J.1 Recovery Audit Contractor Validation Contractor (RVC) SOW.pdf

RAC Validation Contractor (RVC) Statement of Work (SOW)

Statement of Work (SOW) for the Recovery Auditor Validation Contractor

Table of Contents I. Purpose

II. Background

i. RAC Program Background

III. Requirements

i. General Requirements

ii. System Requirements and Data Accessibility

IV. Personnel Requirements

i. Key Personnel

ii. RVC Medical Review Personnel

iii. Other RVC Personnel………………………………………………………………………………………………………………11

V. Specific Tasks to Be Performed

i. Task 1: Project Plan

ii. Task 2: RVC Operations Manual

iii. Task 3: Accuracy Reviews

iv. Task 4: RAC Disputes/Disagrees

v. Task 5: Special Studies

vi. Task 6: New Issue Review

vii. Task 7: Contractor Quality Assurance

viii. Task 8: Monthly Progress Reports

ix. Task 9: Annual Reports

x. Task 10: Meetings and Conference Calls

xi. Task 11: Travel

xii. Task 12: RVC Transitions/Contract Closeout

xiii. Task 13: Ensuring Compliance with CMS Security Requirements

VI. Administrative and Miscellaneous Topics

i. Contractor Performance Evaluation

ii. Technical Direction

iii. Case Record and File Maintenance

iv. Requests for Information

v. Communications

vi. Deliverables

VII. Appendices

APPENDIX A: SCHEDULE OF DELIVERABLES

APPENDIX B: ACCURACY REVIEW DISPUTE FORM

APPENDIX C: MAP OF RECOVERY AUDIT PROGRAM REGIONS

APPENDIX D: 508 Standards per the Revised Section 508 of the Rehabilitation Act

Statement of Work (SOW) for the Recovery Auditor Validation Contractor

I. Purpose

The primary purpose of the Recovery Auditor Validation Contractor (RVC) is to review Recovery Audit Contractors’ (RACs) claim determinations on Medicare claims that were paid under part A or B of title XVIII of the Social Security Act, and to ensure that the Recovery Audit Contractors (RACs) are not unnecessarily denying Medicare claims that were properly paid. The Recovery Audit Program mission is to reduce Medicare improper payments through the efficient detection and correction of improper payments. This includes the review of Medicare Fee-for Service (FFS) claims submitted under the Title XVIII of the Social Security Act, which includes Part A/B, Durable Medical Equipment, Prosthetics, Orthotics, and Supply (DMEPOS) claims and Home Health/Hospice (HH/H) claims. Therefore, the RVC shall perform accuracy and validation reviews for all RAC regions (Regions 1-5). The accuracy and validation reviews shall consist of overpayments, underpayments, and claims for which the RAC has not found any indication of an improper payment, if requested by CMS. To validate accuracy, the RVC shall be tasked with performing medical reviews to determine if the RAC made appropriate determinations. This contract focuses on the accuracy of the RACs’ improper payment determinations. This typically includes the review of improper payments (overpayment and underpayments) to determine if the determination was accurate. At CMS’ discretion, the RVC shall also review no finding claims to assess the accuracy of those determinations.

II. Background

Section 302 and 1893(h) of the Tax Relief and Health Care Act of 2006 required CMS to make the RAC program permanent and nationwide by 2010. The RAC Program’s mission is to reduce Medicare improper payments through the efficient detection and correction of improper payments. Since inception of the permanent program, CMS has tasked the RVC with measuring the accuracy of the claim review determinations made by the RACs, as well as conducting special study reports on RAC claim determinations.

i. Medicare FFS RAC Program Background

The Medicare FFS RACs perform post-payment review to identify Medicare claims that contain improper payments (overpayments or underpayments), which were made under Part A or Part B of Title XVIII of the Social Security Act. This includes review of all Medicare claim and provider types (including DMEPOS and HH/H) and a review of claims/providers that have a high propensity for error based on the Comprehensive Error Rate Testing (CERT) program and other CMS analysis. Additionally, the RACs participate in a CMS review approval process, through which review topics must be approved before the RAC can begin to review those topics. To gain additional knowledge about the Medicare FFS RAC Program, it would be beneficial to review the following documents:

• RAC Program Status Documents and Reports to Congress (RTC): https://www.cms.gov/Research-

Statistics-Data-and-Systems/Monitoring-Programs/Medicare-FFS-Compliance-Programs/Recovery-Audit-https://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-Programs/Medicare-FFS-Compliance-Programs/Recovery-Audit-Program/Resources https://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-Programs/Medicare-FFS-Compliance-Programs/Recovery-Audit-Program/Resources

Program/Resources

• RAC Statement of Work (SOW): https://www.cms.gov/Research-Statistics-Data-and- Systems/Monitoring-Programs/Medicare-FFS-Compliance-Programs/Recovery-Audit- Program/Downloads/RAC-SOW-Regions-1-4-clean-November-30-2016.pdf

