J-6 Task Order 3 Trusted Third Party SOW.pdf

Fraud Prevention Partnership Trusted Third Party Consultant Task

STATEMENT OF WORK

I. SCOPE

A. Purpose

Background and goal:

Summary: The Center for Program Integrity within CMS is leading a secretarial-level initiative to create a permanent structure where skills, assets and data to address fraud issues of mutual concern, in accordance with applicable law, can be shared between the public and private sectors.

HHS-CMS is currently (as of March 2012) gathering information, reaching out to potential public and private sector partners, and beginning to plan for implementation. The applicable federal public side partners will include HHS-CMS, HHS-OIG, DOJ, and FBI. The private partners most pertinent to this particular task will be private insurance carriers. Several activities will be undertaken as part of this partnership, which is expected to launch in 2012, and which for purposes of this document we will refer to as the Fraud Prevention Partnership (“FPP”). The particular FPP activity that this Task applies to is known as the Data Sharing and Analytics Task (DSAT). One critical piece of the DSAT will be the creation and management of an entity known as the Trusted Third Party (“TTP”), further described below. The new CMS FFRDC is envisioned to play a significant and ongoing role in CMS’s engagement with the TTP and the DSAT. It is anticipated that as the partnership’s activities mature and expand, the FFRDC may be called on to expand its role in supporting partnership activities beyond the DSAT, and these activities may result in additional tasks being agreed upon between CMS and the new FFRDC (sometimes referred to herein as “the contractor”), but the DSAT is the initial task that will be focused on in this document.

FPP

The central goal of the FPP’s DSAT is to arrange for a revolutionary new coordinated nationwide sharing of health care claims information, including and for the first time aggregating claims and payment data from both the large federal public healthcare programs such as Medicare, and the private insurance payers. This goal is based on the concept that the newly-available data management and analytics capabilities – exemplified by CPI’s ground-breaking Fraud Prevention System which is currently streaming all fee-for-service Medicare Part A, Part B and DME claims data against an expanding set of fraud-detection algorithms – are magnified in impact the larger the available data set becomes. The larger the lens of the available data set, the crisper the rendered image becomes. To give a simple example, suppose a given payer, Payer A, sets its analytics system to provide a fraud alert for follow-up when a certain type of provider bills for more than 100 units of a certain type of service over a given period of time, such as a single day. Meanwhile, across town, another payer, Payer B, does the same. Suppose that a nefarious provider bills 50 units of the same service to Payer A, and 51 units to Payer B. Without data sharing, neither payer’s systems will generate an alert, and the potential fraud will go undetected. But with data sharing, both payers will alert to the scheme, and take measures not only to protect their own programs, but perhaps also to generate criminal or civil law enforcement activities. This is the desired state.

There are currently significant barriers to achieving this desired state. These barriers are numerous and complex. Just two examples: first, there is a suite of statutes, such as HIPPAA and the Privacy Act, protecting patient and health information, all of which limit the opportunities for data sharing between payers; second, there are significant marketplace and competitive concerns that prevent private payers, who may be locked in sharp market competition with each other, from sharing the kind of detailed, specific data that are needed for such analytics. CMS is contemplating the creation of a Trusted Third Party entity in order to overcome such barriers, and create a perceived safe, neutral place for private and public payers to share some types of aggregated and appropriately de-identified data which can be analyzed and with the results handed back out to the participating entities. CMS itself is willing to provide to such a third party any claims and payment information that is lawfully permitted.

There are models for this type of Trusted Third Party. For instance, such an entity has been developed and used with some success in recent years in the aviation industry. Airline companies, which previously had carefully guarded their internal safety information such as data about how frequently approved approach patterns were breached or nearly breached, now virtually all share their relevant flight information to a TTP. The TTP then aggregates the data, analyzes it, and feeds the results back to the airlines that provided their own information, allowing the airlines to safely compare their own performance in these crucial measures against the industry’s aggregated data.

The aggregated data has also been used by the Federal Aviation Administration to make crucial changes to approved approach routes to make them easier to comply with, yielding not just measurable safety improvements, but also to significant efficiencies being realized by the airlines and flying public. CMS desires to bring this TTP approach to bear on its efforts to create a nationwide public-private data sharing and analytics capability that can for the first time encompass something approaching the entire health care marketplace, with corresponding benefits to both public and private payers, as well as to health care consumers. The Partnership would be a voluntary, collaborative arrangement between the public and private sectors for the mutual benefit of themselves and the community as a whole.

The FPP will offer a forum where public and private payers come together to:

• Share and obtain strategies, best practices, and advanced analytical techniques and models for detecting and preventing fraud.

• Obtain visibility into the larger universe of de-identified healthcare claims and claimants beyond those submitted by any given payer.

• Benefit from findings reached through data mining, modeling, and analytics, in aggregated form using the pooled claims data.

• Identify emerging fraud trends made possible by maximizing the power of the consolidated claims data.

• Uncover potential gaps in protection that leave a participant’s organization vulnerable to healthcare fraud.

