Centers for Medicare & Medicaid Services

Supplemental Medical Review Contractor (SMRC) Statement of Work

Revised:

March 18, 2025

I. SCOPE

The Centers for Medicare & Medicaid Services (CMS) is seeking a Supplemental Medical Review Contractor (SMRC) to perform medical reviews (MR) and medical review related activities in support of three initiatives within the Center for Program Integrity (CPI) to include the following:

1) The Provider Compliance Group (PCG) ‘Specialty Reviews’ for issues identified by Federal agencies, such as the Office of Inspector General (OIG), Government Accountability Office (GAO)1, and other CMS groups. In addition to support CMS’ internal data analysis programs to include the Comprehensive Error Rate Testing (CERT)2 program; the First-look Analysis Tool for Hospital Outlier Monitoring (FATHOM),3 and the Program for Evaluating Payment Patterns Electronic Reports (PEPPER)4 reports (Task 1);

2) Program Integrity Reviews (Task 2).

The work shall be performed as outlined in this Task Order Statement of Work (SOW), awarded under the Unified Program Integrity Contract (UPIC) Indefinite Delivery Indefinite Quantity (IDIQ) contract vehicle, in accordance with Sections 5.6; 5.8.1; and Section 8 of the UPIC Umbrella SOW (USOW).

A. PURPOSE

The purpose of the SMRC known as the “Contractor” for this SOW is to perform and/or provide support for a variety of tasks aimed at lowering the improper payment rates and increasing efficiencies of the MR functions primarily for Medicare Fee-for-Service (FFS); other product line analysis are limited and may include Medicaid FFS, private and group health insurance lines of business and Prescription Drug Plan (Part D). One of the primary tasks will be conducting large volumes of nationwide MR as directed by CMS. The MR will be performed on Medicare FFS claims for Part A, Part B, and durable medical equipment, prosthetics, orthotics and supplies (DMEPOS) programs. The Contractor is expected to perform MR on a large volume of claims. For example, some projects may require MR for up to 300,000 claims per project/task assignment. These medical review activities will assess compliance with Medicare’s coding, coverage, billing, and payment requirements and

1 For more information, see http://www.oig.hhs.gov/and http://www.gao.gov/.

2 The CERT program evaluates a statistically valid random sample of claims to determine if they were paid properly under Medicare coverage, coding, and billing rules.

3 FATHOM is a Microsoft Access application that allows CMS to provide each State with hospital-specific Medicare claims data statistics, which identify areas having high payment errors.

4 PEPPER is a comparative data report that provides hospital-specific Medicare data statistics for discharges vulnerable to improper payments.

SMRC Statement of Work identify claims improperly paid. The Contractor will recommend recoupment and/or adjustment for claims identified as improperly paid. Having a centralized MR resource that can perform large volume of MR nationally shall allow for a timely and consistent execution of MR review, activities, and decisions. The Contractor shall conduct the reviews and submit completed reports to CMS as described in this Statement of Work (SOW). The Contractor shall select subject claims, perform research and/or data analysis, and conduct reviews in a manner that will minimize provider and supplier burden. The Contractor must have in place adequate facilities, personnel, and equipment to perform medical reviews.

B. BACKGROUND

The Centers for Medicare & Medicaid Services (CMS) is the Federal agency that administers the Medicare and Medicaid programs. A top priority for CMS is reducing improper payments in the Medicare Fee-for-Service (FFS) program. To protect the Medicare Trust Fund, CMS must prevent improper payments that result in a loss of taxpayer dollars. Preventing improper payments requires the active involvement of multiple components in CMS and effective coordination with its partners, including various Medicare Contractors and providers/suppliers. CMS evaluates medical records and related documents to determine whether Medicare claims were billed in compliance with statutory, regulatory and sub- regulatory coverage, coding, payment, and billing rules. Paid claims that do not comply with Medicare’s coverage, coding, payment and billing rules are considered improper payments. Analyses of Medicare Parts A/B/DMEPOS claims data is one way to identify that Medicare may have paid claims improperly. Providers and suppliers may submit claims to various Medicare contractors under multiple provider numbers. In addition, some potential improper payments can only be identified when a provider’s Medicare claims data is compared to what that provider billed to a Medicaid agency or other public or private payer. These improperly paid claims could result in significant losses to the Medicare Trust Fund.

The Contractor claim reviews require, at a minimum, the clinical evaluation of medical records and related documents to determine whether Medicare claims were billed and paid in compliance with Medicare’s coding, coverage, billing and payment requirements. Statutory authority for the MR programs is found in Sections 1833(e) and 1862(a) of the Social Security Act (the Act).

II. GENERAL REQUIREMENTS

The Contractor shall perform in accordance with applicable laws, regulations, Medicare manuals, and CMS requirements to ensure the financial integrity of the Medicare program. The Medicare program’s legal, policy, and operating environment is complex, and the Contractor shall utilize or interact with certain CMS guidelines, systems, equipment, and operational capabilities in the performance of its functions.

