Draft SOW Supplemental Medical Review Contractor.pdf

SMRC Statement of Work 1

Centers for Medicare & Medicaid Services

Supplemental Medical Review Contractor

(SMRC)

Statement of Work (SOW)

June 3, 2026

SMRC Statement of Work 2

Table of Contents I. Purpose II. Background III. Requirements

A. Collaboration with Other Internal and External Entities B. Information Technology (IT) Policies and General Requirements C. Privacy Act D. CMS Security and Privacy Language for Information & Information Technology E. CMS Data Use Agreements (DUA) F. Work Functions G. Tasks Capabilities & Requirements H. Assumptions and Constraints

IV. Key Personnel and Staffing V. Statement of Work Tasks

Task 1: PCG Specialty Reviews Task 2: Medical Reviews for Program Integrity Support Task 3: Perform Non-Medical Record Review Task 4: Discussion and Education (D&E) Task 5: Claim(s) Re-Review Task 6: Research Task 7: Data Analysis Task 8: Public Website Task 9: Public Portal Task 10: Customer Service Support Task 11: Defending Medical Review Decisions at Administrative Law Judge (ALJ) Hearings Task 12: Record Management and Work Tracking Task 13: Contract Ramp-Up and Contract Close-out & Transition

VI. Optional Tasks Optional Task 1: Ad-Hoc Innovation Project(s) Optional Task 2: Statistical Extrapolation of Overpayment or Potential Overpayment Optional Task 3: Recalculation of Statistical Extrapolation of Overpayment

VII. Deliverables Appendix A: CMS Security and Privacy Language for Information and Information Technology (IT) Appendix B. Information Security Certification Checklist Appendix C. Prospective Offeror Non-Disclosure Agreement Appendix D. Contractor Non-Disclosure Agreement Appendix E. References

SMRC Statement of Work 3

I. Purpose

The Centers for Medicare & Medicaid Services (CMS) is seeking a Supplemental Medical Review Contractor (SMRC) to perform post payment medical reviews (MR) and medical review related activities in support of initiatives within the Center for Program Integrity (CPI) to include the following:

1) The Provider Compliance Group (PCG) ‘Specialty Reviews’ for issues identified by Federal agencies, such as the Office of Inspector General (OIG)0F

1, Government Accountability Office (GAO) , and other CMS groups. In addition to support CMS’ internal data analysis programs to include the Comprehensive Error Rate Testing (CERT)1F

2 program; the First-look Analysis Tool for Hospital Outlier Monitoring (FATHOM)2F

3, and the Program for Evaluating Payment Patterns Electronic Reports (PEPPER)3F

4 reports (Task 1);

2) Program Integrity Reviews (Task 2), in collaboration with the Fraud Investigations Group (FIG), shall conduct nationwide. comprehensive medical review documentation in an effort to identify fraud, waste, and abuse (FWA) and protect the Medicare Trust Fund.

The purpose of the SMRC known as the “Contractor” for this SOW is to perform and/or provide support for a variety of tasks aimed at lowering the improper payment rates and increasing efficiencies of the MR functions primarily for Medicare Fee-for-Service (FFS). One of the primary tasks will be conducting large volumes of nationwide post payment MR as directed by CMS. The MR will be performed on Medicare FFS claims for Part A, Part B, and durable medical equipment, prosthetics, orthotics and supplies (DMEPOS) programs. The Contractor is expected to perform MR on a large volume of claims.

The Contractor must have the ability to respond to fluctuations in project/task assignment/claim volume without interruption to workflow. These medical review activities will assess compliance with Medicare’s coding, coverage, billing, and payment requirements and identify claims improperly paid. The Contractor will recommend recoupment and/or adjustment for claims identified as improperly paid as well as identify potential FWA. Having a centralized MR resource that can perform large volume of MR nationally shall allow for a timely and consistent execution of MR review, activities, and decisions. The Contractor shall conduct the reviews and submit completed reports to CMS as described in this Statement of Work (SOW). The Contractor shall select subject claims, perform research and/or data analysis, and conduct reviews in a manner that will minimize provider and supplier burden. The Contractor must have in place adequate facilities, personnel, and equipment to perform medical reviews.

II. Background

The Centers for Medicare & Medicaid Services (CMS) is the Federal agency that administers the Medicare and Medicaid programs. A top priority for CMS is reducing improper payments in the Medicare Fee-for-Service (FFS) program and reducing FWA. To protect the Medicare Trust Fund, CMS must prevent improper payments that result in a loss of taxpayer dollars. Preventing improper payments requires the active involvement of multiple components in CMS and effective coordination with its

1 For more information, see http://www.oig.hhs.gov/and http://www.gao.gov/.

2 The CERT program evaluates a statistically valid random sample of claims to determine if they were paid properly under Medicare coverage, coding, and billing rules.

3 FATHOM is a Microsoft Access application that allows CMS to provide each State with hospital-specific Medicare claims data statistics, which identify areas having high payment errors.

