Guidelines for Addressing Fraud and Abuse in Medicaid Managed Care

1. Guidelines for Addressing Fraud and Abuse in Medicaid Managed Care From the National Medicaid Fraud and Abuse Initiative, 10/2000 Deyna Hall, MHD Compliance Officer 3/2005

2. Summary The purpose of these guidelines is to assist you in preventing, identifying, investigating, reporting and prosecuting fraud and abuse in the Medicaid managed care environment.

3. Overview 1. Defining fraud and abuse in a Medicaid managed care environment. 2. Roles of Medicaid purchasers in controlling fraud and abuse. 3. Data needed to detect and prosecute fraud and abuse in managed care. 4. Key components of an effective managed care fraud and abuse program. 5. Fraud and abuse in managed care contracts, programs, and waivers.

4. 1. Defining fraud and abuse in a managed care environment The first step in combating fraud/abuse is to identify it. • Definitions found in 42 CFR 455.2 Fraud = “an intentional deception or misrepresentation made by a person with the knowledge that the deception could result in some unauthorized benefit to himself or some other person.”

5. Definitions (42 CFR 455.2) Fraud = “an intentional deception or misrepresentation made by a person with the knowledge that the deception could result in some unauthorized benefit to himself or some other person.” Abuse = “provider practices that are inconsistent with sound fiscal, business or medical practices and result in unnecessary cost to the Medicaid program, or in reimbursement for services that are not medically necessary, or that fail to meet professionally recognized standards for health care. It also includes beneficiary practices that result in unnecessary costs to the Medicaid program.”

6. Medicaid Managed Care definitions • Medicaid Managed Care Fraud = any type of intentional deception or misrepresentation made by an entity or person in a capitated MCO, PCCM program, or other managed care setting with knowledge that the deception could result in some unauthorized benefit to the entity, himself, or some other person. Can be committed by: an MCO, a contractor, a subcontractor, a provider, a State employee, or a Medicaid beneficiary/enrollee

7. Medicaid Managed Care Definitions (continued) • Medicaid Managed Care Abuse = practices in a capitated MCO, PCCM program, or the managed care setting, that are inconsistent with sound fiscal, business or medical practices and result in an unnecessary cost to the Medicaid program, or in reimbursement for services that are not medically necessary, or that fail to meet professionally recognized standards of contractual obligations for health care.

8. Please note: Medicaid Funds paid to an MCO, then passing on to subcontractors, are still Medicaid funds from a fraud and abuse perspective….

9. Fraud/abuse risk areas A. Procurement of the managed care contract. • Marketing and enrollment • Underutilization • Claims submission and billing procedures • Fee-for-service fraud in managed care • Embezzlement, theft, and related fee-for-service fraud

10. A. Procurement of the managed care contract The incentive may be receipt of payment of money to which the company would not otherwise be entitled. Examples: • Falsification of health care provider credentials • Falsification of financial solvency • Falsified or inadequate provider network • Fraudulent subcontract (agreement between parties that contains materially misleading information, has been pre- or post-dated and/or contains a forged or unauthorized signature) • Fraudulent subcontractor • Bid-rigging or self-dealing • Collusion among providers • Contracts with related parties • Illegal tying agreements

11. B. Marketing and enrollment fraud Generally a “startup” type of fraud Incentive can be found where the MCO has established the practice of paying a fee or bonus for individuals enrolled. All marketing plans and materials need to be approved by the State.

12. Marketing/enrollment fraud (continued) Examples: • Misrepresentation to beneficiaries (aka “slamming”) • Misrepresentation to beneficiaries by charging non-existent fees. • Enrolling ineligible individuals. • Enrolling nonexistent individuals. • Enrolling nonexistent or ineligible family members. • “Cherry-picking” or selecting healthier segments of the enrollment population. • Kickbacks for referrals. • Disenrolling undesirable members. • Failing to notify the State of deceased members. • Beneficiary enrollment fraud.

