J.1 Appendix A - Statement of Work 2022 (final).docx

WORKERS’ COMPENSATION REVIEW CONTRACTOR (WCRC)

Statement of Work

WORKERS’ COMPENSATION REVIEW CONTRACTOR (WCRC)

Fbruary 15, 2022

Revised February 15, 2022

Contents

BACKGROUND

Workers’ Compensation (WC) Insurers, agencies, and attorneys have significant responsibilities under the Medicare Secondary Payer (MSP) provisions of the Social Security Act Section 1862(b) [42 U.S.C. 1395y] to protect Medicare’s interests. Because Medicare does not pay for an individual’s WC-related medical services and/or prescription drugs when the individual receives a WC settlement that includes funds for future medical and/or prescription drug expenses, it is highly critical that the individual consider Medicare’s interests at the time of settlement. For this reason, CMS recommends that parties to a WC settlement set aside funds, known as a Workers’ Compensation Medicare Set- Aside Arrangement or “WCMSA,” for all future medical and/or prescription drug expenses related to the WC injury or illness/disease that would otherwise be reimbursable by Medicare.

More information on CMS policies, procedures, and operational guidelines pertaining to the CMS WCMSA review process is available at: http://www.cms.hhs.gov/WorkersCompAgencyServices.

Medicare Overview Medicare is a nationwide Federal health insurance program administered by the Centers for Medicare & Medicaid Services (CMS). Congress enacted Medicare in 1965 as Title XVIII of the Social Security Act (“the Act”; 42 U.S.C. § 301 et seq.) for persons 65 years of age or older, certain younger disabled persons, and persons with end-stage renal disease (ESRD)1. The Medicare program serves well over 43 million beneficiaries and processes over one billion claims per year. Fee-for-service (FFS), or “traditional,” Medicare consists of two primary parts: Hospital Insurance (HI) otherwise known as Part A, and Supplemental Medical Insurance (SMI) also known as Part B. A third part of Medicare, known as “Medicare Part C” or the “Medicare Advantage (MA) program,” was established by the Balanced Budget Act of 1997 (Public Law 105-33). It allows beneficiaries the option of receiving their Medicare benefits through private managed care plans and related kinds of organizations. Finally, the Medicare prescription drug program, also known as “Medicare Part D,” was enacted as part of the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA).

Medicare Part A covers some of the costs of providing medically necessary inpatient hospital care, skilled nursing facility care following hospital care, home health agency, and hospice care. Individuals entitled to Social Security or Railroad Retirement benefits become automatically entitled to receive premium-free Part A benefits beginning with the first day of the month in which those individuals attain the age of 65; those not automatically entitled to such benefits may enroll and purchase Part A once they attain age 65. Other persons who are also automatically entitled to Part A include: 1) people younger than age 65 who receive Social Security disability benefits (after a defined waiting period) and meet certain qualifications; 2) persons with ESRD who met certain criteria; and 3) individuals who worked in particular Medicare-qualified Federal, state, or local government positions, provided certain conditions were met.

Medicare Part B helps pay for certain physician services (in hospital and non-hospital settings), outpatient hospital services, certain home health services, diagnostic and laboratory tests when medically necessary, and other medical services, equipment and supplies not covered under Part A. Part B benefits are available to almost anyone age 65 or older regardless of entitlement to Part A and to all beneficiaries entitled to premium-free Part A. Part B carries a premium and is an optional benefit program under Medicare, meaning that eligible individuals may enroll to become entitled to Medicare Part B or may decline enrollment based upon various factors, including continued active employment. MA plans are an alternative to traditional FFS Medicare whereby individuals entitled to Part A and enrolled in Part B, except for those who are entitled based upon ESRD, may elect to receive Medicare benefits by enrolling in a private Medicare managed care plan. The CMS contracts directly with qualified plans and those plans must offer a full range of Medicare benefits, and pay a fixed monthly amount for each enrolled beneficiary. MA plans may, but are not required to, offer Part D prescription drug benefits, as discussed below.

The Part D program works similarly to the MA program in that benefits are offered through private plans. To be eligible to enroll in Part D, a Medicare beneficiary must be either entitled to Part A or enrolled in Part B (whether he or she receives benefits through FFS Medicare or through the MA program). A beneficiary with FFS Medicare may enroll in a Prescription Drug Plan (PDP) for stand-alone Part D benefits. A beneficiary in the MA program must receive all Medicare benefits through the same MA plan; those MA entities that provide Part D benefits are identified as MA-PD plans or MAPDPs. The Medicare program’s authorizing statutes charge the Secretary of the Department of Health and Human Services (DHHS) with administrative responsibility for the Medicare program. In turn, the Secretary has delegated the program authority for Medicare to the Administrator of CMS. Additionally, the Social Security Administration (SSA) is responsible for initially determining an individual’s Medicare entitlement and for maintaining the Medicare Master Beneficiary Record (MBR). The CMS administers the Medicare program through activities such as:

· program policy and guidance formulation and promulgation;

· contract execution, operation and management;

· utilization record maintenance and review; and

· general Medicare financing. The CMS performs such administration through a complex set of relationships involving the private insurance industry, state and local governments, and thousands of independent hospitals, physicians, providers, and suppliers.