4 PEPPER is a comparative data report that provides hospital-specific Medicare data statistics for discharges vulnerable to improper payments.

http://www.oig.hhs.gov/ http://www.oig.hhs.gov/ http://www.gao.gov/ http://www.gao.gov/

SMRC Statement of Work 4 partners, including various Medicare Contractors and providers/suppliers. CMS evaluates medical records and related documents to determine whether Medicare claims were billed in compliance with statutory, regulatory and sub- regulatory coverage, coding, payment, and billing rules. Paid claims that do not comply with Medicare’s coverage, coding, payment and billing rules are considered improper payments.

Analyses of Medicare Parts A/B/DMEPOS claims data is one way to identify that Medicare may have paid claims improperly. Providers and suppliers may submit claims to various Medicare contractors under multiple provider numbers. In addition, some potential improper payments can only be identified when a provider’s Medicare claims data is compared to what that provider billed to a Medicaid agency or other public or private payer. These improperly paid claims could result in significant losses to the Medicare Trust Fund.

The Contractor claim reviews require, at a minimum, the clinical evaluation of medical records and related documents to determine whether Medicare claims were billed and paid in compliance with Medicare’s coding, coverage, billing and payment requirements. Statutory authority for the MR programs is found in Sections 1815(a), 1833(e) and 1862(a) of the Social Security Act (the Act).

III. Requirements

The Contractor shall perform in accordance with applicable laws, regulations, Medicare manuals, and CMS requirements to ensure the financial integrity of the Medicare program. The Medicare program’s legal, policy, and operating environment is complex, and the Contractor shall utilize or interact with certain CMS guidelines, systems, equipment, and operational capabilities in the performance of its functions.

A. Collaboration with Other Internal and External Entities

CMS depends on a close and coordinated working relationship between its internal components and external organizations. The Contractor shall work with and coordinate alongside CMS with, as necessary, external entities including, but not limited to, the following:

• State Agencies

• Investigative agencies (such as, but not limited to, OIG, GAO, Federal Bureau of Investigation

(FBI), Department of Justice (DOJ), and CMS Regional Offices)

• Program Integrity Contractors (UPIC/ National Benefit Integrity Medicare Drug Integrity

Contract (NBI MEDIC))

• Professional Organizations

• Infrastructure Service providers, other CMS Contractors, including but not limited to the

Medicare Administrative Contractors (MAC). The SMRC specifically will collaborate with the MAC for activities such as completion and maintenance of a Joint Operating Agreement (JOA) and/or Service Level Agreement (SLA).

• Medical Review Accuracy Contractor (MRAC)

B. Information Technology (IT) Policies and General Requirements

CMS requires its business partners to implement IT systems security controls to maintain the confidentiality, integrity, and availability of Medicare system operations in the event of computer incidents or physical disasters. The SMRC shall comply with the security requirements defined in the

SMRC Statement of Work 5

Business Partner System Security Manual (BPSSM), the CMS Information Security (IS) Acceptable Risk Safeguards (ARS), including CMS Minimum Security Requirements (CMSRs) (also known as IOM Pub.

100-25), and the Program Integrity Manual (IOM Pub. 100-8) all found at:

https://www.cms.gov/medicare/regulations-guidance/manuals/internet-only-manuals-ioms

The SMRC shall comply with the CMS Security Assessment and Authorization (SA&A) methodology, policies, standards, procedures, and guidelines for contractor facilities and systems. When using or disclosing protected health information (PHI), the SMRC shall comply with the Health Insurance Portability and Accountability Act (HIPAA) and policies listed below, as well as documents referenced within those policies:

1. The CMS Policy for Information Security and Privacy Policy (IS2P2) (as amended) https://security.cms.gov/policy-guidance/cms-information-systems-security-privacy-policy-is2p2 -- The high-level CMS policy for the CMS Information Security Program serves as the primary framework for protecting CMS information and systems. It mandates compliance with federal laws to secure Personally Identifiable Information (PII) and Protected Health Information (PHI), requiring all users to follow strict access controls.

2. The CMS Policy for Investment Management and Governance (as amended) https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/CIO- Directives-and-Policies/Downloads/POLICY_DL_InvestmentMgmt.pdf -- Establishes the policy for systematic review, selection/reselection, implementation/control, and continual evaluation of IT investments at CMS.

3. Cloud Services - All cloud-specific requirements will be as defined in CMS Information Security, Section 1.3, Cloud-based Services. However, for information identified as Personally Identifiable Information (PII), Protected Health Information (PHI), and/or Federal Tax Information (FTI), the additional security and privacy requirements listed in the ARS manual Implementation Standards (as amended), as applicable to PII, PHI, and/or FTI, shall be applied within cloud-based services.

4. The CMS Information Security website provides a list of applicable security policies and procedures across the program.

A summary of these requirements is listed in the Applicable Laws and Regulations sections of the above listed CMS policies, as well as in the Applicable Laws and Regulations section of the Health and Human Services (HHS) Office of the Chief Information Officer (OCIO) Policy for Information Systems Security and Privacy. Additionally, the Contractor shall incorporate and utilize the following information technology requirements:

• The Contractor staff shall be trained on security procedures as well as relevant aspects of the

Privacy Act, Health Insurance Portability and Accountability Act (HIPAA), and the Freedom of Information Act. The Contractor shall adhere to the 508 Accessibility clause (HHSAR 352.239- 73).

