43 FR 45262, Sept. 29, 1978, unless otherwise noted.
This part sets forth requirements for a State fraud detection and investigation program, and for disclosure of information on ownership and control.
(a) Under the authority of sections 1902(a)(4), 1903(i)(2), and 1909 of the Social Security Act, Subpart A provides State plan requirements for the identification, investigation, and referral of suspected fraud and abuse cases. In addition, the subpart requires that the State—
(1) Report fraud and abuse information to the Department; and
(2) Have a method to verify whether services reimbursed by Medicaid were actually furnished to beneficiaries.
(b) Subpart B implements sections 1124, 1126, 1902(a)(36), 1903(i)(2), and 1903(n) of the Act. It requires that providers and fiscal agents must agree to disclose ownership and control information to the Medicaid State agency.
(c) Subpart C implements section 1936 of the Act. It establishes the Medicaid Integrity Program under which the Secretary will promote the integrity of the program by entering into contracts with eligible entities to carry out the activities of subpart C.
[51 FR 34787, Sept. 30, 1986, as amended at 72 FR 67655, Nov. 30, 2007]
As used in this part unless the context indicates otherwise—
Abuse means provider practices that are inconsistent with sound fiscal, business, or medical practices, and result in an unnecessary cost to the Medicaid program, or in reimbursement for services that are not medically necessary or that fail to meet professionally recognized standards for health care. It also includes beneficiary practices that result in unnecessary cost to the Medicaid program.
Conviction or Convicted means that a judgment of conviction has been entered by a Federal, State, or local court, regardless of whether an appeal from that judgment is pending.
Credible allegation of fraud. A credible allegation of fraud may be an allegation, which has been verified by the State, from any source, including but not limited to the following:
(1) Fraud hotline tips verified by further evidence.
(2) Claims data mining.
(3) Patterns identified through provider audits, civil false claims cases, and law enforcement investigations. Allegations are considered to be credible when they have indicia of reliability and the State Medicaid agency has reviewed all allegations, facts, and evidence carefully and acts judiciously on a case-by-case basis.
Exclusion means that items or services furnished by a specific provider who has defrauded or abused the Medicaid program will not be reimbursed under Medicaid.
Fraud means an intentional deception or misrepresentation made by a person with the knowledge that the deception could result in some unauthorized benefit to himself or some other person. It includes any act that constitutes fraud under applicable Federal or State law.
Fraud hotline tip. A fraud hotline tip is a complaint or other communications that are submitted through a fraud reporting phone number or a website intended for the same purpose, such as the Federal Government's HHS OIG Hotline or a health plan's fraud hotline.
Furnished refers to items and services provided directly by, or under the direct supervision of, or ordered by, a practitioner or other individual (either as an employee or in his or her own capacity), a provider, or other supplier of services. (For purposes of denial of reimbursement within this part, it does not refer to services ordered by one party but billed for and provided by or under the supervision of another.)
Practitioner means a physician or other individual licensed under State law to practice his or her profession.
Suspension means that items or services furnished by a specified provider who has been convicted of a program-related offense in a Federal, State, or local court will not be reimbursed under Medicaid.
[48 FR 3755, Jan. 27, 1983, as amended at 50 FR 37375, Sept. 13, 1985; 51 FR 34788, Sept. 30, 1986; 76 FR 5965, Feb. 2, 2011; 86 FR 6131, Jan. 19, 2021]
Part 1002 of this title sets forth the following:
(a) State plan requirements for excluding providers for fraud and abuse, and suspending practitioners convicted of program-related crimes.
(b) The limitations on FFP for services furnished by excluded providers or suspended practitioners.
(c) The requirements and procedures for reinstatement after exclusion or suspension.
(d) Requirements for the establishment and operation of State Medicaid fraud control units and the rates of FFP for their fraud control activities.
[51 FR 34788, Sept. 30, 1986]
A State plan must meet the requirements of §§ 455.13 through 455.23.
[52 FR 48817, Dec. 28, 1987]
The Medicaid agency must have—
(a) Methods and criteria for identifying suspected fraud cases;
(b) Methods for investigating these cases that—
(1) Do not infringe on the legal rights of persons involved; and
(2) Afford due process of law; and
(c) Procedures, developed in cooperation with State legal authorities, for referring suspected fraud cases to law enforcement officials.
