for the CPIC. Should it be determined that the complaint is not within the scope of FWA, the complaint shall be closed or submitted to the CMS Regional Offices (ROs) as needed.

Should it be determined that the complaint is within the scope of FWA and requires additional review, the CPIC shall re-categorize the complaint as Level II. During the review of Level II complaints, the CPIC may review additional (included) documentation, research potential fraud schemes, review previous complaints and billing information, etc.

If a Level II complaint is unable to be resolved, the complaint shall be forwarded for Lead review.

Complaint Triaging and Coordination

The MEDIC shall triage all complaints received from the sources in this section and refer them to the CPIC when appropriate. The CPIC and the MEDIC shall coordinate to resolve and respond to complaints that impact both contractors’ responsibilities.

3. Subtask B2.1: MEDIC Call Center

The MEDIC shall operate a Call Center that shall enable individuals to report potential MA Plan, Part D Plan prescriber, pharmacy, and beneficiary related FWA.

MEDIC Complaint Referrals

The CPIC shall receive complaint referrals from the MEDIC call center. The CPIC shall document and maintain a log using its own internal system.

Upon receipt of a new complaint referral, the CPIC shall review the complaint to determine if further screening should occur. The CPIC complaints team shall resolve or refer the complaint to the CPIC intake team with 30 calendar days of receipt.

If the CPIC receives any complaints (or inquiries) that are outside its scope of responsibility, the CPIC shall refer the complainant to the appropriate entity(ies). The CPIC shall keep track of where ‘outside scope’ or misrouted complaints are originating from so that further education can be provided and/or the Contracting Officer’s Representative (CORs)/Business Function Lead (BFLs) can take action as required.

The contractor shall maintain, and document information obtained from complaints in its own internal system. Any calls indicating potential FWA in Part C on specific providers or suppliers shall be referred as a lead to the CPIC intake team to pursue and document in UCM.

4. Subtask B2.1.1: MEDIC Call Center Promotion

The contractor shall publicize the toll-free call center number, along with its address and fax number, so that FWA complaints are sent to them. Accordingly, the CPIC shall, at a minimum, inform the following about its contact information:

• Providers, suppliers, and beneficiaries that the CPIC has the responsibility to monitor FWA in Part C. When informing them on how to report potential FWA, the CPIC should include a model letter approved by CMS.

• CMS contractors that may receive FWA complaints from individuals and entities such as UPICs, MACs, MA plans, and QIOs.

• Organizations involved with beneficiary advocacy and protection, such as the American Association of Retired Persons, SHIPs, Area Office of Aging, and the SMP. The CMS CORs/BFLs will assist the CPIC with contacting these organizations since many of these associations partner with CMS.

The contractor shall maintain, and document information obtained from complaints in its own internal system. Any calls indicating potential FWA in Part C on specific providers or suppliers shall be referred as a lead to the CPIC intake team to pursue and document in UCM.

5. Subtask B2.2: Plan Complaints

The CPIC receives complaints via the Complaints Tracking Module (CTM) and the HPMS PI Portal.

6. Subtask B2.2.1: Plan Complaints from the CTM

CMS ROs rely upon the Complaints Tracking Module (CTM) to support the effective administration of the Medicare Part C and Part D programs. By using the CTM as a two-way communication system, the CPIC and CMS ROs can communicate on sensitive matters securely, with the objective of routing beneficiary matters to the appropriate entity for investigation and/or resolution.

Upon receipt of a new complaint referral, the CPIC shall review the complaint to determine if further screening should occur. The CPIC complaints team shall resolve or refer the complaint to the CPIC intake team within 30 calendar days of receipt.

The complaint will be entered into UCM when further investigation is warranted and close the CTM entry with a standard message approved by CMS. If the CPIC determines that the complaint is not related to Part C FWA, the CPIC shall refer the complaint to the appropriate entity.

If the complaint is routed to the CPIC from the RO via the CTM, the CPIC shall:

• Check CTM to determine if there are open and/or duplicate complaints. If a duplicate CTM complaint is found and is still open, the CPIC shall add a note to the complaint that it has determined is not within its purview. Further, the CPIC complaint shall reference the CTM number(s) of the duplicate complaint(s) when redirecting to the RO.

• Check CTM to determine if the complaint has already been resolved and closed by the RO.

If a duplicate CTM complaint is found and has been resolved/closed by the RO, the CPIC shall reference the resolved CTM number and mark the complaint as closed. In this instance, the complaint will not be redirected to the RO as it is already closed. Please note that all Congressional inquiries should be forwarded CMS as directed.