13. C. Underutilization Fraud/abuse occurs when an organization shows a pattern of failing to provide its members with medically necessary health care services on a timely basis. Examples: • Untimely first contact with clients • Untimely assignment of a primary care physician • Delay in reassigning a PCP upon an individual’s request • Discouragement of treatment using geographic or time barriers • Engagement in any Federally-prohibited activities • Failure to serve individuals with cultural or language barriers • Failure to provide educational services • Failure to provide outreach and follow-up care or Federally-required referrals • Failure to provide court-ordered treatment

14. Underutilization (continued) Examples (continued) • Defining “appropriateness of care” and/or “experimental procedures” in a manner inconsistent with standards of care. • Slow or non-existent drug formulary updates • Strict Utilization Review standards • Cumbersome appeal processes for enrollees or providers • Ineffective grievance process • Inadequate prior authorization “hotline” • Unreasonable prior authorization requirements • Delay or failure of the PCP to perform necessary referrals for additional care. • “Gag orders” • Incentives to illegally limit services or referral • Routine denial of claims.

15. D. Claims Submission and Billing Procedures Examples: • Balance billing • Inflating the bills for services/goods provided • Double-billing • Improper coding (upcoding/unbundling) • Billing for ineligible consumers or services never rendered • Inappropriate physician incentive plans • Reporting phantom visits and improper cost reporting • Inappropriate cost-shifting to carved outs services • Beneficiary fraud/abuse

16. E. Fee-for-service fraud Can occur if contracts with subcontractors/providers are not capitated and are paid on a fee for service basis. Examples: • Billing for unnecessary services/overutilization • Double billing • Unbundling • Upcoding • Ghost billing/billing for services not provided

17. F. Embezzlement, theft and related fee-for-service fraud • Embezzlement/theft • Diversion of funds for medical services to unnecessary administrative costs • “Bust outs” (premiums paid, but MCO claims bankruptcy and avoids paying providers/vendors)

18. 2. Roles of Medicaid Purchasers in Controlling Fraud/Abuse • CMS • Develops and implements effective oversight plans to assure that funds are used legitimately. • Assures that States have effective program integrity systems in place. • Approves State Medicaid Agencies’ MCO contracts. • Reviews current laws/regs and develops legislative proposals. • Provides technical assistance to States • Allows considerable flexibility in review/approval of demonstration projects • Promotes exchange of information among states • Provide information and assistance

19. State Medicaid Agency Roles • Designs/implements cost effective programs to combat fraud/abuse • Develop contract provisions relating to program integrity, and require MCOs to implement program integrity programs. • Provides technical assistance to MCOs to identify fraud/abuse, promote best practices in program integrity, and improve program outcomes. • Provide periodic training to MCOs. • Disseminate information and coordinate efforts and comply with reporting requirements. • Procedures to report suspected fraud/abuse to MFCUs and CMS. • Audits and contract reviews to assess compliance • Analyze EQRO data to identify potential fraud/abuseissues and inform the MCO and MFCU as appropriate.

20. Managed Care Organization Roles • Develop comprehensive internal programs to prevent and detect program violations. • Recover funds misspent due to fraudulent/abusive actions. • Comply with all reporting and other anti-fraud requirements • Reports suspected cases of fraud/abuse to the State Medicaid Agency. • Submit a certification to the State as to the truth, accuracy, and completes of each submission of their data. • Cooperates with MFCUs/DA and other agencies that conduct investigations. • Provides for exchange of information and strategies with State, MFCU, DA for addressing fraud/abuse, as well as allowing access to documents and other available information r/t program violations

21. Office of the Inspector General (OIG) roles • Conducts investigations, audits and evaluations and protects HHS programs/operations against fraud, waste and abuse. • Establishes and administers a nationwide Fraud and Abuse Control Program. • Coordinates federal, state and local law enforcement programs and the conduct of investigations, audits, evaluations and inspections. • Oversees the operation of the Medicaid Fraud Control Units (MFCUs) through their certification process and distribution of Federal matching funds. • Authority to exclude from participation individuals/entities determined to pose a risk to the program. • Authority to impose civil monetary penalties (CMPs)

22. 3. Data needed to detect and prosecute fraud and abuse in managed care Data can be used to: • Monitor service utilization, access to care, quality of care • Update/evaluate capitation payment rates • Monitor MCO and provider contract performance, and manage and enforce managed care contracts.