A. COLLABORATION WITH OTHER INTERNAL AND EXTERNAL ENTITIES

CMS depends on a close and coordinated working relationship between its internal components and external organizations. The Contractor shall work with and coordinate with, as necessary, external entities including, but not limited to, the following:

· State Agencies

· Investigative agencies (such as, but not limited to, OIG, GAO, Federal Bureau of Investigation (FBI), Department of Justice (DOJ), and CMS Regional Offices

· Healthcare Fraud Prevention Partnership (HFPP) Trusted Third Party Contractor (TTP)

· Program Integrity Contractors (UPIC/ National Benefit Integrity Medicare Drug Integrity Contract (NBI MEDIC))

· Professional Organizations

· Infrastructure Service providers, other CMS Contractors, including but not limited to the Medicare Administrative Contractors (MAC). The SMRC specifically will collaborate with the MAC for activities such as completion and maintenance of a Joint Operating Agreement (JOA) and/or Service Level Agreement (SLA).

· Medical Review Accuracy Contractor (MRAC)

B. INFORMATION TECHNOLOGY (IT) AND SECURITY REQUIREMENTS

CMS requires that its business partners implement IT systems security controls in order to maintain the confidentiality, integrity, and availability of Medicare system operations in the event of computer incidents or physical disasters. The Contractor shall comply with the security requirements defined in the Business Partner System Security Manual (BPSSM), the CMS Information Security (IS) Acceptable Risk Safeguards (ARS), including CMS Minimum Security Requirements (CMSRs) (also known as IOM Pub. 100-25), and the Program Integrity Manual (IOM Pub. 100-8) all found at http://www.cms.gov/Regulationsand-Guidance/Guidance/Manuals/Internet-Only-Manuals- IOMs.html.

The Contractor’s information system/applications shall have a valid Authority to Operate (ATO) (conveyed through the CMS Chief Information Officer authorization decision process) before going into operation and processing CMS information. The implementation of a Federal Government information system requires a formal Government ATO for infrastructure systems and/or all application systems developed, hosted and/or maintained on behalf of CMS. NIST Special Publication (SP) 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, and CMS procedures (located on the CMS Information Security website at http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS- InformationTechnology/InformationSecurity) give guidelines for performing the system ATO process. The Contractor shall begin the process to obtain an ATO within 60 days of contract award.

Additionally, the Contractor shall incorporate and utilize the following information technology requirements:

· The Contractor staff shall be trained on security procedures as well as relevant aspects of the Privacy Act, Health Insurance Portability and Accountability Act (HIPAA), and the Freedom of Information Act. The Contractor shall adhere to the 508 Accessibility clause (HHSAR 352.239-73).

· The Contractor shall record completion of Information Security Awareness and RoleBased Security Training and retain the results in accordance with CMS procedures available at http://www.cms.gov/InformationSecurity. Training shall be consistent with the requirements contained in C.F.R. Part 5 Subpart C (5 C.F.R. 930.301) and conducted at least annually.

· The Contractor shall have in place a request management and prioritization system. This system shall allow for workflow management, prioritization of activities, identity management, user provisioning requests and activity reports. This system shall ensure that MR projects are appropriately triaged and managed in a timely manner.

· The Contractor shall protect all CMS information from unauthorized access, use, disclosure, duplication, modification, diversion, or destruction, whether accidental or intentional, in order to maintain the security, confidentiality, integrity, and availability of such information. The Contractor shall become and remain compliant with the requirements set forth at the CMS Information Security website at https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS- InformationTechnology/InformationSecurity/Info-Security-Library-Items/CMS- InformationSecurity-Contract-Clause-Provision.html

· The Contractor shall meet all FISMA/FedRAMP compliance requirements set forth at the CMS Information Security website at https://www.cms.gov/Research-Statistics-Dataand- Systems/CMS-Information-Technology/InformationSecurity/Info-Security- LibraryItems/CMS-Information-Security-Contract-Clause-Provision.html )

· The Contractor shall access the IOM Pub.100-08 and Business Partners Systems Security Manual (BPSSM) at http://cms.hhs.gov/manuals/downloads/117_systems_security.pdf for guidance on both physical and operational security. Physical and operational security is essential for all CMS contracts.

· The Contractor shall comply with FAR 52.239-1 Privacy and Security Safeguards, HHSAR 352.239-72 Security Requirements for Federal Information Technology Resources, and HHSAR 352.239-71 Standard for Encryption Language.

· CMS’ Core Security Requirements, as defined in the CMS BPSSM, including security standards adopted under the Health Insurance Reform regulations published pursuant to the Health Insurance Portability and Accountability Act (HIPAA) (FR Volume 68, Number 34 of February 20, 2003), are applicable to this contract and to all subcontracts (see https://cms.hhs.gov/manuals/downloads/117_systems_security.pdf for BPSSM).

· The Contractor shall check the following web site frequently for updates to the manuals and tools: https://www.cms.gov/Research-Statistics-Data-and-Systems/CMSInformation- Technology/InformationSecurity/Information-Security-Library This page contains links to all of the security references needed for this SOW.