• The Contractor shall record completion of Information Security Awareness and Role Based

Security Training and retain the results in accordance with CMS procedures available at http://www.cms.gov/InformationSecurity. Training shall be consistent with the requirements contained in C.F.R. Part 5 Subpart C (5 C.F.R. 930.301) and conducted at least annually.

• The Contractor shall have in place a request management and prioritization system. This system shall allow for workflow management, prioritization of activities, identity management, user https://www.cms.gov/medicare/regulations-guidance/manuals/internet-only-manuals-ioms https://security.cms.gov/policy-guidance/cms-information-systems-security-privacy-policy-is2p2 https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/CIO-Directives-and-Policies/Downloads/POLICY_DL_InvestmentMgmt.pdf https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/CIO-Directives-and-Policies/Downloads/POLICY_DL_InvestmentMgmt.pdf https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/CIO-Directives-and-Policies/Downloads/POLICY_DL_InvestmentMgmt.pdf http://www.cms.gov/InformationSecurity

SMRC Statement of Work 6 provisioning requests and activity reports. This system shall ensure that MR projects are appropriately triaged and managed in a timely manner.

• The Contractor shall protect all CMS information from unauthorized access, use, disclosure, duplication, modification, diversion, or destruction, whether accidental or intentional, in order to maintain the security, confidentiality, integrity, and availability of such information. The Contractor shall become and remain compliant with the requirements set forth at the CMS Information Security website at https://www.cms.gov/Research-Statistics-Data-and- Systems/CMS- InformationTechnology/InformationSecurity/Info-Security-Library-Items/CMS- InformationSecurity-Contract-Clause-Provision.html

• The Contractor shall meet all FISMA/FedRAMP compliance requirements set forth at the CMS

Information Security website at https://security.cms.gov/

• The Contractor shall access the IOM Pub.100-08 and Business Partners Systems Security Manual (BPSSM) at https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/117_systems_security.pdf for guidance on both physical and operational security. Physical and operational security is essential for all CMS contracts.

• The Contractor shall comply with FAR 52.239-1 Privacy and Security Safeguards, HHSAR

352.239-72 Security Requirements for Federal Information Technology Resources, and HHSAR 352.239-71 Standard for Encryption Language.

• CMS’ Core Security Requirements, as defined in the CMS BPSSM, including security standards adopted under the Health Insurance Reform regulations published pursuant to the Health Insurance Portability and Accountability Act (HIPAA) (FR Volume 68, Number 34 of February 20, 2003), are applicable to this contract and to all subcontracts (see https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/117_systems_security.pdf).

• The Contractor shall check the following web site frequently for updates to the manuals and tools: https://security.cms.gov This page contains links to all of the security references needed for this SOW.

• The Contractor shall allow CMS to observe SMRC-conducted audits, reviews, evaluations, tests and assessments of the SMRC’s security program and facilities upon request. The results of any SMRC-conducted annual audits, reviews, evaluations, tests and assessments shall be made available to the Government for review.

• The Contractor shall utilize Electronic Submission of Medical Documentation (esMD) or applicable system for claims, prior authorization / pre-claim request review (esMD or other electronic medical system approved by CMS). The esMD system is operational at one of CMS Virtual Data Center (VDC) and allows providers and/or their represented agents known as Health Information Handlers (HIHs) to electronically submit medical documentation via a secure means to medical review Contractors. The esMD system is being reviewed to allow medical review Contractors to send claim review documents and data to providers via secure means. Any future updates to the system will be communicated to the Contractor by CMS.

• The Contractor will provide all program management support functions, to include the participation of the medical director on the contract with the esMD recommendation and https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-%20InformationTechnology/InformationSecurity/Info-Security-Library-Items/CMS-%20InformationSecurity-Contract-Clause-Provision.html https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-%20InformationTechnology/InformationSecurity/Info-Security-Library-Items/CMS-%20InformationSecurity-Contract-Clause-Provision.html https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-%20InformationTechnology/InformationSecurity/Info-Security-Library-Items/CMS-%20InformationSecurity-Contract-Clause-Provision.html https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-%20InformationTechnology/InformationSecurity/Info-Security-Library-Items/CMS-%20InformationSecurity-Contract-Clause-Provision.html https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-%20InformationTechnology/InformationSecurity/Info-Security-Library-Items/CMS-%20InformationSecurity-Contract-Clause-Provision.html https://security.cms.gov/ https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/117_systems_security.pdf https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/117_systems_security.pdf https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/117_systems_security.pdf https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/117_systems_security.pdf https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/117_systems_security.pdf https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/117_systems_security.pdf https://security.cms.gov/

SMRC Statement of Work 7 evaluation workgroup (esMD workgroup participation as required) to support the medical review conducted by the Contractor. In the initial implementation of the system, user requests will be made through a Contractor-furnished interface, and a completed report of each medical review project/task will be passed directly back to CMS.