23. Data Sources and Collection • EQRO findings • QA studies • MCO financial, access, quality and grievance reports • Encounter data (most crucial)

24. Encounter Data • How an encounter is defined has considerable impact on the content/value of information collected. • Standard format for encounter data submission includes: HCFA-1500 for professional services, UB-92 for institutional care, and National Standard Drug Claim Form. • Data standards need to be stipulated in the RFP and individual MCO contracts, as well as the frequency that data should be submitted, maximum lag between date of service and encounter data submission, and time lines for correcting and resubmitting rejected claims.

25. Data • Data certification – MCO must attest to the truthfulness, accuracy and completeness of data submitted, each time data is submitted to the State, base d on best knowledge, information and belief, even if the actual provider of services has a Medicaid provider agreement with the state. Apples to related entities, contractors, subcontractors.

26. Data 4 potential areas for data integrity breakdown: 1. getting the data into the MCO’s management information system. 2. getting the data through the MCO’s MIS 3. getting clean data out of the MCO’s MIS and into the State’s MMIS, and 4. getting the data through the State’s MMIS System edits help verify data accuracy and completeness

27. Data • Data integration • Monitoring access to services is one process that requires that data be linked to other Medicaid data sources • Data analysis • Overutilization • Underutilization • Appropriate utilization (setting of care) • Appropriate utilization (clinical focus area)

28. 4. Key components of an effective managed care fraud and abuse program • Formal Plans • Prevention • Coordination • Detection • Enforcement • Reporting suspected cases of fraud/abuse

29. Formal Plans State Medicaid Agency Fraud and Abuse Plan • Outlines all of the State’s fraud and abuse prevention and detection activities, key partners and stakeholders and roles/responsibilities. • Outline goals of fraud/abuse efforts • Outline measurements to assess progress towards goals • Outlines areas of vulnerability and approaches to address • Should be incorporated into the State’s Quality Improvement Strategy • Adequate resources and data systems to manage a successful plan.

30. Formal plansMCO Fraud and Abuse Plan • Formal commitment to prevent, detect, investigate and report potential fraud and abuse occurrences. • Conduct regular reviews/audits of operations to guard against fraud/abuse • Assess/strengthen internal controls to ensure claims are submitted and payments made properly • Educate employees, network providers, beneficiaries about what fraud/abuse is and how to report. • Organizing resources to respond to complaints • Establish procedures to process complaints • Establish procedures for reporting information to the State Medicaid Agency. • Develop procedures to monitor service patterns of providers, subcontractors and beneficiaries.

31. B. Prevention • Provider enrollment and contract requirements • Beneficiary provider outreach and education • State hotlines (24-hour toll-free hotline) • Assess program vulnerabilities • Identify debarred individuals or excluded providers in MCOs (http://www.arnet.gov/epls or http://www.dhhs.gov.oig)

32. C. Coordination • MCO networking with MFCU/DA, State Medicaid Agency and EQRO • State Medicaid Agency Quality Improvement Staff Communication with SURS Staff • Coordination of reviews by different entities of same providers • Communication with Medicare and other State Medicaid staff • Reporting to CMS

33. D. Detection • Routine reviews on problem areas • Validation of managed care service data • Random reviews and beneficiary interviews • Unannounced site visits • Use of feedback and Quality Improvement

34. E. Enforcement SANCTIONS: • Suspensions • Permissive exclusion by MCO/State • Permissive/mandatory exclusions by the Federal government • Corrective action plans • Prosecution by either MFCU or DA • Overpayment collection • Civil Monetary Penalties • Temporary state management • Suspensions in enrollment • Debarment • Non-renewal of contract • Contract revision • Termination of a managed care entity

35. F. Reporting of suspected cases of Medicaid managed care fraud and abuse State MCOs and Medicaid Agencies should have procedures for exchange of information and collaboration among all involved parties to determine the best course of action.

36. 5. Fraud and abuse in managed care contracts, programs and waivers • Explicit fraud and abuse measures need to be incorporated into contracts, programs and waivers. • States should require MCOs to submit periodic written reports on their fraud and abuse activities, so that these can be monitored and assistance/guidance given as needed. • States to provide random medical record review as validation of services provided as reported. • States to provide providers and beneficiaries materials that include education about fraud abuse identification and reporting.