Sections 1816(a) and 1842(a) of the Act provide that public or private entities and agencies may participate in the administration of the Medicare program under contracts or agreements entered into with CMS. These contractors are known as “Medicare Administrative Contractors” (MACs). With certain exceptions, MACs perform bill processing and benefit payment functions for program. For clarity, this document uses the following rules when referring to contractors:

· where only one contractor or contracting type is relevant, it will be specifically identified;

· the phrase “Medicare claims processing contractors” refers collectively to MACs and DME MACs; and

· the phrase “Medicare contractor” encompasses any entity that contracts with CMS to perform Medicare functions.

The Medicare Integrity Program (MIP) The Health Insurance Portability and Accountability Act of 1996 (HIPAA; also known as Public Law 104-191) added § 1893 to the Act establishing the Medicare Integrity Program (MIP; 42 U.S.C. § 1395ddd). This program is funded from Medicare’s Federal HI Trust Fund for activities related to both Medicare Parts A and B. Specifically, § 1893 enables CMS to contract with an expanded pool of eligible entities to carry out certain Medicare program integrity activities that were being performed under contracts with FIs and carriers. The contractor under this SOW, the Benefits Coordination and Recovery Contractor (BCRC), and the Commercial Repayment Center Contractors (CRC), exist under such authority. On March 20, 1998, CMS published a notice of proposed rulemaking in the Federal Register (63 FR 13590) regarding MIP contracting authority. However, § 1893 authorizes CMS to enter into MIP contracts without publication of a final rule (see MSP Governing Statute and Implementing Regulations; MIP Regulation for more information).The MIP activities identified in § 1893 include: 1) conducting medical reviews of claims to determine whether the services rendered were medically necessary and met an appropriate level of care; 2) detecting and deterring Medicare fraud, waste and abuse; 3) auditing provider cost reports; 4) developing/updating the list of durable medical equipment subject to prior authorization; and, most importantly for purposes of this Statement of Work (SOW), 5) ensuring that Medicare pays appropriately when a beneficiary has other insurance. This last activity is known as “Medicare Secondary Payer” (MSP) and involves those situations in which Medicare does not have primary legal responsibility for paying a beneficiary’s health care expenses (see Section D, The MSP Program, below).

The MSP Program MSP involves those functions or activities performed to identify situations where another entity has payment responsibility before Medicare to recover Medicare primary payments made when another payer rightfully held primary responsibility. Furthermore, § 1862(b)(2)(A)(ii) of the Act (42 U.S.C. § 1395y(b)(2)) and the implementing regulations in 42 CFR Part 411 preclude Medicare from making primary payment where the beneficiary is:

· age 65 or older and covered under an employer’s group health plan (GHP) based on the current employment status of the individual or of his/her spouse (of any age), and

· the employer has at least 20 employees, or

· the GHP is part of a multi-employer or multiple employer plan where at least one employer has at least 20 employees and the GHP has not received a formal exception under 42 CFR 411.172(b);

· under age 65, entitled to Medicare on the basis of disability, and covered under an employer’s large group health plan (LGHP) based on his/her own current employment status or the current employment status of a family member. An LGHP is a plan where:

· the employer has 100+ employees, or

· the GHP is part of a multi-employer or multiple employer plan where at least one employer has 100+ employees;

• within the first 30 months of eligibility/entitlement to Medicare based on having permanent kidney failure or ESRD and is covered under any GHP (regardless of size or employment status). Additionally, Medicare may not make payment where payment has been made, or can reasonably be expected to be made, under a workers’ compensation (WC) law or plan, under no- fault insurance, or under liability insurance (including self-insurance). An entity that engages in a business, trade, or profession is deemed to have a self-insured plan if it carries its own risk, whether by a failure to obtain insurance or otherwise, in whole or in part. A primary plan’s responsibility for such payment may be demonstrated by a judgment, a payment conditioned upon the recipient’s compromise, waiver or release (whether or not there is a determination or admission of liability) of payment for items or services included in a claim against the primary plan or the primary plan’s insured, or by other means.

MSP Information Gathering Processes In order for Medicare to pay claims in the proper order and recover payments accurately, information about beneficiaries’ other health benefits insurance must be taken from various parties and verified, conflicts must be resolved, and further investigation or “development” must be conducted to determine what entity has primary payment responsibility.

SOW OVERVIEW

Scope The Workers’ Compensation Review Contractor (WCRC) shall, in accordance with CMS guidelines, evaluate Workers’ Compensation Medicare Set-aside Arrangement (WCMSA) proposals and project the future medical costs, including prescription drugs, related to the workers’ compensation (WC) injury, illness, or disease that would be otherwise reimbursable by Medicare. This future cost projection is known as the WCMSA. The contractor shall, upon reviewing complete WCMSA proposals, recommend the WCMSA amount for each proposal to CMS for final determination.

Purpose The purpose of this contract is to procure an impartial entity, not as an agent of the Federal government, to independently price the future Medicare-covered medical services costs related to the WC injury, illness, and/or disease and to price the future Medicare covered prescription drug expenses related to the WC injury, illness and/or disease thereby taking Medicare’s payment interests appropriately into account.