[43 FR 45262, Sept. 29, 1978, as amended at 48 FR 3755, Jan. 27, 1983]
If the agency receives a complaint of Medicaid fraud or abuse from any source or identifies any questionable practices, it must conduct a preliminary investigation to determine whether there is sufficient basis to warrant a full investigation.
[48 FR 3756, Jan. 27, 1983]
If the findings of a preliminary investigation give the agency reason to believe that an incident of fraud or abuse has occurred in the Medicaid program, the agency must take the following action, as appropriate:
(a) If a provider is suspected of fraud or abuse, the agency must—
(1) In States with a State Medicaid fraud control unit certified under subpart C of part 1002 of this title, refer the case to the unit under the terms of its agreement with the unit entered into under § 1002.309 of this title; or
(2) In States with no certified Medicaid fraud control unit, or in cases where no referral to the State Medicaid fraud control unit is required under paragraph (a)(1) of this section, conduct a full investigation or refer the case to the appropriate law enforcement agency.
(b) If there is reason to believe that a beneficiary has defrauded the Medicaid program, the agency must refer the case to an appropriate law enforcement agency.
(c) If there is reason to believe that a beneficiary has abused the Medicaid program, the agency must conduct a full investigation of the abuse.
[48 FR 3756, Jan. 27, 1983, as amended at 51 FR 34788, Sept. 30, 1986]
A full investigation must continue until—
(a) Appropriate legal action is initiated;
(b) The case is closed or dropped because of insufficient evidence to support the allegations of fraud or abuse; or
(c) The matter is resolved between the agency and the provider or beneficiary. This resolution may include but is not limited to—
(1) Sending a warning letter to the provider or beneficiary, giving notice that continuation of the activity in question will result in further action;
(2) Suspending or terminating the provider from participation in the Medicaid program;
(3) Seeking recovery of payments made to the provider; or
(4) Imposing other sanctions provided under the State plan.
[43 FR 45262, Sept. 29, 1978, as amended at 48 FR 3756, Jan. 27, 1983]
The agency must report the following fraud or abuse information to the appropriate Department officials at intervals prescribed in instructions.
(a) The number of complaints of fraud and abuse made to the agency that warrant preliminary investigation.
(b) For each case of suspected provider fraud and abuse that warrants a full investigation—
(1) The provider's name and number;
(2) The source of the complaint;
(3) The type of provider;
(4) The nature of the complaint;
(5) The approximate range of dollars involved; and
(6) The legal and administrative disposition of the case, including actions taken by law enforcement officials to whom the case has been referred.
(Approved by the Office of Management and Budget under control number 0938-0076)
[43 FR 45262, Sept. 29, 1978, as amended at 48 FR 3756, Jan. 27, 1983]
(a) Except as provided in § 455.19, the agency must provide that all provider claims forms be imprinted in boldface type with the following statements, or with alternate wording that is approved by the Regional CMS Administrator:
(1) “This is to certify that the foregoing information is true, accurate, and complete.”
(2) “I understand that payment of this claim will be from Federal and State funds, and that any falsification, or concealment of a material fact, may be prosecuted under Federal and State laws.”
(b) The statements may be printed above the claimant's signature or, if they are printed on the reverse of the form, a reference to the statements must appear immediately preceding the claimant's signature.
As an alternative to the statements required in § 455.18, the agency may print the following wording above the claimant's endorsement on the reverse of checks or warrants payable to each provider: “I understand in endorsing or depositing this check that payment will be from Federal and State funds and that any falsification, or concealment of a material fact, may be prosecuted under Federal and State laws.”
(a) The agency must have a method for verifying with beneficiaries whether services billed by providers were received.
(b) In States receiving Federal matching funds for a mechanized claims processing and information retrieval system under part 433, subpart C, of this subchapter, the agency must provide prompt written notice as required by § 433.116 (e) and (f).
[48 FR 3756, Jan. 27, 1983, as amended at 56 FR 8854, Mar. 1, 1991]
In a State with a Medicaid fraud control unit established and certified under subpart C of this part,
(a) The agency must—
(1) Refer all cases of suspected provider fraud to the unit;
(2) If the unit determines that it may be useful in carrying out the unit's responsibilities, promptly comply with a request from the unit for—
(i) Access to, and free copies of, any records or information kept by the agency or its contractors;
(ii) Computerized data stored by the agency or its contractors. These data must be supplied without charge and in the form requested by the unit; and
(iii) Access to any information kept by providers to which the agency is authorized access by section 1902(a)(27) of the Act and § 431.107 of this subchapter. In using this information, the unit must protect the privacy rights of beneficiaries; and
(3) On referral from the unit, initiate any available administrative or judicial action to recover improper payments to a provider.