• CMS has specific requirements when interfacing with other entities. Example entities that may interface with the Contractor include but are not limited to Medicare Administrative Contractors (MACs), Unified Program Integrity Contractor (UPIC), National Benefit Integrity Medicare Drug Integrity Contract (NBI MEDIC), the HFPP Trusted Third Party (TTP) and analytics contractors, Medical Review Accuracy Contractor (MRAC), and the other related entities as directed by

CMS.

• The SMRC and entities interfacing with the SMRC shall develop a Joint Operating Agreements (JOA) or Service-Level Agreements (SLA). These agreements ensure that all parties understand their respective roles and responsibilities. The Contractors shall execute, update, and perform associated duties in accordance with a JOA and/or SLA. A JOA and/or SLA defines mutually agreed upon and cost-effective methods of CMS contractors working together. Examples of activities that the JOA and/or SLA may cover are adjustment of SMRC claims review, handling and reporting identified as well as collected underpayments and overpayments, reopenings, appeals of SMRC adjusted claims, reporting for SMRC support operations, and other SMRC support activities.

• A JOA and/or SLA describes the work that needs to be accomplished, and the roles and responsibilities of each signatory to the success of the task or project. It includes specifics about who will do what, when, and for whom. The JOA and/or SLA also spells out the process the parties will follow if either believes that the other is not following the agreement, including any alternative dispute resolution procedures.

• Each JOA and/or SLA should include, but not be limited to, the following topics:

o Confidentiality o Definitions o Workload o Contract Roles and Responsibilities o Dispute Resolution o Connectivity o Communication

• The Contractor is responsible for identifying and negotiating any changes required to appropriately address the roles and responsibilities of the parties to the JOA and/or SLA. The Contractor is responsible for identifying and negotiating any changes required to appropriately address the roles and responsibilities of the parties to the JOA and/or SLA. NOTE: Other independent tasks will be performed concurrently while finalizing the JOA and/or SLA to ensure work continuity.

General CMS & Related Technical Standards

The Contractor should perform all work associated with this effort in a manner consistent with the requirements, methods, and goals described in the following references:

• Digital Services Playbook

• The Agile Manifesto https://playbook.cio.gov/ https://agilemanifesto.org/

SMRC Statement of Work 8

• The TechFAR Hub

• 18F API Standards

• White House API Standards

• Building the Twelve-Factor App

• Scaled Agile Framework (SAFe) Agile Framework

• Federal Cloud Computing Strategy “Cloud Smart”

• CMS Target Life Cycle (TLC) guidelines

• Section 508 at CMS

• CMS Information Security and Privacy

• Overarching CMS IT Guidelines

• Design Guidance at Digital.gov

• CMS Web Design System(s)

• CMS Data Administration framework: CMS guidance to support consistent creation, utilization, and maintenance of CMS data resources.

• Cybergeek

• CMS' open-source policy and helpful resources from the Digital Service at CMS (DSAC)

C. Privacy Act

Privacy Act: This contract is NOT subject to the Privacy Act of 1974, because this contract DOES NOT provide for the design, development, or operation of a system of records about individuals from which records are retrieved by name or other identifying particular.

D. CMS Security and Privacy Language for Information & Information

Technology

See Appendices for detailed security and IT requirements

E. CMS Data Use Agreements (DUA)

The CMS makes data files available to certain stakeholders as allowed by federal laws and regulations as well as CMS policy. CMS enters into Data Use Agreements (DUAs) with most data requesters for disclosures of protected health information (PHI) and/or personally identifiable information (PII) to ensure that data requesters adhere to CMS privacy and security requirements and data release policies. A CMS DAU is used to create a traceable record of what data is being accessed by each CMS contractor.

All CMS contractors requiring access to PHI/PII as well as their Contracting Officer Representatives (CORs) must create and maintain their CMS DUAs through the Enterprise Privacy Policy Engine (EPPE) system.

1. DUA Closeouts - CMS DUAs may only be approved for a period of up to one year. After one year, the DUA will expire unless the DUA Requester either extends or closes the DUA. If a DUA for an organization expires, it is important to note that ALL open DUAs for that organization will be frozen. This means that no new DUAs or actions on existing DUAs (adding data or changing contacts) will be processed for any DUAs held by that organization until the expired DUA is either extended or closed. The DUA system will send the DUA contacts (Requester, Custodians, https://techfarhub.cio.gov/ https://github.com/18F/api-standards https://github.com/WhiteHouse/api-standards https://12factor.net/ https://scaledagileframework.com/ https://cloud.cio.gov/strategy/ https://www.cms.gov/data-research/cms-information-technology/tlc https://www.cms.gov/data-research/cms-information-technology/section-508 https://www.cms.gov/data-research/cms-information-technology/cms-information-security-privacy-overview https://www.cms.gov/data-research https://digital.gov/topics/design/ https://design.cms.gov/?theme=core https://www.cms.gov/data-research/cms-information-technology/data-architecture-engineering https://security.cms.gov/ https://github.com/CMSgov/cms-open-source-policy/blob/master/Policy.md https://github.com/dsacms/repo-scaffolder

SMRC Statement of Work 9

COR, Federal Project Officer (FPO), and Principal Investigators) notification e-mails at the following intervals, before the DUA expires: 60 days, 30 days, 15 days, and every day thereafter.