The CPIC shall take the following steps when dealing with a complaint related to a potential MA Plan provider/supplier or beneficiary related FWA when after the screening process it is determined further investigation is warranted:

• Enter the complaint: The CPIC shall enter all potential FWA complaints and all potential FWA leads into the internal Case Management System within five business days of receiving the complaint from the complaints team (If the CPIC received the complaint via CTM, then it should be noted in the Case Management System that the complaint was received from CTM).

• Acknowledge the Complainant: The CPIC shall send an acknowledgement letter to the complainant within five business days after initial receipt of the complaint. The letter shall be sent on the CPIC letterhead and shall contain the SAFERx Hotline telephone number and the Call Center Manager’s name or designee. For complaints that require further investigation, upon referral to the CPIC intake team, the CPIC shall log the issuance of this letter into the UCM case notes and upload a copy of the letter. If a case was referred from an entity other than the complainant (e.g., SHIPs or SMPs), the CPIC shall send the acknowledgement letter to the referring entity and the complainant if the complainant’s contact information is included with the complaint. When sending any information about a complainant to another entity, the CPIC shall ensure that it is in compliance with all Health Insurance Portability and Accountability Act laws. The contractor is not required to send acknowledgement and resolution letters to CMS staff for complaints originating from

CMS.

• Resolve the Complaint: If the complaint did not require referral to the CPIC intake team, the CPIC shall update their internal complaint tracking system with a standard, CMS-approved message within five business days of resolution. If the complaint did require referral to the CPIC intake team, the CPIC shall update the MCMS with a standard, CMS-approved message within five business days of the referral. If the complaint requires referral to the CPIC intake team, the complaint shall be entered into UCM within two business days when further investigation is warranted. The contractor shall also be responsible for sending the complainant a resolution letter within five business days of the resolution of the complaint or investigation.

7. Subtask B2.2.2: Plan Complaints from the HPMS PI Portal

The MEDIC shall refer fraud, waste, and abuse plan complaints from the HPMS PI Portal to the CPIC for review, action, and reporting.

Upon receipt of FWA plan complaints, the CPIC can reject the complaint submission by selecting the appropriate rejection option in the HPMS PI Portal and provide a written justification via the HPMS PI Portal without providing a resolution letter upload. This shall only apply if the CPIC has not provided an acknowledgement letter to the plan. All other complaint submissions that do not receive an initial “not sufficient information” shall be provided an acknowledgment letter and a resolution letter once closed.

When the CPIC accepts a complaint from the MEDIC, the CPIC shall take the following steps:

Enter the complaint: The CPIC shall enter all potential FWA complaints into its internal case management system within five business days of receiving the complaint from the MEDIC. If the complaint originated from the HPMS PI Portal, the CPIC shall notate in its internal case management system that the complaint originated from the HPMS PI Portal.

• Acknowledge the Complainant: The CPIC shall send an acknowledgement letter to the complainant/plan/PBM, via the HPMS PI Portal, within five business days after initial receipt of the complaint. The letter shall be sent on CPIC letterhead and shall contain the telephone number of the CPIC complaints manager. For complaints that require further investigation, upon referral to the CPIC intake team, the CPIC shall log the issuance of this letter into the UCM case notes and upload a copy of the letter. When sending any information about a complainant to another entity, the CPIC shall ensure that it is following all Health Insurance Portability and Accountability Act laws.

• Referral of the Complaint to the CPIC Intake Team: If the complaint requires referral to the CPIC intake team, the complaint shall be entered into UCM within two business days when further investigation is warranted. If the complaint originated in the HPMS PI Portal, it shall be notated in the UCM that the complaint originated in the HPMS PI Portal.

• Resolve the Complaint: If the complaint did not require referral to the CPIC intake team, the CPIC shall update its internal case management system with a standard, CMS-approved message within five business days of resolution. If the complaint does require referral to the CPIC intake team, the CPIC shall update its internal case management system with a standard, CMS-approved message within five business days of the referral. The contractor shall also be responsible for sending the complainant a resolution letter within five business days of the resolution of the complaint or investigation.

The CPIC complaints team shall resolve or refer the complaint to the CPIC intake team within 30 calendar days of receipt.

If the CPIC determines that the complaint is not related to Part C FWA, the CPIC shall refer the complaint to the appropriate entity.

11. Subtask B3: Investigations

The CPIC shall investigate suspected instances of fraud, waste, and abuse involving Medicare providers, suppliers, prescribers, and other entities receiving reimbursement under the Medicare programs. The CPIC shall open approved investigations with the highest priority of potential fraud, waste, and abuse. The CPIC shall investigate to determine the facts and the magnitude of the alleged fraud.