PERIOD OF PERFORMANCE

The period of performance for this effort is one Base Period plus four one-year option periods. The transition-in period shall be the first 90 days of the contract base year of the newly awarded contract. The transition out period will take place during the last 120 days of the last fully operational, exercised, option year.

TECHNICAL REQUIREMENTS

General This section outlines CMS’ expectations of the contractor in terms of technical assumptions governing its process and procedural roles to be executed as an operator of the Workers’ Compensation Case Control System (WCCCS). This section also supplies CMS’ expectations concerning attendant technical business processes systems—including, but not limited to, operational and customer service components—that the contractor shall be expected to fulfill in performance of the WCRC contract.

Assumptions

1. The CMS will make available an electronic case control system and network interface for the contractor’s use. The electronic case control system referred to as the Workers’ Compensation Case Control System (WCCCS) is a national database, hosted and maintained by the Medicare Secondary Payer System Contractor (MSPSC) which stores claimant data pertaining to the submitted WCMSA proposal. Additionally, CMS shall make available access to the Common Working File (CWF) for the purpose of verifying certain Medicare eligibility statuses. Finally, the CMS will provide access to the Document Management System (DMS) for electronic tracking and delivery of deliverables. When a WCMSA proposal is received, CMS creates a case file for the claimant associated with the proposal and the submitted documentation is imaged into the corresponding claimant case file for processing. The contractor shall use the information submitted through the WCCCS to evaluate the WCMSA proposals. In addition, the contractor shall document its evaluation of the case file and recommend an independently priced WCMSA amount to CMS. A copy of the WCCCS user guide is attached in Appendix “C.”

2. The contractor shall review all WCMSA proposals within 20 business days inclusive of screening after the initial date of receipt, excluding development of the cases, and provide its recommended amount to CMS. Please refer to section C.3.2.1 for CMS’ proposal review time lines. It should be noted that a Saturday/Sunday/Holiday receipt of information will be reviewed as having been received on the next business day. For staffing and other resource considerations, the contractor shall anticipate receiving 1,600 new WCMSA proposals per month, which represents forty-two (42) percent of the average workload on hand. This is based on recent historical data. Additionally, the contractor should anticipate a workload from proposals received in previous months that are in various stages of review/completion (e.g., development, etc.). Historically, the WCRC has received approximately 19,000 cases annually, with roughly 14,000 of those reviewing through approval recommendation. There are about 5,000 developments from that group. However, additional cases that come back from development and are completed total roughly an additional 13,000, annually. The disparity between these totals is that some of these cases are returns from previous months or years. Approximately ten (10) percent of all cases will be re-reviewed at some time in the future.

3. Optional Non-Group Health Plan work, inclusive of LMSA and NFMSA, may (or may not) be exercised based upon submission receipts, unrealized legislative Acts, or regulatory and CMS policy changes. Optional Non-Group Health Plan work, inclusive only of LMSA and NFMSA is not expected to be exercised sooner that Option Year 1.

4. The transition period will last 4 months, during which time, the incoming contractor will not be operational, therefore the base period will include 8 months of operations.

4.1. Transition shall include:

· Physical location distribution of resources;

· Network resource development (to include security requirements);

· Internal training development;

· Staffing and training of personnel

· Familiarization with CMS-acceptable standards for review;

· Any items not directly mentioned necessary for contract cutover.

5. The contractor shall establish, create, and maintain the ability to identify, isolate, and expedite the processing of high-priority cases to address the special needs of the Medicare population. This includes cases with severe claimant financial hardship or catastrophic health problems and those with Congressional interest. The contractor shall process expedited cases within two (2) business days after the date of initially receiving the expedited request from the CMS (e.g. expedited request received on a Monday, the contractor shall process the case by 6:00pm Wednesday of the same week).

6. Occasionally, misdirected documents (less than 10 pages per month) will come to the WCRC; as a result, the contractor shall have documents scanned by the BCRC into the WCCCS and append these documents to the appropriate case. The contractor shall maintain a dedicated fax machine for privacy reasons to receive additional information that submitters might fax to the contractor, and the contractor shall have these documents scanned to the appropriate case by the BCRC. See the WCMSA Reference Guide.

6.1. The contractor shall ensure that:

· All software and hardware supporting the contractor’s systems is maintained at the contractor’s facility, unless otherwise directed by the CMS Contracting Officer’s Representative (COR) or Alternate COR (ACOR);

· Unless otherwise noted, the contractor shall submit all deliverables to the CMS Contracting Officer (CO), COR, and ACOR;

· Unless otherwise noted, all deliverables shall be submitted to the CMS electronically, and in hard copy upon request; and

· All mailings of documents in hard copy version shall be done (1) in the most cost-effective manner possible, (2) in accordance with all timeframes prescribed in this SOW, and (3) in accordance with all CMS security laws, regulations, instructions and directives.