• National Coverage Determinations (NCDs) and Local Coverage Determinations (LCDs) database:

https://www.cms.gov/medicare-coverage- database/overview-and-quick-search.aspx)

• The Financial Management Manual, Claim Processing Manual, Benefit Policy Manual and the Program Integrity Manual (PIM): Guidance/Guidance/Manuals/Internet-Only-Manuals-IOMs.html, published by CMS for use by CMS contractors)

• Comprehensive Error Rate Testing Reports: https://www.cms.gov/Research-Statistics-Data-and-

Systems/Monitoring-Programs/Medicare-FFS-Compliance-Programs/CERT/CERT-Reports)

III. Requirements

The RVC shall complete its tasks in a timely, accurate, complete and efficient manner. The timeliness, accuracy, and completeness of each task and deliverable shall be determined by the

CMS RVC COR.

i. General Requirements

The SOW is subject to Sections 504 and 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by the Workforce Investment Act of 1998 (P.L. 105-220). All documentation created by the contractor and submitted to CMS is subject to Sections 504 and 508 Compliance for Communications as applicable. At the discretion of the CMS RAC COR, 508 compliance may be waived for working documents including draft versions of documents and versions of documents not yet accepted by the COR. For more information, see Appendix D “508 Standards per the Revised Section 508 of the Rehabilitation Act”.

Independently, and not as an agent of the Government, the RVC shall furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the requirements of this SOW. The contractor shall perform these services in accordance with the standards defined in this document.

The RVC shall ensure it has access to all coverage and payment policies that are in effect on the date of service/discharge for each claim. This also includes access to any websites, provision of any medical review systems, and/or provision of any and all other materials that may have to be acquired via purchase, license or subscription. The RVC shall maintain copies of all versions of New Issue packages supplied via the CMS RVC COR and RACs. These packages shall be maintained either by repository or other means, and available to all reviewers. The CMS does not endorse any specific review methods, standards, or systems. The CMS will provide minimal administrative support, which may include assistance communicating with Medicare contractors, and policy interpretations to allow the RVC to perform its tasks efficiently.

It is also the RVC’s responsibility to pursue continuous process improvement, which focuses on continual refinement and improvement of processes through data gathering, CMS feedback, and other methods of stakeholder engagement.

https://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-Programs/Medicare-FFS-Compliance-Programs/Recovery-Audit-Program/Resources https://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-Programs/Medicare-FFS-Compliance-Programs/Recovery-Audit-Program/Downloads/RAC-SOW-Regions-1-4-clean-November-30-2016.pdf https://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-Programs/Medicare-FFS-Compliance-Programs/Recovery-Audit-Program/Downloads/RAC-SOW-Regions-1-4-clean-November-30-2016.pdf https://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-Programs/Medicare-FFS-Compliance-Programs/Recovery-Audit-Program/Downloads/RAC-SOW-Regions-1-4-clean-November-30-2016.pdf https://www.cms.gov/medicare-coverage-database/overview-and-quick-search.aspx https://www.cms.gov/medicare-coverage-database/overview-and-quick-search.aspx https://www.cms.gov/Regulations-and-Guidance/Guidance/Manuals/Internet-Only-Manuals-IOMs.html https://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-Programs/Medicare-FFS-Compliance-Programs/CERT/CERT-Reports https://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-Programs/Medicare-FFS-Compliance-Programs/CERT/CERT-Reports

ii. System Requirements and Data Accessibility

The RVC shall possess appropriate hardware, software, and telecommunications equipment to undertake and fully complete all the tasks within this SOW.

The RVC shall store CMS data and/or documents in a system, that system will require an Authority to Operate (ATO) prior to use for such storage. It is the responsibility of the RVC to have available the personnel needed to design, build, and maintain a system, in the appropriate environment, meeting CMS standards, without assistance from CMS. Resources available to the RVC include the CMS Risk Management Handbook (RMH) and the CMS Acceptable Risk Safeguards (ARS) publication. The RVC shall comply with the CMS Security Assessment and Authorization (SA&A) methodology, policies, standards, procedures, and guidelines for Contractor facilities and systems. When using or disclosing protected health Information (PHI), the RVC shall be in compliance with the Health Insurance Portability and Accountability Act (HIPAA). The RVC shall comply with CMS policies and other requirements below, as well as documents referenced within those policies:

• CMS Policy for Information Security (PIS) (as amended) – The high level CMS policy for the CMS

Information Security Program, is available at http://www.cms.gov/Research-Statistics-Data-and- Systems/CMS-Information-Technology/InformationSecurity

• CMS Policy for the Information Security Program (PISP) (as amended) - Sets the ground rules under which CMS shall operate and safeguard its information and information systems to reduce the risk and minimize the effect of security incidents. This document will subsequently reference the Contractor-applicable ARS manual and the RMH, Volumes I, II, and/or III Security Standards and Procedures, and is available at http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information- Technology/InformationSecurity.