(b) The agency need not comply with specific requirements under this subpart that are the same as the responsibilities placed on the unit under subpart D of this part.
(c) The agency must enter into a written agreement with the unit under which:
(1) The agency will agree to comply with all requirements of § 455.21(a);
(2) The unit will agree to comply with the requirements of § 1007.11(c) of this title; and
(3) The agency and the unit will agree to—
(i) Establish a practice of regular meetings or communication between the two entities;
(ii) Establish procedures for how they will coordinate their efforts;
(iii) Establish procedures for §§ 1007.9(e) through 1007.9(h) of this title;
(iv) Establish procedures by which the unit will receive referrals of potential fraud from managed care organizations, if applicable, either directly or through the agency, as required at § 438.608(a)(7) of this title; and
(v) Review and, as necessary, update the agreement no less frequently than every five (5) years to ensure that the agreement reflects current law and practice.
[43 FR 45262, Sept. 29, 1978, as amended at 84 FR 10713, Mar. 22, 2019]
(a) Basis for suspension.
(1) The State Medicaid agency must suspend all Medicaid payments to a provider after the agency determines there is a credible allegation of fraud for which an investigation is pending under the Medicaid program against an individual or entity unless the agency has good cause to not suspend payments or to suspend payment only in part.
(2) The State Medicaid agency may suspend payments without first notifying the provider of its intention to suspend such payments.
(3) A provider may request, and must be granted, administrative review where State law so requires.
(b) Notice of suspension.
(1) The State agency must send notice of its suspension of program payments within the following timeframes:
(i) Five days of taking such action unless requested in writing by a law enforcement agency to temporarily withhold such notice.
(ii) Thirty days if requested by law enforcement in writing to delay sending such notice, which request for delay may be renewed in writing up to twice and in no event may exceed 90 days.
(2) The notice must include or address all of the following:
(i) State that payments are being suspended in accordance with this provision.
(ii) Set forth the general allegations as to the nature of the suspension action, but need not disclose any specific information concerning an ongoing investigation.
(iii) State that the suspension is for a temporary period, as stated in paragraph (c) of this section, and cite the circumstances under which the suspension will be terminated.
(iv) Specify, when applicable, to which type or types of Medicaid claims or business units of a provider suspension is effective.
(v) Inform the provider of the right to submit written evidence for consideration by State Medicaid Agency.
(vi) Set forth the applicable State administrative appeals process and corresponding citations to State law.
(c) Duration of suspension.
(1) All suspension of payment actions under this section will be temporary and will not continue after either of the following:
(i) The agency or the prosecuting authorities determine that there is insufficient evidence of fraud by the provider.
(ii) Legal proceedings related to the provider's alleged fraud are completed.
(2) A State must document in writing the termination of a suspension including, where applicable and appropriate, any appeal rights available to a provider.
(d) Referrals to the Medicaid fraud control unit.
(1) Whenever a State Medicaid agency investigation leads to the initiation of a payment suspension in whole or part, the State Medicaid Agency must make a fraud referral to either of the following:
(i) To a Medicaid fraud control unit established and certified under part 1007 of this title; or
(ii) In States with no certified Medicaid fraud control unit, to an appropriate law enforcement agency.
(2) The fraud referral made under paragraph (d)(1) of this section must meet all of the following requirements:
(i) Be made in writing and provided to the Medicaid fraud control unit not later than the next business day after the suspension is enacted.
(ii) Conform to fraud referral performance standards issued by the Secretary.
(3)
(i) If the Medicaid fraud control unit or other law enforcement agency accepts the fraud referral for investigation, the payment suspension may be continued until such time as the investigation and any associated enforcement proceedings are completed.
(ii) On a quarterly basis, the State must request a certification from the Medicaid fraud control unit or other law enforcement agency that any matter accepted on the basis of a referral continues to be under investigation thus warranting continuation of the suspension.