· The Contractor shall allow CMS to observe SMRC-conducted audits, reviews, evaluations, tests and assessments of the SMRC’s security program and facilities upon request. The results of any SMRC-conducted annual audits, reviews, evaluations, tests and assessments shall be made available to the Government for review.

· The Contractor shall utilize Electronic Submission of Medical Documentation (esMD) or applicable system for claims, prior authorization / pre-claim request review (esMD or other electronic medical system approved by CMS). The esMD system is operational at one of CMS Virtual Data Center (VDC) and allows providers and/or their represented agents known as Health Information Handlers (HIHs) to electronically submit medical documentation via a secure means to medical review Contractors. The esMD system is being reviewed to allow medical review Contractors to send claim review documents and data to providers via secure means. Any future updates to the system will be communicated to the Contractor by CMS.

· The Contractor will provide all program management support functions, to include the participation of the medical director on the contract with the esMD recommendation and evaluation workgroup (esMD workgroup participation as required) to support the medical review conducted by the Contractor. In the initial implementation of the system, user requests will be made through a Contractor-furnished interface and a completed report of each medical review project/task will be passed directly back to CMS.

· CMS has specific requirements when interfacing with other entities. Example entities that may interface with the Contractor include but are not limited to Medicare Administrative Contractors (MACs), Unified Program Integrity Contractor (UPIC), National Benefit Integrity Medicare Drug Integrity Contract (NBI MEDIC), the HFPP Trusted Third Party (TTP) and analytics contractors, Medical Review Accuracy Contractor (MRAC), and the other related entities as directed by CMS.

· The SMRC and entities interfacing with the SMRC shall develop a Joint Operating Agreements (JOA) or Service-Level Agreements (SLA). These agreements ensure that all parties understand their respective roles and responsibilities. The Contractors shall execute, update, and perform associated duties in accordance with a JOA and/or SLA. A JOA and/or SLA defines mutually agreed upon and cost-effective methods of CMS contractors working together. Examples of activities that the JOA and/or SLA may cover are: adjustment of SMRC claims review, handling and reporting identified as well as collected underpayments and overpayments, reopenings, appeals of SMRC adjusted claims, reporting for SMRC support operations, and other SMRC support activities.

· A JOA and/or SLA describes the work that needs to be accomplished, and the roles and responsibilities of each signatory to the success of the task or project. It includes specifics about who will do what, when, and for whom. The JOA and/or SLA also spells out the process the parties will follow if either believes that the other is not following the agreement, including any alternative dispute resolution procedures.

Each JOA and/or SLA should include, but not be limited to, the following topics:

· Confidentiality

· Definitions

· Workload

· Contract Roles and Responsibilities

· Dispute Resolution

· Connectivity

· Communication

· The Contractor is responsible for identifying and negotiating any changes required to appropriately address the roles and responsibilities of the parties to the JOA and/or SLA. The Contractor is responsible for identifying and negotiating any changes required to appropriately address the roles and responsibilities of the parties to the JOA and/or SLA. NOTE: Other independent tasks will be performed concurrently while finalizing the JOA and/or SLA to ensure work continuity.

C. CMS DATA USE AGREEMENT (DUA)

The CMS makes data files available to certain stakeholders as allowed by federal laws and regulations as well as CMS policy. CMS enters into Data Use Agreements (DUAs) with most data requesters for disclosures of protected health information (PHI) and/or personally identifiable information (PII) to ensure that data requesters adhere to CMS privacy and security requirements and data release policies. A CMS DAU is used to create a traceable record of what data is being accessed by each CMS contractor. All CMS contractors requiring access to PHI/PII as well as their Contracting Officer Representatives (CORs) must create and maintain their CMS DUAs through the Enterprise Privacy Policy Engine (EPPE) system.

1. DUA Closeouts - CMS DUAs may only be approved for a period of up to one year. After one year, the DUA will expire unless the DUA Requester either extends or closes the DUA. If a DUA for an organization expires, it is important to note that ALL open DUAs for that organization will be frozen. This means that no new DUAs or actions on existing DUAs (adding data or changing contacts) will be processed for any DUAs held by that organization until the expired DUA is either extended or closed. The DUA system will send the DUA contacts (Requester, Custodians, COR, Federal Project Officer (FPO), and Principal Investigators) notification e-mails at the following intervals, before the DUA expires: 60 days, 30 days, 15 days, and every day thereafter.

2. EPPE - The EPPE is the system that tracks all disclosures of CMS data. Prior to gaining access to the EPPE system, contractors and CORS must complete EPPE training. For additional information about the DUA process and EPPE, see the Applicable DUA Links Table below. CMS Contractors are required to process DUA requests in EPPE. Please see the CMS Contractor web page (link included in table below) for instructions on how to Extend/Close DUAs.