• CMS Policy for Investment Management and Governance (as amended) – Establishes the policy for systematic review, selection/reselection, implementation/control, and continual evaluation of IT investments at CMS, and is available at http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS- Information-Technology/ITInvestman/index.html

• Cloud Services - All cloud-specific requirements will be as defined in Section 1.3, Cloud-based Services.

However, for information identified as Personally Identifiable Information (PII), Protected Health Information (PHI), and/or Federal Tax Information (FTI), the additional security and privacy requirements listed in the ARS manual Implementation Standards (as amended), as applicable to PII, PHI, and/or FTI, shall be applied within cloud-based services.

• The CMS Information Security website at https://www.cms.gov/Research-Statistics-Data-and-

Systems/CMS-Information-Technology/InformationSecurity/index provides a list of applicable security policies and procedures across the program.

A summary of these requirements are listed in the Applicable Laws and Regulations sections of the above listed CMS policies, as well as in the Applicable Laws and Regulations section of the Health and Human Services (HHS) Office of the Chief Information Officer (OCIO) Policy for Information Systems Security and Privacy, available at:

https://www.hhs.gov/about/agencies/asa/ocio/about-ocio/index.html

For transmitting and receiving information containing sensitive data including both Protected Health Information (PHI) and Personally Identifiable Information (PII), the RVC shall establish http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/ITInvestman/index.html http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/ITInvestman/index.html https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/index https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/index https://www.hhs.gov/about/agencies/asa/ocio/about-ocio/index.html connections over secure Medicare Data Communications Network (MDCN) and Multiprotocol Label Switching (MPLS) lines. The RVC shall use a secure email service for communications with the CMS RVC COR. The RVC shall perform all tests necessary to ensure a secure environment, connections are maintained and that RVC reviewers have access to all resources to fulfill the tasks within this SOW.

The Contractor shall include this requirement in any subcontract awarded under this prime contract. If this SOW requires the Contractor to (1) process, (2) store, (3) facilitate transport, or (4) host/maintain Federal information; the Contractor agrees to comply with the Federal, Health and Human Services (HHS), and CMS Information Systems Security and Privacy Policy (IS2P2) and the CMS Business Partners System Security Manual (BPSSM). The CMS security requirements, policies, procedures, standards, and guidelines are located at CMS Information Security and Privacy “Virtual Handbook” at: http://www.cms.gov/InformationSecurity as well as the Information Security and Privacy Library at: https://www.cms.gov/Research-Statistics-Data-and- Systems/CMS- Information-Technology/InformationSecurity/Information-Security-Library.html.

This SOW is subject to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by the workforce Investment Act of 1998 (P.L. 105-220). Specifically, subsection 508 (a)(1) requires that when the Federal Government procures Electronic and Information Technology (EIT), the EIT must allow Federal employees and individuals of the public with disabilities comparable access to and use of information and data that is provided to Federal employees and individuals of the public without disabilities. For additional information, please refer to the HHS Section 508 Accessibility Checklist https://www.hhs.gov/web/section- 508/making-files-accessible/checklist.

IV. Personnel Requirements

Appropriate, qualified staffing is a material requirement of contract performance, therefore, failure by the RVC to meet this requirement shall result in the RVC being placed on a Performance Improvement Plan (otherwise known as a Corrective Action Plan or “CAP”), which will result in corrective actions, by CMS, including limiting the scope of work under the contract and possible contract termination.

RVC personnel may be required to undergo a background investigation commensurate with the Homeland Security Presidential Directive (HSPD) 12 position-sensitivity levels for the Personal Identity Verification (PIV) card required to access, develop, or host and/or maintain a Federal information system(s). All RVC employees shall comply with the conditions established for their designated position sensitivity level prior to performing any work under this contract.

Additional information regarding PIV card credentialing shall be communicated by the CMS

RVC COR.

i. Key Personnel

Key Personnel are individuals who contribute to the execution of the contract in a substantive and measurable way. Their absence from the contract would be expected to impact the approved scope of the SOW. The RVC shall submit1 a CMS approved contingency plan and designate backups for each key personnel role. The backup shall have similar skills and knowledge as the primary key

1 1 The RVC will be required to provide a staffing plan outlining how all personnel based, on the requirements, will be utilized and outline the work they would be doing specific to that task based on the personnel requirements and descriptions below. Merely restating tasks and personnel requirements as outlined in the SOW does not show how the RVC will carry out SOW requirements.

http://www.cms.gov/InformationSecurity https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html http://www.hhs.gov/web/section-508/making-files-accessible/checklist.

http://www.hhs.gov/web/section-508/making-files-accessible/checklist.

personnel to ensure, to the greatest extent possible, continuity of operations and minimal interruptions in the event of an unexpected departure of key personnel. All backup positions, while working in the backup capacity, may be a part-time RVC employee. Upon approval of the initial contingency plan, the plan shall be incorporated into the RVC Operations Manual and updated as necessary.

The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the RVC shall notify the CMS RVC COR and Contracting Officer (CO) and shall submit a justification for the diversion or replacement and a request to replace the individual.