It is not CMS’ responsibility to send reminders for recertifications.

2. EPPE - The EPPE is the system that tracks all disclosures of CMS data. Prior to gaining access to the EPPE system, contractors and CORS must complete EPPE training. For additional information about the DUA process and EPPE, see the Applicable DUA Links Table below. CMS Contractors are required to process DUA requests in EPPE. Please see the CMS Contractor web page (link included in table below) for instructions on how to Extend/Close DUAs.

Applicable Links:

• Data Use Agreement: https://www.cms.gov/about-cms/information-systems/privacy/data-use-agreement-dua

• Data Available to CMS Contractors: https://www.cms.gov/data-research/cms-data/data-available-cms-contractors

F. Work Functions

CMS Team for the SMRC Work Certain CMS staff shall serve as Business Function Leads (BFL), Alternate Contracting Officer Representatives (ACOR), Subject Matters Experts (SMEs), and Program Lead (PL) to assist the COR in operationalizing this contract. These CMS staffs are referred to as the COR ‘designees’ in this document.

The PL/SME/BFL/ACOR are not authorized to direct changes to the terms of this task order. Only the COR can give technical direction to the contractor.

Project Initiation A project starts when the COR or designee initiates work through technical direction in a format defined by CMS. The project initiation will entail details of the project, such as background, type of activity, type of claims, dates of services and other pertinent data to begin the project. The SMRC shall acknowledge their understanding of the project. Any updates and/or changes to the project will require modified technical direction and an updated acknowledgement of understanding from the SMRC. The COR designees, as described above, shall provide operational guidance to the Contractor on matters within COR designees’ area of responsibility.

The Contractor must provide an auditable record of work requests and a process to prioritize and assign Contractor personnel to ensure timeliness in processing medical reviews.

If the Contractor disagrees with the project details directing the work, the contractor will provide justification and supporting rationale for review and consideration to the COR and/or designees.

Work not related to an agreed upon project will require written approval prior to the Contractor incurring costs. The exceptions to this will be for requests for re-review communicated by the MAC, and requests by the MAC for documentation for the purpose of appeals, in accordance with the agreed upon process in the SMRC-MAC JOA. In these cases, the Contractor will provide the detailed information for the completion of these tasks in the monthly status report for the purpose of reconciling invoices.

The Contractor shall perform and/or support MR projects/tasks at the direction of CMS. The Contractor must provide analysis of the MR performed. The Contractor shall perform the MR projects, and/or tasks based on the work request procedures and delivery acceptance criteria described in this SOW.

1. Start-Up https://www.cms.gov/about-cms/information-systems/privacy/data-use-agreement-dua https://www.cms.gov/about-cms/information-systems/privacy/data-use-agreement-dua https://www.cms.gov/about-cms/information-systems/privacy/data-use-agreement-dua https://www.cms.gov/data-research/cms-data/data-available-cms-contractors https://www.cms.gov/data-research/cms-data/data-available-cms-contractors https://www.cms.gov/data-research/cms-data/data-available-cms-contractors

SMRC Statement of Work 10

a. Staff: The Contractor shall ensure all necessary staff is hired prior to the start of the first MR project.

2. Training

a. The Contractor shall ensure the staff has the training necessary to complete the SOW tasks prior to the start of the first project. This training shall include at a minimum:

i. General Medical Review tasks

ii. Procedures on what to do for claims that are complicated and need a senior level or Medical Director review

iii. Policies for identifying, alerting program management, and mitigating potential conflicts or program risks, and

iv. Policies on security and non-disclosure of any medical information and records.

3. Provider/Supplier Communication

a. The Contractor shall develop a model for communication with the provider/supplier community that can be modified to fit the specific project topic. The communication should include:

i. A standard Additional Documentation Request (ADR) Letter. The Contractor shall submit a ADR letter template to CMS for review and approval.

ii. A general script to answer frequently asked provider/supplier questions

iii. A contact number and procedure for provider/suppliers to call with questions.

4. CMS will direct the Contractor to conduct MR projects/tasks. MR projects/tasks shall be provided via a secure environment.

5. The Contractor shall capture MR projects/tasks information and/or reports in an electronic format for transmittal to CMS via a secure environment.

6. The Contractor shall develop a process for receipt of work requests, prioritization of work, and monitoring of work completion. This workflow process shall have the capabilities to develop/produce project status updates for every aspect of the medical review project. The workflow process shall be detailed in a chart. The Contractor shall have in place a mechanism to oversee and monitor the progress of all assigned projects. Monthly updates will be provided to CMS. Additionally, the contactor shall be able to provide status updates on an ad hoc basis.

7. The Contractor must have the capability to breakdown all costs on a project-by-project basis and submit a monthly cost report to CMS.

8. The CMS periodically evaluates medical review determinations made by a variety of CMS contractors performing medical review of Medicare claims, including the Contractor. This is to ensure that medical review is being conducted consistently across all medical review contractors.