(4) If the Medicaid fraud control unit or other law enforcement agency declines to accept the fraud referral for investigation the payment suspension must be discontinued unless the State Medicaid agency has alternative Federal or State authority by which it may impose a suspension or makes a fraud referral to another law enforcement agency. In that situation, the provisions of paragraph (d)(3) of this section apply equally to that referral as well.
(5) A State's decision to exercise the good cause exceptions in paragraphs (e) or (f) of this section not to suspend payments or to suspend payments only in part does not relieve the State of the obligation to refer any credible allegation of fraud as provided in paragraph (d)(1) of this section.
(e) Good cause not to suspend payments. A State may find that good cause exists not to suspend payments, or not to continue a payment suspension previously imposed, to an individual or entity against which there is an investigation of a credible allegation of fraud if any of the following are applicable:
(1) Law enforcement officials have specifically requested that a payment suspension not be imposed because such a payment suspension may compromise or jeopardize an investigation.
(2) Other available remedies implemented by the State more effectively or quickly protect Medicaid funds.
(3) The State determines, based upon the submission of written evidence by the individual or entity that is the subject of the payment suspension, that the suspension should be removed.
(4) beneficiary access to items or services would be jeopardized by a payment suspension because of either of the following:
(i) An individual or entity is the sole community physician or the sole source of essential specialized services in a community.
(ii) The individual or entity serves a large number of beneficiaries within a HRSA-designated medically underserved area.
(5) Law enforcement declines to certify that a matter continues to be under investigation per the requirements of paragraph (d)(3) of this section.
(6) The State determines that payment suspension is not in the best interests of the Medicaid program.
(f) Good cause to suspend payment only in part. A State may find that good cause exists to suspend payments in part, or to convert a payment suspension previously imposed in whole to one only in part, to an individual or entity against which there is an investigation of a credible allegation of fraud if any of the following are applicable:
(1) beneficiary access to items or services would be jeopardized by a payment suspension in whole or part because of either of the following:
(i) An individual or entity is the sole community physician or the sole source of essential specialized services in a community.
(ii) The individual or entity serves a large number of beneficiaries within a HRSA-designated medically underserved area.
(2) The State determines, based upon the submission of written evidence by the individual or entity that is the subject of a whole payment suspension, that such suspension should be imposed only in part.
(3)
(i) The credible allegation focuses solely and definitively on only a specific type of claim or arises from only a specific business unit of a provider; and
(ii) The State determines and documents in writing that a payment suspension in part would effectively ensure that potentially fraudulent claims were not continuing to be paid.
(4) Law enforcement declines to certify that a matter continues to be under investigation per the requirements of paragraph (d)(3) of this section.
(5) The State determines that payment suspension only in part is in the best interests of the Medicaid program.
(g) Documentation and record retention. State Medicaid agencies must meet the following requirements:
(1) Maintain for a minimum of 5 years from the date of issuance all materials documenting the life cycle of a payment suspension that was imposed in whole or part, including the following:
(i) All notices of suspension of payment in whole or part.
(ii) All fraud referrals to the Medicaid fraud control unit or other law enforcement agency.
(iii) All quarterly certifications of continuing investigation status by law enforcement.
(iv) All notices documenting the termination of a suspension.
(2)
(i) Maintain for a minimum of 5 years from the date of issuance all materials documenting each instance where a payment suspension was not imposed, imposed only in part, or discontinued for good cause.
(ii) This type of documentation must include, at a minimum, detailed information on the basis for the existence of the good cause not to suspend payments, to suspend payments only in part, or to discontinue a payment suspension and, where applicable, must specify how long the State anticipates such good cause will exist.
(3) Annually report to the Secretary summary information on each of following:
(i) Suspension of payment, including the nature of the suspected fraud, the basis for suspension, and the outcome of the suspension.
(ii) Situation in which the State determined good cause existed to not suspend payments, to suspend payments only in part, or to discontinue a payment suspension as described in this section, including describing the nature of the suspected fraud and the nature of the good cause.
[76 FR 5966, Feb. 2, 2011]
44 FR 41644, July 17, 1979, unless otherwise noted.
This subpart implements sections 1124, 1126, 1902(a)(38), 1903(i)(2), and 1903(n) of the Social Security Act. It sets forth State plan requirements regarding—
(a) Disclosure by providers and fiscal agents of ownership and control information; and
(b) Disclosure of information on a provider's owners and other persons convicted of criminal offenses against Medicare, Medicaid, or the title XX services program.