The CPIC shall conduct a variety of activities to substantiate the allegations during the course of an investigation. Examples of activities that may be appropriate can be found in IOM Pub.100-8.

The CPIC is not restricted to these activities and will determine the appropriate methods based on the nature of the allegation and the facts that are uncovered.

The CPIC shall coordinate with various entities throughout the course of an investigation, in an effort to obtain relevant case information and/or data. When applicable, the CPIC shall coordinate its investigative efforts with other entities, such as CMS ROs, other CMS contractors, as well as state or Federal agencies, as directed by CMS. There may be situations where OIG/OI or other law enforcement agencies might recommend that administrative actions are postponed or not pursued as not to disrupt an active case. The CPIC shall refer such requests, with any correspondence from law enforcement to CMS. CMS will provide direction to the CPIC, after discussion with law enforcement.

Prior to conducting large scale onsite and/or “boots on the ground” initiatives, the CPIC may be requested to prepare an Onsite Concept of Operations document in accordance with the Deliverables Schedule and attachment J.4 Onsite Concept of Operations. The purpose of this document is to provide CMS a detailed overview of the proposed onsite initiative(s), providers involved, allegation(s) and dollars at risk, etc.

For additional investigations requirements, please refer to IOM Pub. 100-08.

As part of the CPIC’s investigative process (regardless of the source of the complaint), the contractor shall, as appropriate, reach out to the MA plan (42 CFR §§ 422.504(i)(2)(i)) or Part D sponsor (423.505(i)(2)(i)) to determine if they have requested and received medical records from the provider and request a copy of the records to assist in developing the investigation. In addition, if an MA plan (42 CFR §§ 422.504(i)(2)(ii)) or Part D sponsor (423.505(i)(2)(ii)) does not have the requested records, the CPIC may request records directly from the provider. Prior to requesting records directly from a provider, the CPIC shall make proper notification to the MA plan (42 CFR §§ 422.504(i)(2)(iii)) or Part D sponsor (423.505(i)(2)(iii)). Findings from record reviews could be used to revoke the subject based on abusive prescribing and other possible revocation authorities. If the CPIC determines that it is not appropriate to request medical records from the plan sponsors, it shall document its reasoning in UCM. If the CPIC requests records from a prescriber, pharmacy, or plan sponsor, and the prescriber, pharmacy, or plan sponsor declines to provide the requested record(s), the CPIC shall, within two business days, inform its BFL(s) and COR, as prescribers, pharmacies, and plan sponsors are not required to provide records to CPIC.

The UCM is the official system of record. The CPIC shall use CMS’s UCM, and when needed for reporting/tracking purposes, the contractor’s internal case management systems, to track all investigative functions, with the exception of medical review (the UPIC shall solely use UCM to track Medical Review outcomes). The UCM allows the CPIC to enter information about the initiation of an investigation, follow its progress, and note specific outcomes.

Should the CPIC identify a compromised beneficiary or provider/supplier number through the investigation process, the CPIC shall follow the Identity Theft Investigations and Victimized Provider Waiver of Liability Process as outlined in IOM 100-08. The CPIC is required to report validated compromised Medicare beneficiary and provider numbers, per the definition in IOM 100-08, to the Compromised Number Record (CNR) in UCM. Any reported compromised numbers must meet the IOM 100-08 “compromised number” definition before submission. In addition, any validated compromised number that meets this definition is considered a high risk.

Therefore, contractors will no longer use risk or reason codes in the submission of a compromised number.

The CPIC shall also have adequate foreign language capabilities to handle all communications, to include written documents, with all beneficiaries. The CPIC may obtain foreign language support service by contract.

Investigation Coordination

The CPIC and the MEDIC shall coordinate to conduct investigations that impact both contractors’ responsibilities.

Planning Requirements

The CPIC shall notate and continuously update in the UCM an investigative plan of action for each investigation.

The plan shall include the steps and timeframe necessary to meet investigative objectives.

Immediate Advisements to LE

Should the CPIC identify circumstances that require Immediate Advisement to LE, they shall follow the process outlined in IOM 100-08.

CPIC Case Coordination with CMS and LE

The CPIC shall refer to IOM Pub. 100-08 regarding the Case Coordination process.

Recommending Administrative Action(s)

A range of administrative actions, as referenced in IOM 100-08 and in accordance with the appropriate federal/state regulations and statutes, are to be supported, developed, and recommended by the CPIC to the appropriate federal or state authority include, but are not limited to, the following:

• Medicare enrollment revocations

• Medicare and Medicaid program exclusions

The CPIC shall conduct a peer-to-peer review for Revocation Authority (a)(14) according to the Revocation and Deactivation Policy Document. The CPIC shall consult with their BFLs during their regularly scheduled calls prior to submitting proposed revocations for Revocation Authority (a)(14).