The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract. If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than thirty days’ notice, the RVC shall provide the maximum notice practicable under the circumstances. The RVC shall not divert, replace, or announce any such change to key personnel without the written consent of the CMS RVC COR. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties (HHSAR 352.237-75 KEY

PERSONNEL (DEC 2015)).

For this SOW, “fully dedicated” means that the individual identified for the position shall be a Full Time Equivalent (FTE) employee and shall only work on one RVC contract. This individual may not perform duties on any other Medicare/non-Medicare contract or commercial line of business without approval by the CMS Contracting Officer.

The RVC shall designate a Program Manager (PM), a Contractor Medical Director (CMD), Medical Review (MR) Manager, and Systems Security Officer (SSO) as key personnel. The RVC shall ensure that the key personnel are responsible for the successful completion of all tasks, responsibilities, and duties outlined in the SOW. The contractor shall submit the resumes of all key personnel to CMS for verification prior to contract award. Immediately following contract award, the RVC shall submit complete and accurate applications for access to receive a CMS User ID and access to the RAC Data Warehouse (RACDW). Applications must be submitted for all Key Personnel, Key Personnel backups, RVC reviewers, and RVC coders.

a. Program Manager (PM)

The PM shall have authority to act for the contractor on all contract matters relating to daily operations. This includes but is not limited to day-to-day contact with the CMS RVC COR, oversight of contract performance, and obtaining staff necessary to conduct the RVC work. The PM shall be involved in all tasks associated with this contract. The PM must be full-time, fully dedicated, and available to the CMS RVC COR between 8:00 am to 5:00 pm ET Monday-Friday.

The PM shall have extensive knowledge of the Medicare program and working knowledge of the CMS FFS RAC Program requirements and activities.

All communications from the CMS RVC COR shall be responded to by the RVC with a confirmation email within two hours. After hours (after 5:00 pm ET – 7:59 am the follow business day) shall be responded to by 10:00 am ET the following business day. All deliverables received by CMS shall be reviewed by the CMS RVC COR prior to acceptance and approval. Only deliverables which meet the requirements of the RVC SOW shall be considered acceptable. Any deliverables not meeting CMS requirements will be returned with additional instruction from the CMS RVC COR. At the discretion of the CMS RVC COR, 508 compliance may be waived for working documents including draft versions of documents and versions of documents not yet accepted by the CMS RVC COR.

Example: If the CMS RVC COR sends an email at 5:01 pm on the Wednesday prior to Thanksgiving, for example, that email shall be responded to no later than noon on Friday.

Any CMS RVC COR request for revisions sent to the PM, shall be acknowledged by the PM during the above business hours, and will count as day one (1), if received by the RVC prior to noon and if received after noon, the calendar day of receipt shall be considered day zero (0).

If the PM is going to be out of the office for one (1) or more full business days the CMS RVC COR shall be notified at least one (1) business day in advance. In such cases, the PM shall provide a fully qualified “back-up” (including a CMS User ID and access to the RAC Data Warehouse (RACDW)) to serve as the central point of contact (POC) with CMS. The designated back-up must be fully dedicated and subject to the same availability requirements as the PM only when s/he is acting for the PM. Anyone serving as a backup for the PM shall be required to respond to CMS inquiries or requests deliverables or services related to this contract. The backup PM shall provide an update, which includes all relevant communications, action items, and other instructions that occurred during their absence, to the PM upon their return ensuring seamless workflow.

Work Experience: The PM shall have five (5) or more years prior work experience as a PM, preferably with large, complex projects. The CMS is also requiring this candidate to have experience in medical review and extensive nursing clinical experience in a variety of health care settings. Examples include but are not limited to:

• acute care, sub-acute care, long term care, rehabilitative services, home health, skilled nursing, diagnostic services, and outpatient services/settings

Education: The PM shall possess a bachelor’s degree in nursing from an accredited institution.

This professional is required to have a current license in nursing in the United States or U.S.

Territory. The PM shall also have a master’s degree in business or management from an accredited institution. In lieu of a master’s degree, the PM shall have a bachelor’s degree and at least an additional three (3) years of related work experience in Program Management.

b. Contractor Medical Director (CMD)

The CMD must be either a Doctor of Medicine or a Doctor of Osteopathy who has relevant work and educational experience reviewing medical policy for Medicare Part A/B, DME, and Home Health/Hospice.

The CMD is responsible for the oversight of the medical review and quality assurance. The CMS shall participate in CMS discussions/trainings and shall oversee the training of new RVC reviewers. The CMD must be full-time and fully dedicated. The CMD shall be available between 8:00 am to 5:00 pm ET Monday-Friday.

The CMD shall have extensive knowledge of the Medicare program and working knowledge of the CMS FFS Recovery Audit Program requirements and activities.