The subpart also specifies conditions under which the Administrator will deny Federal financial participation for services furnished by providers or fiscal agents who fail to comply with the disclosure requirements.
Affiliation means, for purposes of applying § 455.107, any of the following:
(1) A 5 percent or greater direct or indirect ownership interest that an individual or entity has in another organization.
(2) A general or limited partnership interest (regardless of the percentage) that an individual or entity has in another organization.
(3) An interest in which an individual or entity exercises operational or managerial control over, or directly or indirectly conducts, the day-to-day operations of another organization (including, for purposes of this paragraph (3), sole proprietorships), either under contract or through some other arrangement, regardless of whether or not the managing individual or entity is a W-2 employee of the organization.
(4) An interest in which an individual is acting as an officer or director of a corporation.
(5) Any payment assignment relationship under § 447.10(g) of this chapter.
Agent means any person who has been delegated the authority to obligate or act on behalf of a provider.
Disclosable event means, for purposes of § 455.107, any of the following:
(1) Currently has an uncollected debt to Medicare, Medicaid, or CHIP, regardless of—
(i) The amount of the debt;
(ii) Whether the debt is currently being repaid (for example, as part of a repayment plan); or
(iii) Whether the debt is currently being appealed;
(2) Has been or is subject to a payment suspension under a federal health care program (as that latter term is defined in section 1128B(f) of the Act), regardless of when the payment suspension occurred or was imposed;
(3) Has been or is excluded by the OIG from participation in Medicare, Medicaid, or CHIP, regardless of whether the exclusion is currently being appealed or when the exclusion occurred or was imposed; or
(4) Has had its Medicare, Medicaid, or CHIP enrollment denied, revoked or terminated, regardless of—
(i) The reason for the denial, revocation, or termination;
(ii) Whether the denial, revocation, or termination is currently being appealed; or
(iii) When the denial, revocation, or termination occurred or was imposed.
Disclosing entity means a Medicaid provider (other than an individual practitioner or group of practitioners), or a fiscal agent.
Other disclosing entity means any other Medicaid disclosing entity and any entity that does not participate in Medicaid, but is required to disclose certain ownership and control information because of participation in any of the programs established under title V, XVIII, or XX of the Act. This includes:
(a) Any hospital, skilled nursing facility, home health agency, independent clinical laboratory, renal disease facility, rural health clinic, or health maintenance organization that participates in Medicare (title XVIII);
(b) Any Medicare intermediary or carrier; and
(c) Any entity (other than an individual practitioner or group of practitioners) that furnishes, or arranges for the furnishing of, health-related services for which it claims payment under any plan or program established under title V or title XX of the Act.
Fiscal agent means a contractor that processes or pays vendor claims on behalf of the Medicaid agency.
Group of practitioners means two or more health care practitioners who practice their profession at a common location (whether or not they share common facilities, common supporting staff, or common equipment).
Health insuring organization (HIO) has the meaning specified in § 438.2.
Indirect ownership interest means an ownership interest in an entity that has an ownership interest in the disclosing entity. This term includes an ownership interest in any entity that has an indirect ownership interest in the disclosing entity.
Managed care entity (MCE) means managed care organizations (MCOs), PIHPs, PAHPs, PCCMs, and HIOs.
Managing employee means a general manager, business manager, administrator, director, or other individual who exercises operational or managerial control over, or who directly or indirectly conducts the day-to-day operation of an institution, organization, or agency.
Ownership interest means the possession of equity in the capital, the stock, or the profits of the disclosing entity.
Person with an ownership or control interest means a person or corporation that—
(a) Has an ownership interest totaling 5 percent or more in a disclosing entity;
(b) Has an indirect ownership interest equal to 5 percent or more in a disclosing entity;
(c) Has a combination of direct and indirect ownership interests equal to 5 percent or more in a disclosing entity;
(d) Owns an interest of 5 percent or more in any mortgage, deed of trust, note, or other obligation secured by the disclosing entity if that interest equals at least 5 percent of the value of the property or assets of the disclosing entity;
(e) Is an officer or director of a disclosing entity that is organized as a corporation; or
(f) Is a partner in a disclosing entity that is organized as a partnership.
Prepaid ambulatory health plan (PAHP) has the meaning specified in § 438.2.
Prepaid inpatient health plan (PIHP) has the meaning specified in § 438.2.