7. The contractor shall provide or furnish:

7.1. All necessary services;

7.2. Facilities;

7.3. Equipment;

7.4. Materials and supplies not otherwise provided by the government, and;

7.5. Personnel to perform all requirements set forth in this SOW.

8. In addition, the contractor shall plan for the following operational contingencies:

8.1. Deliverable Due Dates Falling on Weekends: If the date by which the contractor shall complete a certain activity under this SOW falls on a Saturday, the contractor shall complete the activity by the preceding Friday (i.e., the day before the original Saturday deadline). If the date by which the contractor shall complete a certain activity under this SOW falls on a Sunday, the contractor shall complete the activity by the following Monday (i.e., the day after the original Sunday deadline). If the date by which the contactor shall complete a certain activity under this SOW falls on a Federal holiday, the contractor shall complete the activity by the following day (i.e., the day after the original deadline).

8.2. WCMSA Proposal Re-Review: At least ten Percent (10%) of WCMSA proposal will require re-review.

8.3. WCCCS Availability Schedule and Unscheduled down time:

8.4. Availability of the WCCCS is Monday through Friday, 7 a.m. to 9 p.m. EST/EDT and on Saturdays, 8 a.m. to 6 p.m. EST/EDT except on federal holidays. A list of these shall be provided by the COR, ACOR, or appropriate system contractor.

8.5. Scheduled down time for maintenance will occur every 2nd Saturday of the month.

8.6. Unscheduled down time: The contractor shall include as part of its Business Contingency Plan tasks that will be performed in instances where the WCCCS may be unavailable for an extended period of time lasting more than eight (8) hours.

IMPORTANT: The contractor shall alert the CMS COR and ACOR of any unscheduled WCCCS outages immediately after contacting the COBR support desk. The contractor shall provide a monthly report to the CMS COR and ACOR indicating the date, the start time, and end time of any unscheduled WCCCS outage. Further, the contractor shall supply the CMS COR and ACOR a brief explanation of the reason for and resolution of the issue (e.g. server problem, T-1 line issue, local power outage).

Specific Requirements The contractor shall perform the following tasks as outlined below:

1. TASK 1 - Procedures for Processing WCMSAs:

The contractor shall use the information submitted through the WCCCS to review submitted cases and determine all relevant documents are present in the file.

1.1. Procedures for Processing WCMSAs, The case reviewer shall:

1.1.1. Once a complete case has been established in the WCCCS, the contractor shall notify the submitter of any missing and/or inappropriate documents/items within ten (10) business days after the date the proposal was initially received.

1.1.2. The contractor shall ensure that any subsequent documents (i.e. returned documents from the submitter), whether solicited or unsolicited, are accepted by fax and appended to the original case file.

1.1.3. Additionally, the contractor shall complete its review (i.e., render a recommendation regarding a WCMSA proposal amount or deemed ineligible and transferred the case to CMS) of the WCMSA proposals within twenty (20) business days after the date after the case has been initially received or after any originally requested missing or incomplete information needed for adequate review of a proposal is received.

IMPORTANT: When following the procedures indicated below, the contractor shall refer to CMS’ website to obtain current applicable guidelines relating to the WCMSA process.

1.1.4. Substantiate that the injuries, including ICD-9/10 diagnosis codes, presented in the case establish a causal relationship to the WC injury, illness, or disease.

1.1.5. Substantiate with respect to the incoming WCMSA case that:

a. The information contained in the case adheres to the applicable states workers’ compensation and/or venue’s legal statutory requirement(s);

b. The appropriate documents needed for the support of an accurate review of the case are available, e.g., medical notes, x-rays, surgical report, etc.;

c. All relevant documents are present in the case to support the pricing of the WCMSA, e.g., the most recent two years’ medical records;

d. All supplemental information relevant to the case is present; There is a valid, signed “Consent to Release” document accompanying the WCMSA proposal;

e. The existence of an appropriate pricing method (State WC Fee schedule or actual/usual and customary charges for medical pricing; average wholesale price (AWP) for prescription pricing) was applied to the case for future medical costs/treatment and prescription drugs;

f. Use the claimant’s life expectancy or rated age if submitted in pricing the WCMSA amount.

NOTE: CMS uses the life expectancy by sex under general origin found on the most recent table listed on the Centers for Disease Control (CDC) Web site at https://www.cdc.gov/nchs/data/nvsr/nvsr69/nvsr69-12-508.pdf to project the cost of the claimant’s future treatment, unless documentation from a medical professional provides justification for an alternative projection.

1.1.6. All WCMSA reviews conducted by the contractor shall be defensible. The contractor shall complete all WCMSA case reviews in such a manner so as to ensure all reviews are able to be thoroughly explained and justified. If it is determined, as a result of a challenge, that the rationale/methodology used in the contractor’s review of a WCMSA, is indefensible, the contractor shall correct/update the WCMSA amount recommendation accordingly.

1.1.7. It is the Government’s expectation that the amount of reviews determined to be indefensible as a result of the contractor’s action, or inaction, will be reduced to an absolute minimum. In the event of such an occurrence, the contractor is expected to supply the Government with a complete corrective action plan to ensure similar occurrences do not occur in the future;

1.1.8. Conduct an independent medical review of the WCMSA case and input findings into the WCCCS.

1.1.9. Price the WCMSA amount based on the contractor’s independent review of the submitted proposal.

1.1.10. Recommend an independently priced WCMSA amount to CMS.

1.1.11. Respond to inquiries (telephone, written and email) as directed by CMS (Refer to Section Task C.3 of the SOW).

1.1.12. Evaluate the case considering the appropriate State or Federal law when making its final determination in those instances where the WCMSA proposal includes Court orders or settlement agreements.