Applicable DUA Links

Privacy-Policy-Engine

Agreements/Overview

_Forms

Agreements/DUAContractors

D. WORK FUNCTIONS

CMS Team for the SMRC Work - Certain CMS staff shall serve as Business Function Leads (BFL), Alternate Contracting Officer Representatives (ACOR), Subject Matters Experts (SMEs), and Program Lead (PL) to assist the COR in operationalizing this contract. These CMS staffs are referred as the COR ‘designees’ in this document. The PL/SME/BFL/ACOR are not authorized to direct changes to the terms of this task order. Only the COR can give technical direction to the contractor.

Project Initiation–A project starts when the COR initiates work through technical direction in a format defined by CMS. The project initiation will entail details of the project, such as: background, type of activity, type of claims, dates of services and other pertinent data to begin the project. The SMRC shall acknowledge their understanding of the project. Any updates and/or changes to the project will require modified technical direction and an updated acknowledgement of understanding from the SMRC. The COR designees, as described above shall provide operational guidance to the Contractor on matters within COR designees’ area of responsibility.

The Contractor must provide an auditable record of work requests and a process to prioritize and assign Contractor personnel to ensure timeliness in processing medical reviews.

If the Contractor disagrees with the project details directing the work, the contractor will provide justification and supporting rationale for review and consideration to the COR and/or designees.

Work not related to an agreed upon project will require written approval prior to the Contractor incurring costs. The exceptions to this will be for requests for re-review communicated by the MAC, and requests by the MAC for documentation for the purpose of appeals, in accordance with the agreed upon process in the SMRC-MAC JOA. In these cases, the Contractor will provide the detailed information for the completion of these tasks in the monthly status report for the purpose of reconciling invoices.

NOTE: For this document, any reference to “days” is considered to be “business days,” unless otherwise specified.

III. SPECIFIC REQUIREMENTS

The Contractor shall perform and/or support MR projects/tasks at the direction of CMS. The Contractor must provide analysis of the MR performed. The Contractor shall perform the MR projects, and/or tasks based on the work request procedures and delivery acceptance criteria described in this SOW.

1. CMS will direct the Contractor to conduct MR projects/tasks. MR projects/tasks shall be provided via a secure environment.

2. The Contractor shall capture MR projects/tasks information and/or reports in an electronic format for transmittal to CMS via a secure environment.

3. The Contractor shall develop a process for receipt of work requests, prioritization of work, and monitoring of work completion. This workflow process shall have the capabilities to develop/produce project status updates for every aspect of the medical review project. The workflow process shall be detailed in a chart. The Contractor shall have in place a mechanism to oversee and monitor the progress of all assigned projects. Monthly updates will be provided to CMS. Additionally, the contactor shall be able to provide status updates on an adhoc basis.

4. The CMS periodically evaluates medical review determinations made by a variety of CMS contractors performing medical review of Medicare claims, including the Contractor. This is to ensure that medical review is being conducted consistently across all medical review contractors. As such, upon request, the Contractor shall provide to CMS or a designated accuracy contractor a list of all completed medical review claims for active projects by both work streams for sampling selection by CMS or the designated accuracy contractor.

Fifty (50) medical review cases shall be provided to the designated accuracy contractor and shall be comprised of medical review conducted by both work streams. The type of medical review cases to be submitted will be determined by CMS. CMS may request additional claims over and above the average of 50 claims per month for Quality Assurance (QA) purposes at any time.

The CMS Medical Review Accuracy Program lead will notify the Contractor of the outcome of their medical review case evaluations. The Contractor will have the opportunity to provide a rebuttal for any cases for which there is a disagreement between the SMRC and the CMS Medical Review Accuracy Contractor. At CMS discretion, CMS reviews disagreements between MR contractors and the Medical Review Accuracy Program Contractor. CMS findings will be shared with the SMRC Contractor.

The overall scope of work for the project includes the following primary tasks/activities:

Note: Task 3 is marked as intentionally left blank to maintain the numbering scheme of the tasks.

· Task 1: PCG Specialty Reviews

· Task 2: Medical Reviews for Program Integrity Support

· Task 3: – INTENTIONALLY LEFT BLANK.

· Task 4: Perform Non-Medical Record Review

· Task 5: Research

· Task 6: Data Analysis

· Task 7: Claim re-review

· Task 8: Public Website

· Task 9: Record Management and Work Tracking

· Task 10: Customer Support

· Task 11: Defending Medical Review Decisions at Administrative Law Judge (ALJ) Hearings

· Task 12: CAA Telehealth Project

This task order also includes optional tasks that may be exercised at CMS’ discretion, these tasks are:

· Optional Task 1: Special Project-Home Health; Third Party Liability (HHA-TPL)

· Optional Task 2: Public Portal for dashboard reporting

· Optional Task 3: Ad-hoc Innovation Project(s)

· Optional Task 3(A) – Medi-Medi Specialty Projects

· Optional Task 4: Statistical Extrapolation of Overpayment or Potential Overpayment

· Optional Task 5: Recalculation of Statistical Extrapolation of Overpayment

A. TASKS

NOTE: The SMRC must track all costs incurred under each workload stream and bill to the appropriate contract line item number (CLIN) under this contract for: PCG Specialty MRs (Task 1), and Program Integrity/ MRs (Task 2).