The Partnership will employ a novel approach to combating healthcare fraud by drawing upon large amounts of consolidated claims data voluntarily contributed by both public and private payers. The goal is to paint a more comprehensive picture of provider and supplier claims and potential fraud schemes.

One challenge Public Private Partnerships frequently face is how to facilitate trust and information sharing, given security and privacy constraints. One tested approach is to create a Trusted Third Party with responsibility for enabling collaboration and managing the data.

The TTP serves as the bridge that will allow each of the parties to be assured that security, privacy and other statutory requirements are adhered to after they cede control of their data. The TTP will provide a safe haven for all the data that will be contributed for analysis. The benefit of this approach is that no entity other than the TTP will have access to all of the data. Rival private payers will not be able to see each other’s claims data. Data and analytic techniques can be shared in a trusted environment with appropriate information security and privacy safeguards.

The TTP is expected to play four major self-reinforcing roles in support of the FPP, as illustrated below.

Conduct Analysis

• Statistical analysis

• Data and text mining

• Information retrieval and indexing

• Data fusion

Share Results

• Portal for sharing

• Data visualization

• Information Sharing Committee

• Meetings and briefings

Collect, Store and Aggregate Data

• Data capture and storage

• Parsing and mapping

• Data quality processes

• Information systems security

Facilitate Collaboration

• Policies and procedures

• Executive Board & committee meetings

• Legal agreements

The following is an interim statement of general principles that will guide the TTP’s information collection and sharing activities:

• Each partner’s data and analytics contains – and thus reveals – only part of the total fraud

• Combining data from CMS and private payers will provide a more complete picture

– Unusual activity not found in one partner’s data may be discovered in the combined data set

– Larger samples may detect trends and hot spots that are lost in the noise of smaller datasets

• Each partner will share medical claims data with the TTP

• Only the TTP will have access to all the medical claims data

• The TTP will use third-party data to supplement its analysis

• The TTP will share aggregated data reports with all partners and will share a detailed, partner-specific report with each partner

A Trusted Third Party forms the foundation on which the FPP can be launched and sustained. By ensuring that the partner’s data is protected and not misused, the TTP facilitates the development and sustainment of trust, which is a key element in successful Public Private Partnerships.

TTP Consultant Task:

Because of the urgency of the national healthcare fraud problem, CMS and its government and private partners are moving forward with this project with all deliberate speed. It is therefore likely that the Trusted Third Party could be created before the CMS FFRDC is created and begins its work. However, it seems certain that the FFRDC will start its work at the latest while the TTP is still in its early stages and at the beginning of its activities. Because the FFRDC will come into being close to the time the TTP is created, and because the TTP (as well as the underlying public-private fraud prevention partnership) and the FFRDC are both contemplated to become long-term fixtures in the CMS environment, there exists a unique opportunity for both entities to mature together.

Since no comparable collaborative project of this scale has ever been attempted within the health care industry (or perhaps any industry), this Task must be written in such a way as to allow growth, creativity, and flexibility on all sides, while still providing enough structure for the FFRDC to begin its work.

The following is a non-comprehensive list of some of the areas where the FFRDC will be expected to assist CMS. These are some of the topics that must be addressed in the First Year Project Work plan that is a key deliverable under this SOW:

1. Developing Data Use Policies and Data Use Agreements

• FPP participating entities and the TTP must follow agreed- upon Data Use Agreements, which may include:

– Types of data sent (medical claims, etc.)

– Ways data can be used

– Allowable output from data that can be shared with other partners

– Length of time data can be used until being purged

– Security requirements

– Privacy concerns; potential de-identification protocols

2. Memoranda of Understanding may be used for facilitating the transfer of data for pilot and directed studies

• When data are sent

• Data formats

• Geographic area for medical claims

• Provider types

• Medical specialties

3. Relationship and outreach challenges

• Never before done sharing between public and private payers;

• Strong interaction with state, federal and local law enforcement and other agencies

• Patient and beneficiary stakeholders

• Oversight scrutiny of a novel public-private activity

4. Technical expertise

• Claims payment expertise (public and private)

• Program integrity and investigative expertise

• Healthcare market knowledge;

• Law enforcement expertise & relationships;

• Medical/clinical expertise

• Data analytics and predictive modeling expertise

• Technical challenges & data integration – many different data sets and platforms, public and private

II. GENERAL REQUIREMENTS

Independently and not as an agent of the Government, the contractor shall furnish all of the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the SOW requirements as indicated below.

The contractor shall be responsible for the tasks outlined in this SOW. In meeting its responsibilities, the contractor shall work effectively and efficiently with all appropriate components within CMS in order to gather the information needed to develop needed research and perform needed, as well as any external entities it deems appropriate including (e.g.) the state and federal law enforcement (notably including but not limited to DOJ, HHS-OIG, and FBI), and industry groups including but not limited to the National Healthcare Anti-fraud Association, the National Insurance Crime Bureau, AHIP, Coalition Against Insurance Fraud, the National Association of Medicaid Fraud Control Units and the National Association of Insurance Commissioners. An additional large partnership area will be the private payer community, including all market segments. All timeframes for tasks identified in this SOW shall be based on calendar days, unless otherwise noted.