1.1.13. Complete (i.e. render a recommendation regarding the validity of the requested stated issue and provide an assessment of the contractor’s review rationale) WCMSA rereview referred either from CMS’ Central Office or Workers’ Compensation Medicare Set-aside Agreement Portal (WCMSAP) within ten (10) business days after the date the rereview request was received.

1.1.14. Complete (i.e. render a recommendation regarding the validity of the requested stated issue and provide an assessment of the contractor’s review rationale) WCMSA amended review referred either from CMS’ Central Office or Workers’ Compensation Medicare Set-aside Agreement Portal (WCMSAP) within ten (10) business days after the date the amended review request was received.

1.2. The CMS considers an evaluation/review of a WCMSA proposal complete when the contractor has rendered a recommendation regarding:

1.2.1. a WCMSA amount;

1.2.2. a complete re-review of the case when necessary (looking at a submission to determine eligibility for re-review does not constitute re-review); or

1.2.3. the case being ineligible for initial review; and transfer of the case to the CMS for a determination.

2. TASK 2 - System Testing and Local Area Network Support The contractor shall participate in testing with CMS’ MSPSC with respect to WCMSA-related system changes. The contractor shall document all local systems release changes in accordance with updates after receiving approval from the CMS COR or Alternate COR to do so.

3. TASK 3 - Customer Service and Education

3.1. Customer Service

3.1.1. The contractor shall perform customer service tasks in accordance with CMS-approved procedures and the performance standards, as defined in the deliverable schedule - Appendix B.

3.2. Written Inquiries

3.2.1. The contractor shall respond to written inquiries timely (i.e., within ten (10) business days after the date of receipt or as otherwise defined by CMS at the initial kickoff meeting following contract award). Written inquiries include hardcopy letters and e-mails sent directly to the contractor outside of the WCCCS.

3.2.2. The contractor shall retain all written inquiries in addition to those defined above. Regardless of whether they are stored on-site or off-site, all written inquiries shall be clearly identified and filed/saved in a manner that will allow for easy selection by CMS personnel and auditors. The CMS reserves the right to audit this functional aspect at any time.

3.2.3. If within five (5) business days of initial receipt of any correspondence, the contractor is not able to answer all questions contained within the inquiry, then the contractor shall notify the source of the inquiry that the inquiry is being researched and a response will soon follow. Customer Service Representatives (CSRs) and/or other staff responding to written inquiries shall proactively follow up as appropriate with all stakeholders until the technical or policy related issues are resolved.

3.2.4. The contractor shall date stamp all incoming inquiries;

3.2.5. The contractor shall assign a control number to each incoming written inquiry; and

3.2.6. The contractor shall respond to questions using responses that have been approved by CMS.

3.2.7. When preparing a written reply to a written inquiry, the contractor shall:

a. indicate in the response the mechanism a customer should use to have follow-up questions answered,

b. use 12-point font or larger,

c. use the CMS logo when applicable,

d. use CMS approved language for standard responses, and

e. save copies of all responses to inquiries in the appropriate electronic file.

3.2.8. The contractor has the discretion to respond by telephone to written inquiries that involve simple questions. Each telephonic reply to a written response shall be accompanied by a Report of Contact (ROC). The ROC shall include the following information:

a. inquirer name,

b. inquirer telephone number,

c. date of reply,

d. internal inquiry control number,

e. subject, and

f. summary of discussion.

g. The ROC shall be placed in the applicable general file/record for the submitter. If the inquirer does not have a general file already established (e.g., is a beneficiary or is a submitter that has not previously provided information to the contractor), the contractor shall store/file the ROC in a manner that allows for quick and easy retrieval.

Note: The contractor shall not include personally identifiable information (PHI) or any financial information when replying to an inquiry via e-mail.

Note: Since e-mail represents official correspondence with the public, the contractor shall use sound e- mail practices and proper etiquette when communicating electronically and shall utilize the same guidelines that pertain to hard copy responses.

Note: If a telephone requestor cannot be reached by phone after two (2) attempts, the contractor shall send a written response.

3.3. Telephone Inquiries

3.3.1. The contractor shall be available to callers between 9:00 a.m. and 5:00 p.m. EST/EDT, Monday through Friday. The contractor shall staff for at least one bi-lingual (English-Spanish) customer service representative (CSR) position during regular business hours.

3.3.2. The contractor shall provide adequate staff coverage for incoming calls from the public during the regular hours of operation.

3.3.3. The contractor shall provide staff with expertise to answer both general and technical questions. Customer service staff shall have the necessary skills to help them explain the requirements of the WCMSA program to the submitters and to resolve basic, uncomplicated issues/problems.

3.3.4. The contractor shall only speak to a caller about a specific WCMSA proposal after first verifying that the caller is authorized to receive information specific to the WCMSA proposal in question.