For Medical Record Reviews: The Contractor shall use CMS developed medical review reason codes and statements when making recommendations and reporting medical review related findings. CMS will provide the Contractor a CMS point of contact to obtain medical review reason codes, definitions, conventions and/or other applicable medical review finding code rules.

Task 1: PCG Specialty Reviews Medical Record Review A medical record is the systematic documentation of a single beneficiary’s medical history and care across time. Information is the additional documents that are not in the medical record. Medical record review is the evaluation of the beneficiary’s information and medical records by Medicare Contractors to ensure that payment is made only for services that meet all Medicare coverage, coding, and medical necessity requirements.

Medical record review requires a licensed medical professional to make a clinical judgment about whether a service is covered, and is reasonable and necessary. There may be instances when a medical record review does not require clinical judgment and may be performed by a non-clinician. An example is when CMS orders a coding only review in which case a certified coder could be used.

When clinical judgment is needed, a medical record review must be performed by registered nurses (RN), or specialty practitioners (such as: physical therapist, chiropractor) or physicians. During a medical record review, registered nurse and physician reviewers may call upon other health care professionals (e.g., dieticians or physician specialists) for advice. The Contractor shall ensure that services reviewed by other licensed health care professionals are within their scope of practice.

The Contractor may be required to conduct medical record review of post pay, with a provider specific or service-specific focus. The Contractor shall conduct medical record reviews for Medicare Part A and Part B, including DMEPOS claims.

The Contractor will perform medical record review and/or support a large volume of claims that are generated from all fifty (50) states and in six (6) territories.

Upon receipt of CMS’ direction for each project, the Contractor shall perform the following medical record review activities:

· The Contractor shall develop a medical record documentation request letter for the solicitation of medical records and supporting documentation needed to review the claims. This medical record documentation request letter is known as the Additional Documentation Request letter (ADR). The ADR format shall be in compliance with IOM 100-8, Program Integrity Manual (PIM) (including any future revisions of the PIM, where applicable) and shall be pre-approved by CMS for each project.

· The Contractor shall send the ADR requesting medical records and supporting documentation for medical record review. The Contractor shall draft the documentation request letter in such a way as to minimize provider/supplier burden. The documentation requested must be limited in scope and specific to the benefit/project at issue. Time frames for provider/supplier responses are described later in this document.

· The Contractor shall review all claims for medical review in accordance with statutory, regulatory and sub-regulatory coverage, coding, payment, and billing requirements. The Contractor shall follow all applicable CMS online manuals, including the PIM and any future revisions of the PIM, as directed by CMS. The Contractor shall make a medical record review decision within 30 calendar days of receiving the requested documentation, provided the documentation is received within 45 calendar days of the date of the ADR or the date of the granted extension. The contractor shall mail the review results notification letter to the provider/supplier following the review completion of the provider/supplier entire sample of claims for the project.

· The Contractor shall automatically recommend a denial for any claim where a provider/supplier fails to send medical records and/or supporting documents within the CMS specified time frames. CMS encourages the Contractor to minimize provider/supplier burdens whenever possible. Accordingly, the Contractor has the discretion and is strongly encouraged to grant extensions to medical record documentation submission timeframes for those providers/suppliers that make an extension request prior to the end of the CMS specified response timeframe. The Contractor also has the discretion to grant extensions to those providers/suppliers that make a request after the CMS specified response timeframe.

· The Contractor shall conduct Discussion and Education (D&E) (Please see D&E detailed description section) following the provider/supplier’s receipt of the final results letter. During this verbal exchange, the rationale for recommendation of claim denials will be explained to the provider/supplier. A reviewer involved with knowledge of the provider/supplier claim sample shall be a participant in the D&E session. If the initial reviewer no longer works for the Contractor, the Contractor MR Management shall be familiar with the case and participate in the D&E session. The D&E period shall also apply to claims re-reviewed under Task 7 (Claims re-review).

· The Contractor shall maintain the confidentiality of medical records and documents in accordance with statutory and CMS policies. Any time there is suspicion of fraud or abuse, the Contractor shall notify the COR and/or designees. The Contractor shall also coordinate and communicate directly with ZPICs/UPICs to ensure coordination of efforts and prevent inappropriate duplication of review activities or interference with an existing investigation or corrective action plan.

· The Contractor shall provide a detailed final review results letter to each provider/supplier for their sampled claims. The final review results letter must contain enough specific detail, in plain language. The letter should clearly explain to the provider/supplier the basis for each claim decision, recommendation or basis for exclusion from the medical record review audit.