Primary Duties include but are not limited to:

• Briefing and directing personnel on the correct application of policy during the validation process;

• Educating review staff;

• Keeping abreast of medical practice and technology changes that may result in improper billing or program abuse;

• Serving as a readily available source of medical information to provide guidance in questionable claim review situations;

• Recommending when LCDs, NCDs, provider education, system edits or other corrective actions are needed or must be revised to address Recovery Auditor identified vulnerabilities;

• Overseeing the medical review process and providing the clinical expertise and judgment to understand Local Coverage Determinations (LCDs), National Coverage Determinations (NCDs) and other Medicare policy;

• Discussing claim review determinations with providers upon request;

• Interacting with the CMDs of other contractors and/or Recovery Auditors to share information on potential problem areas;

• Participating in CMD clinical workgroups as appropriate;

• Participating in CMS/RVC presentations if necessary

Please Note: The CMD shall oversee and be actively involved in Accuracy Reviews, Disputes, Special Studies, all aspects of the New Issue (NI) Review, and Contractor Quality Assurance.

These tasks mentioned are not administrative and so non-medical personnel cannot be substituted for the CMD to oversee or perform any of the tasks that involve medical review.

If the CMD is going to be out of the office for two (2) or more full business days, the contractor is required to provide a fully qualified “back-up” (including a CMS User ID and access to the RACDW) CMD. The designated back-up must be fully dedicated and subject to the same availability requirements as the CMD only when s/he is acting for the CMD. The backup CMD shall provide an update, which includes all relevant communications, action items, and other instructions that occurred during their absence, to the CMD upon their return ensuring seamless workflow.

Work Experience: This candidate shall have a minimum of three (3) years’ experience practicing medicine as a board-certified physician with no previous sanctions or exclusions from the Medicare program. This candidate shall have, at a minimum, two (2) years prior work experience in the health insurance industry, utilization review firm or other health care claims processing organizations. Extensive knowledge of the Medicare program particularly the coverage and payment rules. Public relations experience such as working with physician groups, beneficiary organizations or Congressional offices.

Education and Licensure: A board-certified Doctor of Medicine or Osteopathy who is currently licensed to practice medicine in the United States or U.S. Territory. The RVC shall annually verify that the CMD’s license is current.

To prevent conflict of interest issues, the CMD must provide written notification to CMS within thirty (30) calendar days after the appointment, election, or membership effective date if the CMD becomes a committee member or is appointed or elected as an officer in any state or national medical societies or other professional organizations.

c. Medical Review (MR) Manager

Responsible for the overall medical review and quality assurance of the RVC review staff and associated processes. The MR Manager must be full-time and fully dedicated. The MR Manager shall be available between 8:00 am to 5:00 pm ET Monday-Friday. The MR Manager shall have extensive knowledge of the Medicare program and working knowledge of the CMS FFS Recovery Audit Program requirements and activities.

Primary Duties Include but are not limited to:

• Briefing and directing personnel on the correct application of policy during the validation process;

• Educate review staff;

• Keeping abreast of medical practice and technology changes that may result in improper billing or program abuse.

• Serving as a readily available source of medical information to provide guidance in questionable claim review situations;

• Overseeing the medical review process and providing the clinical expertise and judgment to understand federal regulations and policy;

• Participating in random audits of reviewers to ensure cases are being reviewed in accordance with contract and regulatory requirements.

Please Note: The MR Manager shall manage, direct, and be actively involved in Accuracy Reviews, Disputes, Special Studies, all aspects of the New Issue (NI) Review, and Contractor Quality Assurance. These tasks mentioned are not administrative and so non-medical personnel cannot be substituted for the MR Manager to oversee or perform any of the tasks that involve medical review.

If the MR Manager is going to be out of the office for two (2) or more full business days, the contractor is required to provide a fully qualified “back-up” (including a CMS User ID and access to the RACDW) MR Manager. The designated back-up must be fully dedicated and subject to the same availability requirements as the MR Manager only when s/he is acting for the MR Manager.

Anyone serving as a backup for the MR Manager shall be responsible for the overall medical review, the quality assurance of the RVC review staff, and have the ability to respond to reviewer inquiries or requests related to this contract. The backup MR Manager shall provide an update, which includes all relevant communications, action items, and other instructions that occurred during their absence, to the MR Manager upon their return ensuring seamless workflow.

Work Experience: This candidate shall have at least five (5) years of previous medical review experience, with at least three (3) years’ experience as a MR Manager, and at least three years of medical review and quality assurance experience.

Education and Licensure: The MR Manager shall have a current Registered Nurse (RN) license in the United States or U.S. Territory. An associate’s degree in nursing is acceptable.

d. System Security Officer (SSO)

This professional is responsible for CMS business partner security requirements, which includes obtaining and maintaining the Authority to Operate (ATO) and participating fully in the Security Assessment and Authorization (SA&A) process.

The RVC shall designate a SSO qualified to manage the security program and ensure the implementation of necessary safeguards. The SSO shall ensure that RVC systems are in full compliance with the CMS information security requirements. The SSO shall perform duties in accordance with IOM Pub. 100-17, the CMS Business Partner System Security Manual (BPSSM).