Primary care case manager (PCCM) has the meaning specified in § 438.2.
Significant business transaction means any business transaction or series of transactions that, during any one fiscal year, exceed the lesser of $25,000 and 5 percent of a provider's total operating expenses.
Subcontractor means—
(a) An individual, agency, or organization to which a disclosing entity has contracted or delegated some of its management functions or responsibilities of providing medical care to its patients; or
(b) An individual, agency, or organization with which a fiscal agent has entered into a contract, agreement, purchase order, or lease (or leases of real property) to obtain space, supplies, equipment, or services provided under the Medicaid agreement.
Supplier means an individual, agency, or organization from which a provider purchases goods and services used in carrying out its responsibilities under Medicaid (e.g., a commercial laundry, a manufacturer of hospital beds, or a pharmaceutical firm).
Termination means—
(1) For a—
(i) Medicaid or CHIP provider, a State Medicaid program or CHIP has taken an action to revoke the provider's billing privileges, and the provider has exhausted all applicable appeal rights or the timeline for appeal has expired; and
(ii) Medicare provider, supplier or eligible professional, the Medicare program has revoked the provider or supplier's billing privileges, and the provider has exhausted all applicable appeal rights or the timeline for appeal has expired.
(2)
(i) In all three programs, there is no expectation on the part of the provider or supplier or the State or Medicare program that the revocation is temporary.
(ii) The provider, supplier, or eligible professional will be required to reenroll with the applicable program if they wish billing privileges to be reinstated.
(3) The requirement for termination applies in cases where providers, suppliers, or eligible professionals were terminated or had their billing privileges revoked for cause which may include, but is not limited to—
(i) Fraud;
(ii) Integrity; or
(iii) Quality.
Wholly owned supplier means a supplier whose total ownership interest is held by a provider or by a person, persons, or other entity with an ownership or control interest in a provider.
[44 FR 41644, July 17, 1979, as amended at 51 FR 34788, Sept. 30, 1986; 76 FR 5967, Feb. 2, 2011; 84 FR 47856, Sept. 10, 2019]
(a) Indirect ownership interest. The amount of indirect ownership interest is determined by multiplying the percentages of ownership in each entity. For example, if A owns 10 percent of the stock in a corporation which owns 80 percent of the stock of the disclosing entity, A's interest equates to an 8 percent indirect ownership interest in the disclosing entity and must be reported. Conversely, if B owns 80 percent of the stock of a corporation which owns 5 percent of the stock of the disclosing entity, B's interest equates to a 4 percent indirect ownership interest in the disclosing entity and need not be reported.
(b) Person with an ownership or control interest. In order to determine percentage of ownership, mortgage, deed of trust, note, or other obligation, the percentage of interest owned in the obligation is multiplied by the percentage of the disclosing entity's assets used to secure the obligation. For example, if A owns 10 percent of a note secured by 60 percent of the provider's assets, A's interest in the provider's assets equates to 6 percent and must be reported. Conversely, if B owns 40 percent of a note secured by 10 percent of the provider's assets, B's interest in the provider's assets equates to 4 percent and need not be reported.
A State plan must provide that the requirements of §§ 455.104 through 455.107 are met.
[84 FR 47856, Sept. 10, 2019]
(a) Who must provide disclosures. The Medicaid agency must obtain disclosures from disclosing entities, fiscal agents, and managed care entities.
(b) What disclosures must be provided. The Medicaid agency must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures:
(1)
(i) The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address.
(ii) Date of birth and Social Security Number (in the case of an individual).
(iii) Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest.
(2) Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling.
(3) The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest.
(4) The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity).
(c) When the disclosures must be provided —
(1) Disclosures from providers or disclosing entities. Disclosure from any provider or disclosing entity is due at any of the following times:
(i) Upon the provider or disclosing entity submitting the provider application.
(ii) Upon the provider or disclosing entity executing the provider agreement.
(iii) Upon request of the Medicaid agency during the re-validation of enrollment process under § 455.414.
(iv) Within 35 days after any change in ownership of the disclosing entity.
(2) Disclosures from fiscal agents. Disclosures from fiscal agents are due at any of the following times:
(i) Upon the fiscal agent submitting the proposal in accordance with the State's procurement process.
(ii) Upon the fiscal agent executing the contract with the State.
(iii) Upon renewal or extension of the contract.