3.4. Other Requirements

3.4.1. The contractor shall log all inquiries, telephonic or written, in a manner that is easily accessible to CMS. The log must include all of the following:

a. the inquirer (i.e., the party submitting the question),

b. the nature of the inquiry,

c. the name of the CSR who took the inquiry,

d. the date of the inquiry,

e. a description of how the inquiry was resolved,

f. the date of resolution, and

g. the inquiry control number (if applicable).

3.4.2. If the contractor’s customer service staff is not able to answer an inquiry without additional technical support, the staff shall contact CMS’ COR or Alternate COR for guidance. The contractor shall provide periodic updates to the individual that submitted the inquiry until the technical issue is resolved.

3.4.3. The contractor shall respond to CMS inquiries regarding customer service issues timely

3.4.4. The contractor shall provide high-quality customer service and supply enough trained staff to appropriately handle incoming telephone calls.

3.4.5. The contractor shall train its staff to respond to inquiries from both internal and external customers. Internal customers include the CMS Central Office, Consortia, Regional Offices (ROs), and Medicare contractors; external customers include beneficiaries, providers, suppliers, insurers, attorneys, employers, and others with WCMSA questions.

3.4.6. The contractor shall determine whether a select number of CSRs will receive specialized training to handle more complex or technical inquiries in an escalation process.

Note: Face-to- face encounters are extremely rare and no separate facility to accommodate them is required. Additionally, the contractor shall train its CSRs in customer service principles and proper telephone etiquette.

4. TASK 4 - Records Retention Management

4.1. The contractor shall retain WCMSA proposal records indefinitely. The COR and the ACOR are the only individuals who may approve the destruction of records. The CMS will notify the contractor when it determines the contactor may destroy certain records. Any records stored in any CMS-owned system shall not be destroyed by the contractor under any circumstances. All records shall be retained and secured in accordance with applicable CMS and federal laws, regulations, directives, instructions and manuals. Records may include, but are not limited to, the following:

4.1.1. All documents submitted with and appended to the WCMSA proposal, e.g., medical records, consent to release form, and the like;

4.1.2. All reports that the contractor is required to submit to CMS;

4.1.3. Requests for re-reviews/re-evaluations (and all supporting documentation);

4.1.4. Law enforcement requests for information;

4.1.5. General files, including all requests for information submitted regarding an application/payment/appeals status;

4.1.6. Audit records and findings;

4.1.7. Correspondence with CMS; and

4.1.8. Electronic records that are critical to understanding what events contributed to WCRCs determinations. See http://cmsnet.cms.hhs.gov/hpages/osora/records/RecordsSchedule.pdf for instructions on Records Retention Management.

5. TASK 5 - Internal Controls

5.1. Quality Assurance (QA)/Continuous Quality Improvement

5.1.1. The contractor shall maintain effective internal controls to ensure successful continuity of operations through means of an effective quality assurance (QA)/continuous quality improvement (CQI) program and use of Standard Operational Procedures (SOPs), as detailed below.

5.1.2. The contractor shall:

a. Develop a QA/CQI program that ensures the an accurate, defensible, independently priced WCMSA recommendation to CMS for each proposal received (e.g., correct application of CMS’ policy regarding structured WCMSAs, life expectancy, etc.) within CMS’ expected timelines:

· 20 business days after the date the proposal is initially received for new cases (see section IV.C.1 of SOW)

· 10 business days after the date the proposal is received, of any development notification (see IV.C.1 of SOW)

· 20 business days after the date additional documentation requested is received. (See IV.C.1 of SOW).

Note: The CMS considers proposals that contain records or files of two or more different individuals as commingled. The CMS also considers correction of a commingled proposal as a development request. Once a commingled issue has been addressed by the WCMSA submitter, the contractor shall review the file in accordance with section 6.1.1(c) noted above.

· Five (5) business days after the date a rereview proposal is received (see section IV.C.1 of SOW)

· Twenty (20) business days after the date an amended review proposal is received (see section IV.C.1 of SOW)

b. Mitigate the establishment/creation of a “backlog”. Any case that fails to meet the time requirements detailed within C.1 of the SOW and is still with the contractor in any stage of the review process will be considered a backlog. The contractor shall track the timeliness of all reviews and shall immediately notify the CMS COR if a backlog develops. The backlog shall not include cases for which the contractor is awaiting CMS advisement and/or policy recommendations or clarifications or commingled cases awaiting correction by the BCRC.

c. Review business processes to mitigate the need, by the contractor, to create multiple development requests, for the same case at various stages of the review process.

d. A timely response is provided to all written and telephone inquiries. Responses that involve research associated with initial telephone inquiries received are made within 24 hours of the inquiry. Responses to written inquiries are made within ten (10) business days of the inquiry.

e. That all new or revised operational instructions are fully and timely implemented.

f. Government shall have access to reports developed as part of any Continuous Quality Assurance process. The reports, at a minimum, should track the contractors’ adherence to timeliness of submission review, and received written inquiries as stated under Customer Service and Education at section C.3 and Telephone Inquiries at section C.3.

g. Other Tasks to be reported to the Government under the contractor’s Continuous Quality Assurance process will be later defined collaboratively with the contractor.

h. Include a QA/ CQI program that features, at a minimum, the following elements:

· Providing and maintaining an inspection and audit system to meet contract performance requirements;

· Providing a method of identifying nonconformance or deficiency in the quality of services performed;

· Providing a formal system to implement and track progress of corrective actions to completion; and

· Providing for Governmental inspections and audits while work is in process or complete.

i. Submit the specifics of its QA/CQI program to both the CMS COR and Alternate COR; and, upon approval from the COR, use and maintain the program to meet requirements of this contract.

j. Submit a draft QA/CQI Plan to the CMS COR, and other personnel designated by CMS no later than forty (40) business days after the start date of the contract.