As such, upon request, the Contractor shall provide to CMS or a designated accuracy contractor a list of all completed medical review claims for active projects by both work streams for sampling selection by CMS or the designated accuracy contractor.

Fifty (50) medical review cases shall be provided to the designated accuracy contractor and shall be comprised of medical review conducted by both work streams. The type of medical review cases to be submitted will be determined by CMS. CMS may request an increase or decrease in the number of claims per month for Quality Assurance (QA) purposes at any time.

The CMS Medical Review Accuracy Program Lead will notify the Contractor of the outcome of

SMRC Statement of Work 11 their medical review case evaluations. The Contractor will have the opportunity to provide a rebuttal for any cases for which there is a disagreement between the SMRC and the CMS Medical Review Accuracy Contractor. At CMS discretion, CMS reviews disagreements between MR contractors and the Medical Review Accuracy Program Contractor. CMS findings will be shared with the SMRC Contractor. The Contractor shall maintain a 95% accuracy score or greater each month for all tasks, individually.

NOTE: For this document, any reference to “days” is considered to be “business days,” unless otherwise specified.

G. Tasks Capabilities & Requirements

The following Tasks Capabilities & Requirements shall be followed by the Contractor:

1. Response time – Ability to perform medical review and submit reports to CMS within specified response times as outlined in the PIM (including any future revisions of the PIM, where applicable). The provider/supplier response time to a request for additional medical documentation shall be 45 days as currently stated in IOM 100-8. This instruction to the provider/supplier shall be included in the Contractor’s Request for Additional Documentation (ADR) letter. The Contractor has the discretion to grant extensions.

2. The Contractor may complete projects in phases, upon CMS approval. If projects are completed in phases, the SMRC shall send Final Review Results letters to the provider/supplier at the end of each phase, conduct requested Discussion and Education periods at the end of each phase and send overpayment recovery information to the Medicare Administrative Contractor at the end of each phase. The SMRC may deliver one Final Project Report after completion of each project.

CMS further directs that whenever possible, claims be placed in phases according to the date of service (DOS) beginning with the earliest claims. For example, if Phase 1 consists of 1000 claims, those 1000 claims will be ordered by DOS starting with the earliest DOS. In addition, CMS directs that the time between phases should be no longer than two to three weeks.

3. Data Collection, Information Transfer, Integration and Reporting – Ability to complete the following types of activities:

a. The Contractor shall obtain the training and access required to the CMS designated system for claim data collection and analysis

b. Collect medical review specific information based on parameters defined by CMS for the specific project/task to be performed via the designated CMS system

c. Perform overpayment extrapolation(s)

d. Recovery Auditor Data Warehouse (RACDW): The Contractor shall obtain access to the

RACDW. Prior to selecting claims for review, the Contractor shall not select for review any claim that has been marked excluded or suppressed in the RACDW. In addition, the Contractor shall upload to the RACDW the claims it has chosen for review at or before the time that the ADR letters are sent in the revised file format requested by CMS and at other times in keeping with RACDW instructions.

i. The Contractor shall upload to the RACDW available milestones of a claim review and its final conclusion of the claim and must include but not be limited to:

1. Date of ADR request

2. Date medical records were received from the provider

SMRC Statement of Work 12

3. Date of improper payment notification to the provider (final review results letter)

4. Whether there was an overpayment/underpayment

5. Reasons for denial

ii. The above milestones must be entered if information is available even though it may not be a required field in the RACDW file layout

iii. Updates shall be made daily to the RACDW to ensure claims status are kept current.

e. Ability to send secured claims data via compact disc (CD) or other electronic media for overpayments to be collected to the appropriate MAC. In order to determine the actual overpayment amount, the claim adjustment will have to be completed by the MAC. The MAC will send the demand letters and complete the claim adjustments. The Contractor will submit to the MAC claims data within 30 days following the final scheduled D&E period for each phrase of the project.

4. Medical Reviewer/Personnel Credentials, Screening Tools/Checklists, Training, Management Support and Oversight - Ability to provide the following:

a. Employ personnel that understand the services provided by various types of healthcare providers/suppliers. Personnel performing complex medical review are required to have a clinical background. (Program Integrity Manual (PIM), Credentials of Reviewers)

b. The Contractor shall ensure that complex reviews for the purpose of making coverage determinations are performed by registered nurses (RNs) or physicians licensed to practice medicine in the United States. During a complex review, registered nurse and physician reviewers may call upon other health care professionals (e.g., dieticians, therapists, or physician specialists) for advice.

c. The Contractor shall ensure that services reviewed by other licensed health care professionals are within their scope of practice and that their project-specific MR strategy supports the need for their specialized expertise in the review of a particular claim type (i.e., speech therapy claim, physical therapy).

d. The Contractor shall ensure that complex reviews for the purpose of making coding determinations are performed by certified professional coders.

e. Employ clinical personnel that possess critical thinking skills that can be applied when rendering clinical review judgment based on their clinical expertise.