(iv) Within 35 days after any change in ownership of the fiscal agent.
(3) Disclosures from managed care entities. Disclosures from managed care entities (MCOs, PIHPs, PAHPs, and HIOs), except PCCMs are due at any of the following times:
(i) Upon the managed care entity submitting the proposal in accordance with the State's procurement process.
(ii) Upon the managed care entity executing the contract with the State.
(iii) Upon renewal or extension of the contract.
(iv) Within 35 days after any change in ownership of the managed care entity.
(4) Disclosures from PCCMs. PCCMs will comply with disclosure requirements under paragraph (c)(1) of this section.
(d) To whom must the disclosures be provided. All disclosures must be provided to the Medicaid agency.
(e) Consequences for failure to provide required disclosures. Federal financial participation (FFP) is not available in payments made to a disclosing entity that fails to disclose ownership or control information as required by this section.
[76 FR 5967, Feb. 2, 2011]
(a) Provider agreements. A Medicaid agency must enter into an agreement with each provider under which the provider agrees to furnish to it or to the Secretary on request, information related to business transactions in accordance with paragraph (b) of this section.
(b) Information that must be submitted. A provider must submit, within 35 days of the date on a request by the Secretary or the Medicaid agency, full and complete information about—
(1) The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and
(2) Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request.
(c) Denial of Federal financial participation (FFP).
(1) FFP is not available in expenditures for services furnished by providers who fail to comply with a request made by the Secretary or the Medicaid agency under paragraph (b) of this section or under § 420.205 of this chapter (Medicare requirements for disclosure).
(2) FFP will be denied in expenditures for services furnished during the period beginning on the day following the date the information was due to the Secretary or the Medicaid agency and ending on the day before the date on which the information was supplied.
(a) Information that must be disclosed. Before the Medicaid agency enters into or renews a provider agreement, or at any time upon written request by the Medicaid agency, the provider must disclose to the Medicaid agency the identity of any person who:
(1) Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and
(2) Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs.
(b) Notification to Inspector General.
(1) The Medicaid agency must notify the Inspector General of the Department of any disclosures made under paragraph (a) of this section within 20 working days from the date it receives the information.
(2) The agency must also promptly notify the Inspector General of the Department of any action it takes on the provider's application for participation in the program.
(c) Denial or termination of provider participation.
(1) The Medicaid agency may refuse to enter into or renew an agreement with a provider if any person who has an ownership or control interest in the provider, or who is an agent or managing employee of the provider, has been convicted of a criminal offense related to that person's involvement in any program established under Medicare, Medicaid or the title XX Services Program.
(2) The Medicaid agency may refuse to enter into or may terminate a provider agreement if it determines that the provider did not fully and accurately make any disclosure required under paragraph (a) of this section.
(a) Definitions. For purposes of this section only, the following terms apply to the definition of disclosable event in § 455.101:
(1) “Uncollected debt” only applies to the following:
(i) Medicare, Medicaid, or CHIP overpayments for which CMS or the State has sent notice of the debt to the affiliated provider or supplier.
(ii) Civil money penalties imposed under this title.
(iii) Assessments imposed under this title.
(2) “Revoked,” “Revocation,” “Terminated,” and “Termination” include situations where the affiliated provider or supplier voluntarily terminated its Medicare, Medicaid, or CHIP enrollment to avoid a potential revocation or termination.
(b) General.
(1)
(i) Selection of option. A State, in consultation with CMS, must select one of the two options identified in paragraph (b)(2) of this section for requiring the disclosure of affiliation information.
(ii) Change of selection. A State may not change its selection under paragraph (b) of this section after it has been made.
(2)
(i) First option. In a State that has selected the option in this paragraph (b)(2)(i), a provider that is not enrolled in Medicare but is initially enrolling in Medicaid or CHIP (or is revalidating its Medicaid or CHIP enrollment information) must disclose any and all affiliations that it or any of its owning or managing employees or organizations (consistent with the terms “person with an ownership or control interest” and “managing employee” as defined in § 455.101) has or, within the previous 5 years, had with a currently or formerly enrolled Medicare, Medicaid, or CHIP provider or supplier that has a disclosable event (as defined in § 455.101).