III. TASKS TO BE PERFORMED

Task 1: Develop a First-Year Project Work Plan

The contractor shall complete a project work plan subject to the approval of the Contracting Officer Representative (COR) and Project Lead that delineates the activities needed to accomplish the tasks in this SOW; specifies the timeframe associated with them; demonstrates knowledge of the project’s goals and objectives; and includes other relevant information associated with project implementation. The project plan will include a well thought out segmentation of the initial plan into 3 deliverables that will be presented to CPI at the 15, 30 and 60 day mark, starting from the date of the FFRDC’s selection, or such other start date as may be agreed to in CPI’s discretion. CPI will provide comments on the 15- and 30-day drafts no more than 5 business days after receipt of each draft.

The final product will reflect a clear statement not only of CMS’s expectations for the FFRDC’s work and CMS’s needs, but also of the expectations and needs of CMS’s various government and private sector partners in the FPP and TTP areas.

The contractor shall be available at a minimum throughout the life of this contract for one hour weekly update teleconferences with CPI, including a kick-off teleconference to discuss its progress and next steps. The contractor shall also be available for ad-hoc meetings with CPI as necessary, and the CPI COR and Project Lead maintain the right to schedule additional teleconferences/meetings or cancel them as necessary.

Task 2: Conduct Research and Interviews

The ultimate goal of this project is to assist CPI in its FPP and TTP activities. To that end, and in conjunction with the CPI Project Lead, the contractor shall interview numerous parties both within and outside of CMS in order to acquire the knowledge necessary to effectuate this goal. It is anticipated that the contractor within the first 30 days after contract award will have conducted at least 30 interviews, including at least 15 interviews of CMS personnel and 15 interviews of external partners; and within 4 months of performance will have conducted interviews with at least 25 CMS personnel and at least 75 external partners. All discussions shall be subject to approval by the CPI Project Lead and reflected in the contractor’s Project Plan.

Task 3: Establish and begin ongoing work on the FPP and TTP

The specific topics that the paper should address shall include the following:

how to identify potential fraud, waste and abuse schemes, if any, that may arise from the recommendations for how CPI can best prepare itself to address the more sophisticated schemes from both an internal staffing skills set and an organizational basis.

Two interim deliverables are due within 60 and 90 days, respectively after contract award. The draft comprehensive paper is due no later than 7 days prior to the end of the contract, and the final is due no later than 3 days after receipt of CPI comments on the draft.

IV. PERSONNEL REQUIREMENTS

Key personnel required are:

Program Director – shall be the primary point of contact with the CPI COR and Project Lead and shall be responsible for the day-to-day operations of the project and the administrative/financial aspects of the contract. The program director shall possess a combination of experience meeting the following criteria:

i. A minimum of three (3) years health insurance fraud or other program integrity experience.

ii. Extensive knowledge of public and/or private healthcare payment systems.

iii. Data familiarity or expertise.

Project Analyst (SPA) – shall be in direct communication with the Program Director and meet the following education, experience and skill requirements:

i. Master’s degree in a business related field or Certified Public Accountant.

i. Law degree or substantial experience with regulatory and administrative requirements.

i. Master’s degree in informatics or a related field, or substantial expertise in big-data integration or management following education, experience and skill requirements

i. Master’s degree or substantial experience in fraud detection; predictive modeling experience preferred

i. Five or more years in criminal or civil law enforcement focusing on white-collar fraud

i. Licensed M.D. or other licensed medical professional

V. QUALITY ASSURANCE

The contractor shall implement processes to ensure quality assurance in its products.

VI. PERIOD OF PERFORMANCE

The period of performance for this contract is to be no more than one year from the date of award, with an option to renew in one year increments up to four years total.

VII. ITEMS TO BE FURNISHED AND DELIVERABLE SCHEDULE

The contractor shall be required to submit all required reports and deliverables in accordance with the schedule below. Reports and deliverables submitted under this contract shall be in accordance with this Statement of Work.

Satisfactory performance of the contract shall be deemed to occur upon delivery and acceptance by the Contracting Officer, or the duly authorized representative, of the following items in accordance with the following schedule (reports submitted under the contract shall reference and cite the contract number and identify CMS as the sponsoring agency):

Schedule for Deliverables

CO = Contracting Officer COR = Contracting Officer Representative

Deliverable Description Quantity Recipient Delivery Date 1 Develop Project Work

Plan First draft 4 hard copies and electronic version

COR, CPI Project Lead, CPI Deputy Director for Policy, CO

Draft: no later than 15 calendar days after award of contract.

2 Develop Project Work Plan Second Draft

3 hard copies and electronic version

COR, CPI Project Lead, CPI Deputy Director for Policy

Draft: no later than 30 calendar days after award of contract.

3 Final Project Work Plan 3 hard copies and electronic version

COR, CPI Project Lead, CPI Deputy Director for Policy

Final: no later than 60 calendar days after award of contract.

4 Begin ongoing work in support of the FPP and TTP in accordance with agreed-upon first year work plan n/a COR, CPI Project Lead, CPI Deputy Director for Policy

No later than 65 calendar days after award of contract