Note: The CMS will respond to the draft QA/CQI Plan within twenty (20) business days from its receipt.

k. Submit a final QA/CQI Plan to the CMS’ COR, and any other personnel designated by CMS, no later than ten (10) business days after receiving CMS’ comments.

l. Submit corrective action plans (CAPs) to remedy any deficiencies identified as a result of the QA/CQI process. These plans shall be submitted to the CMS COR and any additional staff members designated by CMS for their review and concurrence.

m. If CMS exercises a contract option for a subsequent year, the contractor shall:

· Submit draft updated plans to the CMS COR and other personnel designated by CMS no later than sixty (60) business days after the effective date of the exercise of an option year.

Note: The CMS will respond to the draft within twenty (20) business days of its receipt.

n. Submit final plans to the COR ten (10) business days after receiving CMS’ comments.

Note: The CMS will respond to the final plans within ten (10) business days of its receipt.

· Include a statistical and narrative summary in the QA/CQI Plan of the contractor’s quality control efforts, findings, corrections, and recommendations for improvement to the WCMSA case processing. The contractor’s QA/COI applications shall randomly be applied to no less than five (5) percent of the WCMSA cases.

· Make quality control documentation available to the COR during the term of the contract and when requested.

· Continuously works towards improvement of the quality and efficiency of its operations under this contract.

Important: Biannually, the contractor will randomly select five (5) percent of completed cases (to be defined as no longer awaiting new documentation, but just prior to release of the approval letter) for which a review (or amended review) request was received to access the quality of the recommendations made by the WCRC to CMS. If the WCRC’s initial recommendation is defensible, accurate, (e.g. correct application of CMS’ policy regarding structured WCMSAs, life expectancy, etc.) and within CMS’ expected timelines, the recommendation will be deemed satisfactory. The contractor will conduct discussions on outcomes and findings with CMS.

5.2. Standard Operating Procedures

5.2.1. The contractor shall develop standard operating procedures (SOPs) detailing the processes it will follow in reviewing and pricing the WCMSAs within forty (40) business days after the effective date of the contract and/or as necessary when requiring updates.

5.2.2. The contractor shall develop the SOPs for each function of personnel involved in the WCMSA review and pricing process.

5.2.3. The contractor shall provide updates to the SOPs for each function of personnel involved in the WCMSA review and pricing process as necessary and provide the updated SOPs as indicated in the Deliverable Schedule (Appendix B).

6. TASK 6- HIPAA Systems Security and Privacy Provisions

6.1. HIPAA Systems Security

The central tenet of the CMS Information Security (IS) Program is that all CMS information and information systems shall be protected from unauthorized access, disclosure, duplication, modification, diversion, destruction, loss, misuse, or theft—whether accidental or intentional. The security safeguards to provide this protection shall be risk-based and business- driven with implementation achieved through a multi-layered security structure. All information access shall be limited based on a least-privilege approach and a need-to-know basis, i.e., authorized user access is only to information necessary in the performance of required tasks. Most of CMS' information relates to the health care provided to the nation’s Medicare and Medicaid beneficiaries, and as such, has access restrictions as required under legislative and regulatory mandates.

6.1.1. The CMS IS Program has a two-fold purpose:

a. To enable CMS’ business processes to function in an environment with commensurate security protections; and

b. To meet the security requirements of federal laws, regulations, and directives.

6.1.2. The principal legislation for the CMS IS Program is Public Law (P.L.) 107-347, Title III, Federal Information Security Management Act of 2002 (FISMA), http://csrc.nist.gov/drivers/documents/FISMA-final.pdf. FISMA places responsibility and accountability for IS at all levels within federal agencies as well as those entities acting on their behalf. FISMA directs Office of Management and Budget (OMB) through the Department of Commerce, National Institute of Standards and Technology (NIST) to establish the standards and guidelines for federal agencies in implementing FISMA and managing cost-effective programs to protect their information and information systems. As a contractor acting on behalf of CMS, this legislation requires that the Contractor shall:

a. Establish senior management level responsibility for IS;

b. Define key IS roles and responsibilities within their organization;

c. Comply with a minimum set of controls established for protecting all Federal information; and

d. Act in accordance with CMS reporting rules and procedures for IS. Additionally, the following laws, regulations and directives and any revisions or replacements of same have IS implications and are applicable to all CMS contractors.