The CPIC shall support CMS in identifying innovative approaches to implementing administrative actions based on the authorities available to CMS. Additionally, the CPIC shall be prepared to support additional administrative actions as Congress provides additional program integrity statutory authorities to CMS.

Referring Requirements

The following outlines the CPIC’s referring requirements:

• Referral to CMS, State Medicaid Agency, and LE: The CPIC shall refer recommendations for appropriate action to CMS, MFCU, State Medicaid Agency (when appropriate), and/or LE in accordance with SOW Section 4.4.5 CPIC Case Coordination with CMS, LE, and State Medicaid Agencies, and IOM Pub. 100-08. Once a referred investigation has been accepted by OIG/OI or other LE entity, the CPIC, after consultation with LE, may inform the complainant within five business days that the investigation has been referred and that further requests concerning the matter should be referred to the appropriate LE entity. However, some cases may be sensitive, and, in those cases, the complainant is not to be informed of the referral to LE. The CPIC shall contact the appropriate LE agency before responding to the complainant to determine if the case is a sensitive one. When the CPIC decides that a referral to any agency (federal, state, etc.)

other than OIG/OI and FBI is warranted, it shall seek direction from the BFLs.

• Referral of Quality of Care Issues: The CPIC shall refer suspected instances of apparent unethical or improper practices or unprofessional conduct (e.g., quality of care issues) to the appropriate entity in accordance with the timeframes identified in IOM 100-08.

Investigation Timeframes

The CPIC shall initiate any appropriate administrative action, referral or closure within 210 calendar days, unless otherwise specified by CMS.

Closing Investigations

The MEDIC shall close investigations in accordance with IOM 100-08.

8. Subtask B3.1: Investigation Data Analysis

The CPIC shall refer to IOM Pub. 100-08 regarding data analysis activities that are to be conducted during the investigative process.

Subtask B3.2: Medical Review

The CPIC is authorized to conduct medical reviews (in accordance with 42 U.S.C. 1395ddd (b)(1) and 42 U.S.C.§ 1396U–6). The CPIC shall provide medical review (MR) in support of an investigation to determine the appropriateness and medical necessity of the services in question.

Whenever performing complex coverage or coding reviews (i.e., reviews involving the medical record), the CPIC shall assure that coverage/medical necessity determinations are made by Registered Nurses (RN) or therapists and that coding determinations are made by certified coders or clinicians with approved coding credentials. When necessary, these reviews will include determinations of medical necessity by licensed practitioner(s), as required by state rules and regulations. The CPIC shall comply with all National Coverage Determinations (NCDs), Coverage Provisions in Interpretive Manuals, national coverage and coding articles, local coverage determinations (LCDs) (formerly called local medical review policies (LMRPs), and local coverage/coding articles.

12. Subtask B3.3: Appeals

The CPIC shall support appeals, potentially including additional reviews, related to Medicare revocations, in accordance with IOM Pub. 100-08. The CPIC shall provide testimony in specific cases when requested. In the case of Medicare appeals, this support includes participating in Administrative Law Judge (ALJ) hearings in the Civil Remedies Division with participant status, Departmental Appeals Board Appellate Division hearings, Federal District Court cases and possible appeals of the district court’s decision. The CPIC shall also support appeals of judgements or convictions related to Medicare law enforcement activities. Additionally, the CPIC shall support any reviews relating to settlement agreements or compliance initiatives resulting from CPIC investigations. The CPIC’s activities may include, but are not limited to, the following:

• Participating in teleconferences with State and Federal partners;

• Maintaining documents and related work papers in support of the investigative findings in the UCM;

• Providing position papers or documents to support the appeal;

• Cooperate with the State and Federal partners and respond to their request for information to support the appeal;

• Providing required witnesses as necessary for deposition, hearing, explain the findings, subject of the investigation or other proceedings; and

• Participating and testifying in the deposition, hearing or other proceedings.

V. Functional Requirements

The CPIC shall perform various tasks to support its oversight and investigation of Part C plans and providers, including data analysis, reporting, and supporting various stakeholders that work to safeguard CMS program integrity.

A. Incoming Transition/Implementation Requirements

The CPIC shall work with the outgoing contractors to transition all FWA detection and prevention information, documents, data, and activities. As part of the transition periods, the CPIC shall immediately coordinate with the outgoing contractor regarding workload inventory and identified risks/challenges, conduct a kick-off meeting, and submit deliverables in accordance with the CPIC

SOW requirements. The CPIC shall lead regular transition meetings with CMS, the outgoing contractor, and the appropriate contractors/stakeholders and maintain minutes from those meetings. Meeting minutes shall be provided to CMS within three business days of the meeting date.