Work Experience: The SSO shall possess three (3) years of practical experience in information technology (IT) systems security policies, procedures and practices to manage security administrative duties in large organizations.

Education and Licensure: The professional shall possess a bachelor’s degree in an IT related field from an accredited institution. In lieu of a bachelor’s degree an additional four (4) years of related work experience may substituted. In addition to a bachelor’s degree and/or IT experience, the principal SSO shall be a credentialed Information Systems Security Professional. The Contractor’s SSO may oversee other lines of business, other than this contract.

ii. RVC Medical Review Personnel

The RVC is required to employ RVC Reviewers to accomplish all review tasks required under this SOW. The RVC shall ONLY designate licensed clinicians and certified coders as “RVC Reviewers”. Personnel not possessing the required qualifications may NOT perform any review (automated or complex). The RVC Reviewers shall have extensive knowledge of the Medicare program and working knowledge of the CMS FFS RAC Program requirements and activities.

RVC Reviewers are not required to be full-time employees.

Certified Coders The RVC shall employ certified coders to perform complex coding validations. Certified coders are those professionals who earn their certification from an accredited association such as the American Association of Professional Coders (AAPC) or American Health Information Management Association (AHIMA). Health care professionals are obligated to stay current in their profession. This includes continuing education in their respective discipline and keeping abreast of current medical coding updates, compliance rules, and government regulations.

Certified Coders may also be Registered Health Information Administrators (RHIA) and Registered Health Information Technicians (RHIT) who have been credentialed by AHIMA in their field of health information.

These coders must have at least five years direct coding or billing experience in the specific coding field. That is, an RHIT or RHIA who will be reviewing DRG Validation must have experience in coding or billing DRGs for at least five years before performing coding review for the RAC. The CMS reserves the right to review the credentials of certified coders, RHIA and RHIT at any time under this SOW.

Registered Nurses The RVC shall employ registered nurses with previous experience in medical record review. Registered nurses are required to have current licenses in nursing in the United States. The RVC must ensure that the license is current. The CMS reserves the right to review the credentials of registered nurses at any time under this SOW.

Therapists The RVC shall employ Therapists (e.g. physical therapist, occupational therapist, and speech-language pathologists) with previous experience in medical record review. Therapists are required to have current therapy licenses in the United States. The RAC must ensure that the license is current. The CMS reserves the right to review the credentials of Therapists at any time under this SOW.

Other Clinicians In addition to the required clinicians listed above, the RVC may employ other clinicians to perform medical review. However, only licensed clinicians with previous experience in medical record review may review medical records for medical necessity. The clinician must have an understanding of Medicare policies as well as LCDs and NCDs.

Regardless of license type, all clinicians (including Registered Nurses, Therapists, etc.) must possess three (3) years previous medical record review experience and at least three (3) years of current and/or relevant clinical experience in a variety of health care settings. Examples include but are not limited to: acute care, sub-acute care, long term care, rehabilitative services, home health, skilled nursing, diagnostic services, and outpatient services/settings.

III. Other RVC Personnel

a. Systems Analyst

The Systems Analyst is primarily responsible for an organization's current computer systems, procedures, and design information systems solutions to help the organization operate more efficiently and effectively. The Systems Analyst may be a part-time position. The professional shall possess a bachelor’s degree in an IT related field from an accredited institution, and at least five (5) years of related work experience. In lieu of a bachelor’s degree an additional three (3) years of related work experience may substituted.

b. System Administrator

The System Administrator is primarily responsible for the upkeep, configuration, and reliable operation of computer systems. The System Administrator may be a part-time position. The professional shall possess a bachelor’s degree in an IT related field from an accredited institution, and at least five (5) years of related work experience. In lieu of a bachelor’s degree an additional three (3) years of related work experience may substituted.

c. Application Developer

The Application Developer is primarily responsible for designing, developing, and programming successful software. The Application Developer may be a part-time position. The professional shall possess a bachelor’s degree in an IT related field from an accredited institution, and at least five (5) years of related work experience. In lieu of a bachelor’s degree an additional three (3) years of related work experience may substituted.

V. Specific Tasks to Be Performed

i. Task 1: Project Plan

The RVC shall develop a project plan outlining the activities associated with the contract. A post-award conference shall be required after contract award to discuss the project plan. The specific focus shall be to discuss the timelines for the tasks outlined below.

Within ten (10) business days of this meeting, the RVC shall submit a formal project plan outlining the resources and timeframe for completing the work outlined. The RVC shall also name the designated back-ups for key personnel, which will ensure continuity of operations and minimal interruptions in the event the primary is not able to fulfill their requirement. The contingency plan must be in place/approved by the CMS RVC COR before the RVC may begin work. At any time during contract operations, if the RVC fails to meet the requirements of the contingency plan (e.g., a back-up key personnel is not available) a stop-work order shall be issued until the requirement is fulfilled.