Note:

· P.L. 93-579, The Privacy Act of 1974, https://www.justice.gov/archive/oip/privstat.htm, (as amended);

· P.L. 99-474, Computer Fraud & Abuse Act of 1986, uscode.house.gov/statutes/pl/99/474.pdf

· P.L. 104-13, Paperwork Reduction Act of 1978, as amended in 1995, U.S. Code 44, Chapter 35, https://uscode.house.gov/statutes/pl/104/13.pdf;

· P.L. 104-208, Clinger-Cohen Act of 1996 (formerly known as the Information Technology Management Reform Act), https://www.law.cornell.edu/topn/clinger-cohen_act_of_1996;

· P.L. 104-191, Health Insurance Portability and Accountability Act of 1996 (formerly known as the Kennedy-Kassenbaum Act) https://aspe.hhs.gov/reports/health-insurance-portability-accountability-act-1996;

· OMB Circular No. A-123, Management’s Responsibility for Internal Control, December 21, 2004, http://www.whitehouse.gov/omb/circulars/a123/a123_rev.html;

· OMB Circular A-130, Management of Federal Information Resources, Transmittal 4, November 30, 2000, https://www.whitehouse.gov/omb/information-for-agencies/circulars;

· NIST standards and guidance, pages.nist.gov/800-63-3/sp800-63a.html and,

· Department of Health and Human Services (DHHS) regulations, policies, standards and guidance https://www.hhs.gov/ohrp/regulations-and-policy/index.html.

6.1.3. These laws and regulations provide the structure for CMS to implement and manage a cost- effective IS program to protect its information and information systems. Therefore, the contractor shall monitor and adhere to all IT policies, standards, procedures, directives, templates, and guidelines that govern the CMS IS Program, http://www.cms.hhs.gov/informationsecurity and the CMS ILC Framework, http://www.cms.hhs.gov/SystemLifecycleFramework.

6.1.4. The contractor shall comply with the CMS IS Program requirements by undertaking activities that include, but are not necessarily limited to, the following:

a. Implement its own IS program that adheres to CMS IS policies, standards, procedures, and guidelines, as well as industry best practices;

b. Participate and fully cooperate with CMS IS audits, reviews, evaluations, tests, and assessments of contractor systems, processes, and facilities;

c. Provide upon request results from any other audits, reviews, evaluations, tests and/or assessments that involve CMS information or information systems;

d. Report and process corrective actions for all findings, regardless of the source, in accordance with CMS procedures;

e. Document its compliance with CMS security requirements and maintain such documentation in the systems security profile;

f. Prepare and submit in accordance with CMS procedures, an incident report to CMS of any suspected or confirmed incidents that may impact CMS information or information systems; and

g. Participate in CMS IT information conferences as directed by CMS.

6.1.5. If the contractor believes that an updated IS-related requirement posted to the CMS website may result in a significant cost impact, the contractor may submit a request for equitable cost adjustment before implementing change.

6.1.6. As periodic updates are made to the Information Security requirements, it is recommended that the Contractor check the Information Security website on a monthly basis.

6.2. Additional Contractor Obligations Involving Federal Tax Information (FTI)

6.2.1. In addition, the inclusion of federal tax information (FTI) imposes additional security measures for the handling of this data (26 USC Section 6103(p)(4)). The laws, regulations, and directives and any revisions or replacements of the Internal Revenue Service (IRS) Publication 1075 have IS implications and are applicable to all CMS contractors (and their agents) in regard to FTI (http://www.irs.gov/pub/irs-pdf/p1075.pdf). Section11.7 follows:

a. IRS Publication 1075, section 11.7 The Center for Medicare and Medicaid Services IRC Section 6103(l)(12)(C)-- Under this provision, the Centers for Medicare & Medicaid Services (CMS) is authorized under IRC Section 6103(l)(12) to disclose any FTI it receives from the Social Security Administration (SSA) to its agents for the purpose of, and to the extent necessary in, determining the extent that any Medicare beneficiary is covered under any group health plan. A contractual relationship must exist between CMS and the agent. The agent, however, is not authorized to make further disclosures of IRS information.

6.3. HIPAA PRIVACY RULE Definitions of HIPAA Business Associate:

All terms used in this section and not otherwise defined shall have the same meaning as in the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"; 42 U.S.C. sec. 1320d) and the corresponding implementing regulations. "Business Associate'' shall mean the Contractor; “Covered Entity" shall, in this application, mean CMS; and "Secretary" shall mean the Secretary of the Department of Health and Human Services or the Secretary's designee.

6.3.1. Obligations and Activities of the Contractor as a Business Associate

a. As a business associate of CMS, the Contractor agrees that it will:

· Not use or disclose Protected Health Information ("PHI") or individually identifiable health information, as defined in 45 C.F.R. § 160.103, that it has created or received as a Business Associate from or on behalf of Covered Entity other than as permitted or required by this Contract or as required by law.

· Use safeguards to prevent use or disclosure of PHI or individually identifiable heath information that it has created or received as a Business Associate from or on behalf of Covered Entity other than as provided for by this Contract.

· Apply appropriate administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the electronic protected health information ("EPHI"), as defined in 45 C.F.R. 160.103, that it creates, receives, maintains, or transmits on behalf of the Covered Entity to prevent use or disclosure of such EPHI.

· Mitigate, to the extent practicable, any harmful effect that is known to the Business Associate of a use or disclosure of PHI or individually identifiable health information by the contractor as a Business Associate in violation of the requirements of this Contract.

· Report to the Covered Entity any…