Discussion and Education (D&E):

The Contractor shall offer to conduct D&E following the provider/supplier’s receipt of the final results letter. Discussion and education between the Contractor and the provider/supplier is not automatic. The provider/supplier must request to have a D&E session with the Contractor. Thus, while the D&E session is part of the CMS directed medical record review, not all providers/suppliers will receive a D&E session. Only providers/suppliers requesting a D&E session where medical records were reviewed within the timeframes described below shall be eligible. During the verbal D&E between the Contractor and the provider/supplier, the rationale for recommending a claim denial will be explained to the provider/supplier. In addition, the Contractor shall engage the provider/supplier in D&E regarding any other matter related to the claims review. That is, the D&E should be didactic and not strictly limited to only discussing rationale for recommending a claim be denied. The D&E period shall also apply to claims reviewed as claim(s) re-review (Task 7).

The final review results letter to the provider/supplier shall include instructions on how to request a D&E session. Specifically, the letter shall state that requests must be submitted via telephone, electronic or written communication, within calendar 14 days of the date of the final medical record review results letter. The final review results letter shall also notify the provider/supplier that they may elect to submit documentation but decline a D&E session (see Task 7: Claim(s) re-review for timelines)

The Contractor shall offer to hold a D&E session within 14 calendar days of receipt of the D&E request from the provider/supplier. The contractor shall accommodate the provider/supplier’s request for date/time if outside of the 14 days when able. During the D&E session, the Contractor shall explain their rationale for their recommended payment decision and what the provider/supplier can do to ensure that their claims meet all Medicare coverage, coding, payment and billing requirements. Throughout the D&E session, the Contractor shall suggest to the provider/supplier what additional documentation can be submitted to support the claim within 14 calendar days of when the D&E session was held. If the provider/supplier submits additional documentation to support the claim, the Contractor shall review the additional documentation submitted within 14 calendar days.

Once the Contractor has completed the re-review with the additional documentation, the Contractor shall send a revised final results letter to the provider/supplier within a reasonable time, generally within 7 days.

If the provider/supplier requests to speak to the Contractor Medical Director (CMD), the CMD shall be available for that conversation. Some provider/suppliers, or their corporate organizations, hire 3rd parties to represent them during the D&E session. Sometimes the 3rd party sends an inquiry to the SMRC on behalf of their clients. The SMRC must be in possession of evidence of the provider/supplier authorization for the 3rd party representation before engaging the 3rd party in any discussion or replying to the third party’s inquiry.

In general, when a request for D&E is received after the 14 calendar days, the Contractor does not grant an extension. However, on a case by case basis, the Contractor is able to grant extensions, and CMS encourages the Contractor to grant them. When the Contractor elects not to grant the extension request, the Contractor shall immediately notify the provider/supplier in writing that the D&E request is invalid.

In general, when additional medical record documentation is received after the 14 days from the D&E session, the Contractor has the discretion to accept this or immediately notify the provider/supplier in writing that the documentation will not be reviewed, and the submission is invalid. However, on a case-by-case basis, the Contractor is able to grant extensions and CMS encourages the Contractor to grant them.

If, after the D&E, the Contractor changes the recommendation to pay versus deny the claim, they may do so. For the Final Project Report, changes in payment recommendations shall be summarized using the appropriate reporting category for re-reviews. If the change in payment recommendation occurs prior to the Contractor sending the recommendation to the

MAC for processing recoupment, also known as jurisdictional claim data report, the Contractor shall revise the jurisdictional claim data in the original claim data report. If the change in the payment recommendation occurs after the jurisdictional claim data report is submitted to the MAC, the Contractor shall re-submit a request to the MAC to perform the adjustment. This can be done using the processes outlined in the JOA.

The Contractor shall include the results of the D&E sessions by project in the Final Project Report. In addition, the Contractor shall describe how the findings from the D&E sessions were used to improve training for Medical Record Review staff. The Contractor shall report an adjusted Quality Assurance (QA) score for review determinations on the project that reflects the D&E findings. Sometimes during D&E, the contractor may gain new information that would have changed the outcome of previously reviewed claims. The Contractor should apply this new knowledge to other claims as a result of reviewer error or policy misinterpretations identified by the Contractor or CMS. These changed payment recommendations should not be considered or reported under D&E. CMS considers this activity quality assurance. That is, new information gained by the Contractor should be used to continuously improve their medical review processes.

There may be instances when the provider/supplier is eligible for a D&E session, however, declines a teleconference to discuss medical review findings. The provider/supplier may still request a re-review of the medical review findings with submission of additional documentation. The provider/supplier must convey to the Contractor their intent to submit additional documentation within 14 calendar days of the date of the final results letter. The Contractor must receive the additional documentation within 30 calendar days of the final results letter.

The Contractor shall send recommendations for denials/payment adjustments to the MACs or the final re-review from a D&E or re-review within the timeframes outlined in the JOA. If no D&E is requested by the provider/supplier, the Contractor shall send recommendations for denials/payment adjustments to the MACs as outlined in the JOA after the time to submit a request for D&E has passed.

NOTE: The SMRC shall make reasonable accommodations to hold D&E sessions with providers located in various time zones.

See section titled “Reporting Requirements” and Deliverable Table.

All activities incurred for ‘Task 1: PCG Specialty Reviews’ shall be billed to the appropriate contract line item number (CLIN) under this contract.