In the base year, the PPI MEDIC shall transition its Part C work to the CPIC. At the conclusion of the I-MEDIC contract, the I-MEDIC shall transition its Part C work to the CPIC. Both bodies of work shall include a transition period, after which the fully operational period shall begin. The outgoing contractor may remain in effect for an additional period of time in an effort to assist the incoming contractor with any operational issues they encounter.

The CPIC shall perform the tasks required to successfully implement program integrity operations, including transition of operations from outgoing program integrity contractor(s), including:

• Establish connectivity and participate in training sessions (as needed) to CMS and other appropriate systems as defined in Sections 3.2.1 and 6.1.8.1.

• Work with the COR team to identify the roles that the CPIC staff will play in the authorization scheme that will be present in the UCM, FPS, and any other applicable system(s). The authorization scheme will address issues such as multiple permissions, roles, investigation assignments, and prioritization of work.

• Enter into a Data Use Agreement (DUA) with CMS, as referenced in Section 6.3.

• Work with entities listed in Section 5.3 on establishing JOAs.

• Hire and train staff.

• Conduct validation and discussion between the incoming and outgoing contractor’s regarding the outgoing contractor’s Outgoing Transition Plan, to include what workload shall remain open and be transitioned and what shall be closed.

• Transfer and make accessible to the incoming program integrity contractor all appropriate data, files and information. The incoming contractor shall verify that all files and information have been received and are in a usable format.

• Ensure minimal disruption to program integrity partner operations (e.g., Law Enforcement, prescribers/providers/suppliers, etc.), ongoing investigations, administrative actions (e.g.

revocations underway) and active LE cases.

• Keep all interested parties informed of the transition’s status and progress.

• Ensure transition resources are effectively and efficiently used and transition activities are completed on schedule.

1. Kickoff Meeting w/ CMS

CMS will arrange a Kickoff Meeting with the CPIC within a mutually agreed upon timeframe after the contract award to review and answer any questions that the CPIC has about the contract and to assure that both the CPIC and the CMS have a joint understanding of all work, timeframes, and deliverables required by the contract. The CPIC will work with CMS to compile the agenda for this meeting. The CPIC shall be prepared to provide CMS with a brief presentation outlining the CPIC’s ideas for completing the requirements of the contract. The CPIC is responsible for preparing minutes from the meeting and submitting them to CMS in accordance with the Deliverables Schedule.

13. Implementation Meetings

The Contractor shall organize, host, and provide toll-free telecommunication lines and facilities for all implementation meetings. The meetings shall follow a prepared agenda and discuss the status of the major tasks, issues, deliverables, schedule, delays, problem resolution, and risk mitigation and contingencies. These meetings shall be held no less than every week, or more frequently if needed. These meetings shall include CMS representatives and all relevant stakeholders.

The Contractor shall document the minutes of each implementation meeting conducted. The Contractor shall also maintain an issue log.

B. Outgoing Transition Requirements

The CPIC shall work with the incoming contractor to transition all fraud and abuse detection and prevention information, documents, data, and activities. The CPIC shall transition out beginning four months prior to the end date of the final period of performance. The CPIC will be expected during this time to maintain operations while also meeting the below transition out activities. As part of the transition period, the CPIC shall assist the incoming contractor with transition activities, attend the incoming contractor’s kickoff meeting (if needed), attend the incoming contractor’s transition meetings, and submit deliverables in accordance with the CPIC SOW requirements. The CPIC shall attend transition meetings with the incoming contractor and maintain minutes from those meetings. Meeting minutes shall be provided to CMS within three business days of the meeting date.

The incoming contractor shall assume operational responsibilities three months after the beginning of implementation. During the fourth month of transition, the outgoing CPIC shall include only minimal staffing to assist the incoming contractor with any operational issues they encounter.

The transition period shall be four months. In a successful transition:

• Validation and discussion shall be had between the incoming and outgoing contractor’s regarding the outgoing contractor’s Outgoing Transition Plan, to include what workload shall remain open and be transitioned and what shall be closed.

• All appropriate data, files and information are transferred and made accessible to the incoming program integrity contractor.

• There is minimal disruption to program integrity partner operations (e.g. States, Law Enforcement, and providers/suppliers).

• There is minimal disruption of ongoing investigations, administrative actions (e.g. payment suspension actions, revocations underway) and active LE cases.

• All interested parties are kept informed…