After the project plan is submitted, reviewed, and accepted by CMS, any changes or updates in regards to the project plan shall be noted in the RVC Operations Manual.

This is considered an administrative task, which includes but is not limited to general clerical tasks, such as drafting documents maintaining files, sending and receiving correspondence, scheduling meetings, and project management.

ii. Task 2: RVC Operations Manual

The RVC shall develop and maintain an approved RVC Operations Manual. The CMS RVC COR will approve the design and layout of this manual. The draft manual shall be submitted to the CMS RVC COR no later than twenty (20) business days after the project plan is accepted by CMS and quarterly thereafter.

If no comments are received from the CMS RVC COR within ten (10) business days of submission of a draft manual change, the RVC shall submit the final document within ten (10) business days after the comment period ends.

The RVC Operations Manual is a living document and may be updated without contract modification. The COR may request the document be revised at any time. The contractor will have ten (10) business days for revisions but shall begin process revisions immediately upon direction from the CMS RVC COR. Requests for extension may be granted at the discretion of the COR. The contractor shall provide written comments to the CMS RVC COR on changes, updates or corrections to the manual on a continual basis so that it will be kept current to accommodate workload and other changes in the RVC processes as necessary. Changes identified in revisions to the review manual are to be acted upon only if they fall within the general scope of the contract. The RVC manual documents the contingency plan, the various processes that the RVC follows in its daily operations, including the process for obtaining, processing and reviewing medical records and claims, reporting procedures, and other processes and business rules as necessary.

This is considered an administrative task, which includes but is not limited to general clerical tasks, such as drafting documents maintaining files, sending and receiving correspondence, scheduling meetings, and project management.

iii. Task 3: Accuracy Reviews

The RVC shall measure the accuracy rate for each RAC by reviewing a randomly selected sample of claims on which the RAC has made an improper payment determination. The CMS will provide up to 1,0002 randomly selected claims per month to send to the RVC. These claims will either be automated or complex reviews and the claims selected shall be comparative to the provider types that the RACs review (inpatient hospital, inpatient rehabilitation facility, outpatient hospital, skilled nursing facility, physician, lab/ambulance/other carrier, home health, and DME).

RACs review automated and complex reviews that contain different provider types.

• Automated review occurs when a Recovery Auditor makes a claim determination at the system level without a human review of the medical record.

• Complex review occurs when a Recovery Auditor makes a claim determination utilizing human review of the medical record or other required documentation.

Please note that all portions of this task require medical review, medical expertise, and clinical/certified coding experience. This task requires fully qualified staff to determine whether the edit parameters/claim selection criteria were applied correctly and/or could yield the intended result and if the RACs are correctly interpreting and applying CMS policy and/or evidence-based medical research. It is the RVC’s responsibility to maintain copies of all versions of New Issue packages supplied via the CMS RVC COR

2 CMS decides what will be sent and when it will be sent to the RVC. Therefore, RVC may review none, half, or all of the 1000 claims allotted for this task, according to instruction by the CMS RVC COR. In the event no Accuracy Reviews are required/received by the RVC, the RVC will receive no payment for Accuracy Reviews.

and RACs. These packages shall be maintained either by repository or other means, and available to all reviewers. The CMS RVC COR may ask to see a list, log, tracker, etc. of these New Issues at any time.

The list, log, tracker, etc. shall include, at a minimum, the CMS New Issue Number and CMS New Issue Name as reflected in the RAC DW, the RAC Regions impacted by the New Issue, the effective date of the package, and the date the RVC received the New Issue package. Additional items may be added to this list, log, tracker, etc. at the CMS RVC COR’s discretion.

The CMS will notify the RACs, which claims were selected for review and the RACs shall forward the claim information to the RVC within seven (7) business days unless otherwise specified by CMS. The CMS will also notify the RVC of the claim samples via email. The accuracy reviews begin once the RVC receives claim detail information from the RAC. Please note that CMS cannot advise on the expected breakdown of automated vs complex reviews in a typical monthly sample. The sample is dependent on what the RACs review in a given month.

Each RAC is allowed to provide its own format for the information/data requested, however CMS requires the RACs to provide the following information to the RVC for all accuracy samples:

• Detail of the claim selected for audit (sample claim) and anchor/reference claims, including, but not limited to:

o Claim number (e.g., Internal Control Number (ICN) or Document Control Number (DCN));

Beneficiary name, Health Insurance Claim Number (HICN), Date of Birth (DOB), and Date of Death (DOD); Applicable provider numbers (National Provider Identifier (NPI)) and/or Employee Identification Numbers (EIN) ; Diagnosis code(s); Type of Bill (TOB), Date of Service (DOS), Type of Service (TOS), and Place of Service (POS); All items/services billed including all modifiers appended, number of units, and charges; Diagnosis Related Groups (DRG) and billed diagnosis/procedure codes; Condition/occurrence codes; Discharge status code o If applicable, submissions from the RAC case management system are acceptable; however, the RAC may need to supplement data depending on information captured in the system and requirements of New Issue (NI) under audit.