Task 2: Medical Reviews for Program Integrity Support

The primary principle of Program Integrity (PI) is to pay claims correctly. The Center for Program Integrity follows four parallel strategies in meeting this goal: 1) preventing fraud through effective enrollment and through education of providers and beneficiaries, 2) early detection through, for example, medical review and data analysis, 3) close coordination with internal and external partners, including Program Integrity Contractors (UPIC/ NBI MEDIC), MACs, Healthcare Fraud Prevention Partnership (HFPP) Trusted Third Party (TTP) Contractor, law enforcement agencies, and 4) fair and firm enforcement policies.

The SMRC shall provide medical review in support of CMS requests. This could include provider/supplier specific Medical Review or medical review to validate patterns identified in data.

The SMRC shall provide support to CMS in regard to the implementation, management, monitoring and reporting of administrative actions (e.g., prepayment edits for program integrity, overpayment recoupment, etc.).

The SMRC shall provide notification and feedback to providers and suppliers in support of Medicare MR findings.

The SMRC shall perform Medicare MR functions in accordance with IOM Pub.100-08 unless specifically directed otherwise in the SOW or other CMS instruction.

Initiation of Projects Projects shall be initiated by CMS by the COR. CMS will provide a written request to the contractor and any supporting data as needed. This request may be provided as part of a collaboration with other CMS contractors or external stakeholders. Upon receipt of the request the contractor shall, at a minimum, perform the following steps within 10 business days of receipt of the project:

1. Review the request and associated data. Contact CMS with any questions regarding the project

2. Perform any additional data analysis, as needed by the contractor to perform the medical review

3. Compare the claims data with the RAC Data Warehouse to determine whether any claims or providers need to be suppressed or excluded

4. Produce and send Additional Documentation Requests (ADRs) to the providers and suppliers using an approved template provided by CMS

a. ADRs shall provide contact information for the assigned CMS Point of Contact and include direction on how to provide requested documentation to the contractor

b. ADRs shall be sent via a delivery service that is trackable and requires a signature receipt by the provider

c. Copies of ADRs and associated claims data shall be made available to CMS if requested.

Management of ADRs and Medical Records

1. The contractor shall track the receipt of medical records, and any extensions requested. The contractor shall provide notification to CMS if no records are received by the due date indicated on the ADR or by the extension date.

a. If no records are received by the due date of the initial ADR, a secondary ADR shall be sent to the provider

2. If no records are received after the second ADR or after the due date of an extension, the contractor shall deny those claims for no receipt of records, unless otherwise directed by CMS.

Medical Record Review The contractor in support of CPI program integrity (PI) work through review of assigned medical records shall focus, among other things, on the following:

· Possible falsification or other evidence of alterations of medical record documentation including, but not limited to obliterated sections; missing pages, inserted pages, white out; and excessive late entries;

· Evidence that the service billed for was actually provided and/or provided as billed; or,

· Patterns and trends that may indicate potential fraud, waste, and abuse.

· At the discretion of CMS, the Contractor shall conduct ‘Discussion and Education’ to the provider/supplier as part of the medical record review.

· For Task 2 the Contractor shall make medical record review decisions on all requested claims within 60 days, and notify CMS, in writing, within 75 calendar days of receiving all requested documentation.

Quality of care concerns

The SMRC shall refer suspected instances of apparent unethical or improper practices or unprofessional conduct (e.g., quality of care issues) to the appropriate entity in accordance with the timeframes identified in the PIM. For Medicare-related issues, the SMRC shall coordinate with the Quality Improvement Organization (QIO). For issues involving other programs, the SMRC shall coordinate with these entities and CMS.

Lead development

The Contractor is encouraged to develop leads for new projects and to be innovative in its approach to lead development. Leads and supporting data shall be presented to CMS for consideration.

Vulnerability identification

A Program Vulnerability is an identified flaw or weakness in policy and/or regulatory authority that increases the likelihood of significant inappropriate payments being made to a broad provider/supplier population.

The Contractor shall provide CMS with recommendations for possible controls, audits, or policy changes to reduce the vulnerability. Further, the Contractor shall be proactive and innovative, using many different sources and techniques for analyzing data to reduce any of its risks within this SOW.

The Contractor shall work with and coordinate with entities and partners including, but not limited to, CMS, MACs, Federal stakeholders, HFPP TTP, and Law Enforcement representatives.

Vulnerabilities may be documented in the Final Report.

For submission of Program Vulnerabilities, please refer to IOM 100-08; Chapter 4, 4.31 – Vulnerabilities.

Recommendations The contractor shall provide its recommendations for additional actions to be taken by CMS. These recommendations shall be submitted as a separate document with the Final Report. Recommendations can be, but are not limited to, the following:

· Referral to law enforcement

· Referral to the UPIC

· Re-review at a later date

· Discussion and education of the provider (see D&E section of SOW) Overpayments As required by CMS, the SMRC shall refer Medicare overpayments to the MAC that made the initial claims payment for collection. The SMRC shall supply the required documentation supporting each overpayment to the MAC.

