Eight Elements of Compliance and Operational Intersects

1. Eight Elements of Compliance and Operational Intersects Mathew D. Babcock Assistant Medicaid Inspector General Healthcare Financial Management Association of Northeastern New York First HFMA NENY Annual Institute December 17, 2013 Clifton Park, NY

2. Thank you For inviting the Office of the Medicaid Inspector General to speak today.

3. Today’s Agenda • Introduction • New York’s Medicaid Compliance Program Obligation • Compliance Program Application to Operations • Annual Certifications • How Providers Can Use the Compliance Program Assessment Form (if we have time)

4. The Fine Print • Personal opinions and ideas for collegial discussion • These slides are not intended to provide legal advice; do not represent the opinion of OMIG; and shall not bind OMIG in any way • Acknowledgement – ideas and some materials from many sources – we own the errors • Assumption – you are here to learn what the right thing is, so we should try to help • If you have a question, ask it – someone else probably wants to know the answer • If you find these slides useful, please use them • Compliance is a developing field, so expectchanges

5. Introduction

6. OMIG’s MISSION STATEMENT Our mission is to enhance the integrity of the New York State Medicaid program by preventing and detecting fraudulent, abusive, and wasteful practices within the Medicaid program and recovering improperly expended Medicaid funds while promoting high-quality patient care.

7. We Have A Statewide Presence Regional Offices: • Albany • Buffalo • Hauppauge • New York City • Rochester • Syracuse • White Plains

8. Recent Accomplishments: 2013 • More than $144.6 million identified (actual cash recoveries: more than $310 million) (first nine months) • Finalized and activated 20 audit protocols (posted on Web site – www.omig.ny.gov) (last updated: November 22, 2013)

10. 2013-14 Work Plan For the second consecutive year, OMIG’s Work Plan is organized into Business Line Teams (BLTs): • Managed Care • Medical Services in an Educational Setting • Home and Community Care Services • Hospital and Outpatient Clinic Services

11. 2013-14 Work Plan (Continued) BLTs (continued) • Mental Health, Chemical Dependence, and Developmental Disabilities Services • Pharmacy and Durable Medical Equipment • Physicians, Dentists and Laboratories • Residential Health Care Facilities • Transportation

12. 2013-14 OMIG Work Plan (Continued) • New review types: inventory reviews (pharmacy billings, compare to drug inventories) • Managed care • Protocols: Audit protocols posted on the OMIG Web site, with new protocols under development • Full Work Plan available at: http://www.omig.ny.gov/images/stories/ work_plan/2013_2014_workplan.pdf

14. OMIG’s Bureau of Compliance Mission Statement To educate, assist, and assess Medicaid program providers in meeting their obligation to establish and operate effective compliance plans that will prevent or in the alternative detect and address fraudulent, wasteful and abusive practices within the Medicaid program.

15. New York Is A Leader • New York was the first state to require compliance programs. • Created at the same time as OMIG in statute • Federal government adopted this approach as part of the Affordable Care Act • Compliance translates to the old adage: “An ounce of prevention is worth a pound of cure.”

16. New York's Medicaid Compliance PROGRAM obligation

17. Requirement for Compliance Programs Statutory and regulatory authority for the compliance program mandate? New York State Social Services Law (SSL) §363-d 18 New York Code of Rules and Regulations (NYCRR) Part 521

18. Who Must Have a Compliance Program? Persons… • subject to Public Health Law Article 28 or 36; • SSL §363-d subd. 4 and 18 NYCRR §521.1(a) • subject to Mental Hygiene Law Article 16 or 31; or • SSL §363-d subd. 4 and 18 NYCRR §521.1(b) Persons, providers or affiliates … • for which Medicaid is a substantial portion of their business operations. • SSL §363-d subd. 4 and 18 NYCRR §521.1(c)

19. Who Must Have a Compliance Program?(Continued) “Substantial portion of business operations” means any of the following: • 18 NYCRR §521.2(b) “When a person, provider or affiliate …” • “Claims or orders, or has claimed or has ordered or should be reasonably expected to claim or order at least $500,000 in any consecutive 12-month period from Medicaid; or” • “Receives or has received, or should be reasonably expected to receive at least $500,000 in any consecutive 12-month period, directly or indirectly from Medicaid; or” • “Submits or has submitted claims for care, services or supplies to Medicaid on behalf of another person or persons in the aggregate of at least $500,000 in any consecutive 12-month period.”