5. Training methods shall be in place to familiarize medical reviewers/support staff with techniques and procedures for completing the process of medical review, to include knowledge of Medicare statutory and regulatory requirements as well as sub-regulatory/guidance required to make a claim payment decision based on medical review (for example, medical necessity). Any computer or instructor lead training shall not interfere with medical review timelines or contribute to lengthy project completion.

a. The Contractor’s training plan and maintenance of training materials shall take into account changes in CMS regulations, guidance, manuals, or forms.

b. The Contractor shall present and maintain a Quality Control plan for this assessment/training of MR personnel.

c. Documentation to verify that staff trainings have been completed shall be made available to CMS upon request. Documentation will include the dates of training and the date the individual started performing duties independently relative to this contract.

NOTE: The Contractor must provide any medical review project training materials to CMS upon request as it relates to projects performed for this Task Order.

SMRC Statement of Work 13

H. Assumptions and Constraints

The assumptions specified below relate to responsibilities and tasks that are included in this Statement of Work and may provide a basis for the contractor to determine the level of effort and resources that may be required. The Contractor shall furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the requirements of this SOW. Any and all materials and communications used to accomplish the work under this contract shall be used only when authorized in writing by the COR. This prior approval requirement shall also apply to all agents of the Contractor, including subcontractors. Deliverables shall be provided to the COR and/or designees in either hard copy or acceptable electronic format where applicable.

All written materials including, but not limited to, agenda, meeting minutes, manuals, reports, transcripts, and issuer-interfacing documentation, shall be in plain language English and submitted to and approved by the COR. The Contractor shall conform to all confidentiality requirements with regard to handling paper and electronic issuer information. The Contractor shall work closely with the COR to ensure the fulfillment of all requirements.

• The Contractor shall provide all necessary work locations to include telework availability, to support its personnel and enable delivery of Medical Review project/task services to CMS within the response time requirements established for this contract award, and to meet the requirement to perform or support medical review activities submitted from all fifty (50) states and in six (6) territories.

• The Contractor shall furnish the Information Technology (IT) environment and any equipment required by its personnel to complete the medical review project/tasks and reports.

• The Contractor shall have the capability to breakdown all costs on a project-by-project basis and submit a monthly cost report to CMS.

• The Contractor shall be responsible for purchasing any hardware or software needed to accomplish their tasks.

• Any use of Artificial Intelligence (AI) or Artificial Intelligence Assisted tools including but not limited to ChatGPT, Microsoft Copilot, Google Gemini, Claude AI, etc. utilized to perform/assist with work performed under this SOW, requires prior approval from CMS.

• Any Contractor updates/improvements/efficiencies in excess of $100,000 shall require formal notification to CMS via email and must be accompanied by a white paper. CMS written approval is required prior to incurring any costs related to these updates/improvements/efficiencies.

• The Contractor shall provide key CMS staff with access to propriety system/software for claims review results or provide a report with claims review results.

• CMS anticipates the primary means of contact to providers/suppliers and/or other universe population for the SOW will include but is not limited to phone calls, emails, fax blasts and/or other electronic messaging. Print mailings may occur weekly for up to 70 providers per mailings to be paid by the contractor.

• Travel to CMS office may occur 4 times per year by the Contractor’s key personnel, subject to CMS approval. Industry training\conferences\seminars\webinars is up to CMS discretion and approval. The Contractor shall account for these costs. All travel and attendance at events requires CMS pre-approval. Any presentations, materials, etc. that the Contractor may develop for use at these events where the Contractor is presenting/actively participating must be approved by CMS ahead of time. Any medical review topics must be reflective of findings/information from projects done by the Contractor. All presentation topics must be approved by CMS.

• CMS requires the Contractor to complete required CMS online trainings yearly. These training modules will be web-based and must be taken by all employees working on this task order. Each

SMRC Statement of Work 14 training course should take no more than an hour. It is anticipated that there will be up to 6 annual mandatory online trainings that the Contractor should allocate for in its costs (examples of training are: Ethics, Records Management, Security Controls

• Contractor is to maintain and operate a toll-free number for CMS communications and meetings.

• Minutes shall be provided to the COR and/or designees within four business day after the status, meetings and/or progress updates, as requested.

NOTE: The SMRC shall agree that it will acquire no right, title or interest (including any license rights or rights of use) to any work product resulting from the provision of this task order including project related medical review training materials. Data obtained and its output to perform work under this SOW shall remain the exclusive property of CMS. The Contractor acknowledges and agrees that it will acquire no right, title or interest other than its proprietary systems that may have been used to carry out work duties. Furthermore, any data including but not limited to data obtained and its output, claims data, medical records and the data contained within medical records arising from the work performed under this SOW shall remain the exclusive property of CMS. The aforementioned data must not be shared in any form or variation with persons or entities outside of CMS without the express written permission of CMS. Failure to obtain the necessary permission from CMS may result in the pursuit of remedies for noncompliance up to and including contract termination.

IV. Key Personnel and Staffing

The Contractor shall provide appropriate personnel who shall be designated as “key” personnel. Key personnel shall be fully dedicated to the SMRC, and their time shall not exceed one Full Time Equivalent (FTE). The following project positions are hereby designated by CMS as key and as such require the Contracting Officer’s approval as required in the contract. All personnel employed must also meet a requirement of never having been sanctioned or excluded from the Medicare Program.