Medical record, for all complex reviews, as well as any document submitted as part of a discussion period Correspondence (from the RAC to providers/suppliers) Additional Documentation Request (ADR) Letters, Review Results Letters (RRLs), Requests for Discussion, Results of Discussion Period, etc. Note: The clinician reviewer shall review all correspondence documents to assess whether they include clear descriptions of requested documentation (ADR letters), and clear descriptions of RAC findings including a clear reason for denial for all findings (Review Results Letters, Results of Discussion Period), and all findings align with the approved CMS New Issue package.

Additional Information about the claim being reviewed Any information related to closure or cancellation of a claim review A short explanation when associated findings by the MAC change the final outcome of the RAC determination (if applicable) Notification of any claims in the sample being under internal discussion, at the time of RVC review

The RAC shall send all requested medical records to the RVC through electronic submission, hard copy, or any other method CMS prescribes.

For automated reviews, the RVC shall review each submitted claim, New Issue Review Form (NIRF), edit parameters (identifies how claims are identified as improper payments), code list with long descriptors of all affected codes for the NI concept, communications to provider (Additional Documentation Requests, Informational Letters, Demand Letters, and Discussion Results Letter), error type and subtype, and beneficiary liability finding.

For complex reviews, the RVC shall review each submitted claim, NIRF, claim selection criteria, review guidelines, associated medical record, improper payment finding, reviewer rationale, communications to provider (Additional Documentation Requests, Review Results Letter, Discussion Results Letter), error type and subtype, and beneficiary liability finding.

Claims denied by the RACs shall be subject to RVC review even if the specific claim is going through the appeals process. The appeals process may not be completed by the time of RVC review. Please note that even if the RVC disagrees with a RAC determination, CMS will not reverse the original RAC decision. The RVC shall review and compare each submitted claim to the RACDW for accuracy and consistency.

The RVC shall identify any discrepancy between claim information from the RAC and the information in the RACDW. The RVC shall document the following findings for each claim in the accuracy study sample:

• Whether the RAC used the CMS-approved ADR Letter template

• Whether the edit parameters, claim selection criteria, and/or review guidelines are supported by CMS policy o Did the RAC use the appropriate edit parameters, claim selection criteria, and/or review guidelines when reviewing the claim?

• Whether the criteria for automated review was met (or whether the RAC should have performed a complex review instead). The RVC shall validate and confirm that the RAC has met BOTH of the following conditions to support an automated review:

o There is certainty that the service is not covered or is incorrectly coded; AND o A written Medicare policy, Medicare article or Medicare-sanctioned coding guideline (e.g., CPT statement, Coding Clinic statement, etc.) exists

• Whether the RVC agrees or disagrees with the RAC’s claim improper payment determination (full overpayment, partial overpayment, underpayment, etc) o For each disagree, indicate the correct determination and document the correct code and price for the claims (the RVC shall be responsible for purchasing all pricers and groupers needed for the reviews) o CMS will not provide names of vendors or pricing information paid because it is the RVC’s responsibility to ensure it gains access to or has pricers or fee schedules needed to perform reviews.

o For each claim, the RVC shall indicate if it agrees with the improper payment type and amount.

• Whether the RVC agrees or disagrees with the RAC’s error type (no documentation, insufficient documentation, medically unnecessary, incorrectly coded, or other) and subtype (to be provided by CMS) for the claim determination o For each disagree, indicate the correct denial type and subtype

• Whether the RVC believes the language used by the RAC to communicate findings to the provider was clear and accurate based on the approved New Issue concept o Did the RAC use the CMS-approved Review Results Letter (RRL) or Demand

Letter template?

o Does the Review Results Letter clearly describe all findings?

• Whether the RVC believes that the RAC appropriately communicated to the provider the clinical evidence contained in the medical record that justifies the determination

• Whether the RVC agrees or disagrees with the RAC’s beneficiary liability determination

• Whether the information the RAC submitted matches the information found in the RACDW

a. Accuracy Report

The RVC shall submit to CMS one report per RAC discussing accuracy. The 508-compliant report shall be delivered within twenty (20) business days after the RVC’s receipt of the monthly accuracy sample. The report shall include a narrative section with information about patterns of inappropriate determinations that can be seen from the data as well as recommendations to CMS.

The RVC shall only provide a brief explanation/rationale for disagree claims that have the wrong error type, the wrong improper payment amount, and the wrong information found within the RACDW. In these rationales, the RVC shall include what findings were documented in the medical record and what CMS policy was used to support the review determination, if there is a beneficiary liability issue with the review concept, and if the RAC followed its approved edit parameters/claim selection criteria and review guidelines. It is important for the RVC to provide a rationale or explanation of inconsistencies seen in the review so CMS can implement corrective actions for the RAC to follow. Please note, CMS will review the quality of the Accuracy Reports.

CMS defines quality as entirely accurate, complete and containing no errors.