20. Elements of Mandatory Compliance Programs Compliance Programs shall include the following eight elements: SSL §363-d. sub 2 and 18 NYCRR § 521.3 (c) Element 1: Written Policies and Procedures - Code of Conduct/Ethics Element 2: Designation of Compliance Officer – Employee vested w/ responsibility Element 3: Training and Education Element 4: Communication Lines to the Compliance Officer/Function

21. Elements of Mandatory Compliance Programs(Continued) Element 5: Disciplinary Policies Element 6: Identification of Compliance Risk Areas and Non- Compliance Element 7: System of Responding to Compliance Issues Element 8: Policy of Non-Intimidation and Non-Retaliation

22. How to Build and Measure a Compliance Program for Effectiveness TONE FROM THE TOP Over time, are compliance gaps being closed? Assess the frequency of same audit issues/edits occurring. How are quality issues being addressed in the context of compliance? Are overpayments and underpayments being reported and recovered? Retest solutions previously identified to confirm relevance to the problem. M E A S U R E BUI LD OUTCOMES Compliance connections to board, management & enterprise operations. Working Policies and Procedures. Systems identifying risk areas, errors, PoC and monitoring-#6. Implementation of corrections & improvement-#7. PROCESSES Compliance plan document-#1. Compliance Officer/Compliance Committees-#2. Training and education programs-#3. Communication lines to CO-#4. Disciplinary policies and procedures-#5. Non-retaliation/non-intimidation-#8. STRUCTURE

23. Compliance program Application to operations how your compliance program Can/should interact with the 7 areas in 18 NYCRR 521.3(a)

24. Preliminary Matters • The 8 elements (above) provide the framework, the 7 areas (on the following slides) provide a context of how the 8 elements must be operationalized. • The 7 areas do not mean that the compliance officer must run, oversee or operate these. There should be a compliance connection. Compliance connection could be: • Compliance Officer on the team, committee, work group, etc. • Reports routinely issued to Compliance Officer of identified issues and the result of Plans of Correction • Reports available to Compliance Officer and management so that program integrity can be assessed independently • Regular review by Compliance Officer of established control functions for the various operational areas • Management of the issue by the Compliance Function • Communication is key.

25. 18 NYCRR § 521.3 Compliance Program Required Provider Duties • Every required provider shall adopt and implement an effective compliance program. The compliance program may be a component of more comprehensive compliance activities by the required provider so long as the requirements of this Part are met. Required providers’ compliance programs shall be applicable to: • billings; • payments; • medical necessity and quality of care; • governance; • mandatory reporting; • credentialing; and • other risk areas that are or should with due diligence be identified by the provider.

26. 18 NYCRR § 521.3 Compliance Program Required Provider Duties (Continued) What are some examples you see for connections between your Compliance Program and… (1) billings

27. 18 NYCRR § 521.3 Compliance Program Required Provider Duties (Continued) What are some examples you see for connections between your Compliance Program and… (1) billings • Audits of high risk coding and billing matters • Review of claim denials and root cause analysis of reasons for denial • Conduct a root cause analysis of billing errors and establish PoC • Never events • Review cost reports, rules for reimbursable costs & integrity of reports • Unbundling • Review billing staff training against errors and issues identified

28. 18 NYCRR § 521.3 Compliance Program Required Provider Duties (Continued) What are some examples you see for connections between your Compliance Program and… (2) payments

29. 18 NYCRR § 521.3 Compliance Program Required Provider Duties (Continued) What are some examples you see for connections between your Compliance Program and… (2) payments • Assess reason why payments are more/less than expected • Program for Evaluating Payment Patterns Electronic Reports (PEPPER) • Assess payment connection to billing issues and self disclosure obligation • Assess performance against metrics for timeliness of resolution of payment inquiries

30. 18 NYCRR § 521.3 Compliance Program Required Provider Duties (Continued) What are some examples you see for connections between your Compliance Program and… (3) medical necessity and quality of care

31. 18 NYCRR § 521.3 Compliance Program Required Provider Duties (Continued) What are some examples you see for connections between your Compliance Program and… (3) medical necessity and quality of care • Never events • DOH survey results • One-day stays • Meaningful oversight systems for QI and medical necessity oversight