Review parameters and guidelines The Contractor shall maintain current references to support MR determinations. The review staff shall be familiar with the below references and be able to track requirements in the internal review guidelines back to the statute or manual. References include, but are not limited to:

· CFRs;

· CMS Internet Only Manuals (IOMs);

· Local coverage determinations (LCDs);

· National coverage determinations (NCDs); and

· Internal review guidelines (sometimes defined as desktop procedures).

The contractor shall have specific review parameters and guidelines established for the identified claims. Each claim shall be evaluated using the same review guidelines. The claim and the medical record shall be linked by patient name, HICN, MBI, diagnosis, claim number, and procedure.

The contractor shall evaluate if the provider specialty is reasonable for the procedure(s) being reviewed. As examples, one would not expect to see chiropractors billing for Cardiac care, podiatrists for dermatological procedures, and ophthalmologists for foot care.

The contractor shall ensure the individual(s) documented in the medical records meets the necessary Federal and State requirements necessary to perform the services billed.

The contractor shall evaluate and determine if there is evidence in the medical record that the service submitted was actually provided, and if so, if the service was medically reasonable and necessary. The contractor shall also verify diagnosis and match to age, gender, and procedure.

The contractor shall determine if patterns and/or trends exist in the medical record that may indicate potential fraud, waste, or abuse or demonstrate potential patient harm. Examples include, but are not limited to:

· The medical records tend to have obvious or nearly identical documentation.

· In reviews that cover a sequence of codes (e.g., evaluation and management codes, therapies, and radiology), evidence may exist of a trend to use with greater frequency than would be expected the high-end billing codes representing higher level services.

· In a provider/supplier review, a pattern may be identified of billing more hours of care than would normally be expected on a given workday.

· The medical records indicate a procedure is being done more frequently than prescribed per suggested CMS guidance or industry standards of care, resulting in potential situations of patient harm.

The contractor shall evaluate the medical record for evidence of alterations including, but not limited to, obliterated sections, missing pages, inserted pages, white out, and excessive late entries. The contactor shall comply with the signature attestation process as outlined in the PIM. The contractor shall not consider undated or unsigned entries handwritten in the margin of a document. These entries shall be excluded from consideration when performing medical review.

The contractor shall document errors found in writing in the final summary when the contractor’s review does not find evidence of questionable billing or improper practices.

The contractor shall adjust the service, in part or in whole, depending upon the service under review, when medical records/documentation do not support services billed by the provider/supplier.

The contractor shall thoroughly document the rationale utilized to make the MR decision. Upon receipt of the final MR results, the CMS will make a determination as to whether contractor should proceed with overpayment calculation or send referrals to other contractors.

Quality Improvement (QI) Process

The contractor shall develop a process to address how it will monitor and maintain accuracy in decision making (inter-reviewer reliability). The contractor shall establish a QI process that verifies the accuracy of MR decisions made by licensed health care professionals. The contractor shall include inter-rater reliability and/or peer-review assessments in their QI process and shall report these results as directed by CMS.

The contractor shall have a teleconference with CMS at an interval establish by CMS to advise of issues and findings. The Contractor shall issue a monthly written report with its findings and any analysis and recommendations they may have—format and content will be agreed upon between the contractor and the COR. This report will be included in the monthly status report.

The Contractor, using a template to be provided by CMS, will issue a yearly summary report as well as an end of project report to CMS summarizing their findings and any analysis and recommendations they may have; the format and content will be agreed upon between the contractor and the COR.

NOTE: Ad hoc conference calls or status updates may be needed to discuss particular reviews and or analyze results/findings.

Under Task 2, the Contractor shall comply with Tasks 4 thru 11 as outlined in this SOW.

All activities incurred for ‘Task 2: Medical Reviews for Program Integrity Support and HFPP carryover work shall be billed to the appropriate contract line item number (CLIN) under this contract.

**NOTE: Tasks 4-11 will apply to Tasks 1 and 2

Task 4: Perform Non-Medical Record Review

Non-medical record review is the process of making a payment recommendation without reviewing medical records or information.

Non-medical record review can occur in the following circumstances:

Issuing a recommendation of denial as a result of no response to an ADR letter: When the Contractor sends an ADR letter to the provider/supplier and does not receive a response, the Contractor issues a recommendation for denial. The level of effort required to recommend a denial as a result of no response to an ADR letter is different than the level of effort required to recommend a denial after conducting a medical record review. This is considered a non-medical record review because no review of the beneficiary’s medical record has been completed.

The Contractor shall notify CMS in the Monthly Status Report of the number of non-medical record review for claims as a result of no response to an ADR letter. In addition, this number shall be recorded in the Final Project Report for Task 1, see “Reporting Requirements” for Task 1.

Issuing a recommendation of denial for related claim(s) associated with the primary claim: Sometimes the primary claim will have associated services for which there are separate payments. Per SSA 1862 (a)(1)(A), Medicare shall only make payment for items or services that are reasonable and necessary for the diagnosis or treatment of illness or injury or to improve the functioning of a malformed body member.