CMS shall provide approval of all key personnel before all are hired. The Contractor shall notify CMS of any key personnel leaving the program. Prior to diverting any of the key personnel to other programs, the Contractor shall notify the COR reasonably in advance and shall submit justification (including proposed substitutions) in sufficient detail to permit evaluation of the impact on the program. All proposed substitutions must be submitted, in writing, to CMS at least thirty (30) days prior to the proposed substitution or as soon as reasonably known. Each request shall provide a detailed explanation of the circumstances necessitating the proposed substitution, a complete resume and any other information required by CMS. All proposed substitutions must have qualifications equal to or greater than the person(s) being replaced. CMS anticipates that substitution of key personnel will be kept to a minimum to promote continuity and quality.

Any staff identified as key personnel must have a backup who is properly trained and qualified to act as a fully functioning replacement in the absence of the key person.

The COR and/or designees must be notified when key personnel are out of the office for an extended period of time (more than 2 days). In these instances, the name and contact information, including telephone number and email address, of the backup must be provided to the COR and/or designees prior to the absence of the key personnel.

The key personnel noted below shall possess the following minimum work experience and educational requirements:

SMRC Statement of Work 15

Project Manager

The Project Manager shall be fully dedicated to this contract. The Contractor shall dedicate a Project Manager whose roles and responsibilities shall be defined by the Contractor’s technical approach and management plan. The Project Manager will serve as the point of contact for all aspects concerning this task order. The Project Manager will also have primary responsibility for the development, oversight and implementation of the Contractor’s quality assurance process. In addition, the Project Manager shall have the primary responsibility for making sure that the required reports are submitted timely.

The Project Manager shall possess:

Experience: A minimum of five (5) years of professional work experience in the healthcare industry supporting either Federal Government agencies or Commercial Healthcare Market as a Project Manager, Project Leader, Operations Manager, Technical Project Manager, or Product Manager. Including at least three (3) years as a manager responsible for oversight of complex medical review systems and workflow and not limited to personnel management. The Project Manager shall also possess at least three (3) years of Medicare Fee-for-Service experience, particularly the coverage and payment rules of the Medicare program. The Project Manager shall have and maintain certification in Project Management.

Educational Requirements: A bachelor’s degree from an accredited institution in a healthcare relevant field, plus a master’s degree in Accounting, Business, Public Administration, or other Healthcare relevant field, from an accredited institution or substitution of four (4) additional years of related work experience in lieu of the master’s degree.

Assistant Project Manager

The Assistant Project Manager shall be fully dedicated to this contract. The Assistant Project Manager will assist the Project Manager and teams in structuring, planning, and monitoring projects, and other related duties in line with the Contractor’s defined strategy and project objectives. In addition, this role will require working closely with the Project Manager to ensure that projects are managed in accordance with Contractors’ technical approach and management team. In the absence of the Project Manager, the Assistant Project Manager shall be able to function in the role as the Project Manager.

The Assistant Project Manager shall possess:

Experience: A minimum of three (3) years of professional work experience in the healthcare industry supporting either Federal Government agencies or Commercial Healthcare Market as a Project Manager, Project Leader, Operations Manager, Technical Project Manager, or Product Manager. Including at least two (2) years as a manager responsible for oversight of complex medical review systems and workflow and not limited to personnel management. The Project Manager shall also possess at least two (2) years of Medicare Fee-for-Service experience, particularly the coverage and payment rules of the Medicare program. The Assistant Project Manager shall be working towards certification in Project Management, if not already obtained.

Educational Requirements: A bachelor’s degree from an accredited institution in a healthcare relevant field, plus a master’s degree in Accounting, Business, Public Administration, or other Healthcare relevant field, from an accredited institution or substitution of four (4) additional years of related work experience in lieu of the master’s degree.

Contractor Medical Director (CMD)

SMRC Statement of Work 16

The CMD shall be fully dedicated to this contract. The Contractor shall arrange for a CMS-approved alternate CMD when the primary CMD will be unavailable for an extended period, for example 30 calendar days or more. The CMD must be either a Doctor of Medicine or a Doctor of Osteopathy who has Medicare FFS claim experience to oversee medical review. More than one individual’s time cannot be combined to meet the one FTE minimum. The CMD must be approved by CMS.

To prevent conflict of interest, the CMD must provide written notification to CMS within three months after the appointment, election, or membership effective date if the CMD becomes a committee member or is appointed or elected as an officer in any state or national medical societies or other professional organizations. The SMRC shall ensure that the CMD does not supervise claims from a provider who was their employer within the previous 12 months.

The CMD shall possess:

Experience:

• A minimum of three (3) years’ experience practicing as a Doctor of Medicine or Doctor of Osteopathy who is currently licensed to practice in the United States with no previous sanctioning or exclusion from the Medicare program.

• A minimum of two (2) years prior work experience in the health insurance industry, a utilization review firm, or another health care claims…