32. 18 NYCRR § 521.3 Compliance Program Required Provider Duties (Continued) • Peer-to-peer tracking and mentoring on outcomes, quality and resources • Incident review and management • Culture of institutional responsibility vs. individual culpability • Identification and tracking of performance and relevance of quality indicators

33. 18 NYCRR § 521.3 Compliance Program Required Provider Duties (Continued) What are some examples you see for connections between your Compliance Program and… (4) governance

34. 18 NYCRR § 521.3 Compliance Program Required Provider Duties (Continued) What are some examples you see for connections between your Compliance Program and… (4) governance • Tone from the top proves commitment to integrity by all associated with the provider • Management-level compliance committee includes all major operations • Board and management oversight on compliance program, its operations, reporting results, plans of correction, development of compliance metrics, and development of annual work plan

35. 18 NYCRR § 521.3 Compliance Program Required Provider Duties (Continued) • Reports to board and management include status report on work plan, management of risk areas, plans of correction, and retesting • Meaningful conflict-of-interest disclosure and consideration process

36. 18 NYCRR § 521.3 Compliance Program Required Provider Duties (Continued) What are some examples you see for connections between your Compliance Program and… (5) mandatory reporting

37. 18 NYCRR § 521.3 Compliance Program Required Provider Duties (Continued) What are some examples you see for connections between your Compliance Program and… (5) mandatory reporting • Overpayments and underpayments addressed consistently • Affordable Care Act requirements tested and met • Mandatory reporting includes payment issues, but also quality and clinical matters

38. 18 NYCRR § 521.3 Compliance Program Required Provider Duties (Continued) What are some examples you see for connections between your Compliance Program and… (6) credentialing

39. 18 NYCRR § 521.3 Compliance Program Required Provider Duties (Continued) What are some examples you see for connections between your Compliance Program and… (6) credentialing • CMS recommends monthly excluded party checks • Review of services provided against scope of practice of caregivers or list of services identified in the operational certificate • Identify who must be credentialed against who is credentialed

40. 18 NYCRR § 521.3 Compliance Program Required Provider Duties (Continued) What are some examples you see for connections between your Compliance Program and… (7) other risk areas that are or should with due diligence be identified by the provider

41. 18 NYCRR § 521.3 Compliance Program Required Provider Duties (Continued) What are some examples you see for connections between your Compliance Program and… (7) other risk areas that are or should with due diligence be identified by the provider • Risk management, quality, internal/external audit, etc., interaction • Self assessment and addressing risks • Self assessment and plans of correction or annual work plan • OIG and OMIG annual work plans

42. 18 NYCRR § 521.3 Compliance Program Required Provider Duties (Continued) • Assess impact of changes to law/regulation, coding/billing rules • Operational & organizational changes • Identify performance against recognized benchmarks and react • Verification of compliance programs by vendors, as applicable

43. Annual certification requirements

44. OMIG Webinar #18 http://bit.ly/1iQ57vY Certification Requirement for NYS Social Services Law §363-d and 18 NYCRR §521.3(b) Certification Requirement for federal Deficit Reduction Act of 2005

48. NYS Medicaid Provider Compliance Obligations Certification Requirement 18 NYCRR §521.3: (emphasis added) (b) Upon applying for enrollment in the medical assistance program, and during the month of December each year thereafter, a required provider shall certify to the department, using a form provided by the Office of the Medicaid Inspector General on its Web site, that a compliance program meeting the requirements of this Part is in place.….

49. Federal Deficit Reduction Act of 2005 Obligations The DRA requires health care entities which receive or make $5 million* or more in Medicaid payments during a federal fiscal year (October 1 to September 30) to do the following: • establish written policies and procedures informing and educating their employees, contractors and agents about federal and state false claims acts and whistleblower protections *DRA’s FAQs identify $5 million in direct Medicaid payments received from the State for providers or for MCOs $5 million in Medicaid payments made

50. Federal Deficit Reduction Act of 2005 Obligations (Continued) • on or before January 1 of each year, required health care entities are required to certify: • that it maintains the written policies • that any employee handbook includes materials, required under the DRA mandate • that the materials have been properly adopted and published by the health care entity, and • that the materials have been disseminated to employees, contractors, and agents