(ii) Second option. In a State that has selected the option in this paragraph (b)(2)(ii), and upon request by the State, a provider that is not enrolled in Medicare but is initially enrolling in Medicaid or CHIP (or is revalidating its Medicaid or CHIP enrollment information) must disclose any and all affiliations that it or any of its owning or managing employees or organizations (consistent with the terms “person with an ownership or control interest” and “managing employee” as defined in § 455.101) has or, within the previous 5 years, had with a currently or formerly enrolled Medicare, Medicaid, or CHIP provider or supplier that has a disclosable event (as defined in § 455.101). The State will request such disclosures when it, in consultation with CMS, has determined that the initially enrolling or revalidating provider may have at least one such affiliation.
(c) Information. The initially enrolling or revalidating provider must disclose the following information about each affiliation:
(1) General identifying information about the affiliated provider or supplier, which includes the following:
(i) Legal name as reported to the Internal Revenue Service or the Social Security Administration (if the affiliated provider or supplier is an individual).
(ii) “Doing business as” name (if applicable).
(iii) Tax identification number.
(iv) National Provider Identifier (NPI).
(2) Reason for disclosing the affiliated provider or supplier.
(3) Specific data regarding the affiliation relationship, including the following:
(i) Length of the relationship.
(ii) Type of relationship.
(iii) Degree of affiliation.
(4) If the affiliation has ended, the reason for the termination.
(d) Mechanism. The information described in paragraphs (b) and (c) of this section must be furnished to the State in a manner prescribed by the State in consultation with the Secretary.
(e) Denial or termination. The failure of the provider to fully and completely report the information required in this section when the provider knew or should reasonably have known of this information may result in, as applicable, the denial of the provider's initial enrollment application or the termination of the provider's enrollment in Medicaid or CHIP.
(f) Undue risk. Upon receipt of the information described in paragraphs (b) and (c) of this section, the State, in consultation with CMS, determines whether any of the disclosed affiliations poses an undue risk of fraud, waste, or abuse by considering the following factors:
(1) The duration of the affiliation.
(2) Whether the affiliation still exists and, if not, how long ago the affiliation ended.
(3) The degree and extent of the affiliation.
(4) If applicable, the reason for the termination of the affiliation.
(5) Regarding the affiliated provider's or supplier's disclosable event under paragraph (b) of this section, all of the following:
(i) The type of disclosable event.
(ii) When the disclosable event occurred or was imposed.
(iii) Whether the affiliation existed when the disclosable event occurred or was imposed.
(iv) If the disclosable event is an uncollected debt -
(A) The amount of the debt;
(B) Whether the affiliated provider or supplier is repaying the debt; and
(C) To whom the debt is owed.
(v) If a denial, revocation, termination, exclusion, or payment suspension is involved, the reason for the disclosable event.
(6) Any other evidence that the State, in consultation with CMS, deems relevant to its determination.
(g) Determination of undue risk. A determination by the State, in consultation with CMS, that a particular affiliation poses an undue risk of fraud, waste, or abuse will result in, as applicable, the denial of the provider's initial enrollment in Medicaid or CHIP or the termination of the provider's enrollment in Medicaid or CHIP.
(h) Undisclosed affiliations. The State, in consultation with CMS, may apply paragraph (g) of this section to situations where a reportable affiliation (as described in paragraphs (b) and (c) of this section) poses an undue risk of fraud, waste, or abuse, but the provider has not yet disclosed or is not required at that time to disclose the affiliation to the State.
[84 FR 47856, Sept. 10, 2019]
72 FR 67655, Nov. 30, 2007, unless otherwise noted.
(a) Statutory basis. This subpart implements section 1936 of the Social Security Act that establishes the Medicaid Integrity Program, under which the Secretary will promote the integrity of the program by entering into contracts with eligible entities to carry out the activities under this subpart C.
(b) Scope. This subpart provides for the limitation on a contractor's liability to carry out a contract under the Medicaid Integrity Program and to carry out the Medicaid integrity audit program functions.
[73 FR 55771, Sept. 26, 2008]
(a) A program contractor, a person, or an entity employed by, or having a fiduciary relationship with, or who furnishes professional services to a program contractor will not be held to have violated any criminal law and will not be held liable in any civil action, under any law of the United States or of any State (or political subdivision thereof), by reason of the performance of any duty, function, or activity required or authorized under this subpart or under a valid contract entered into under this subpart, provided due care was exercised in that performance and the contractor has a contract with CMS under this subpart.
(b) CMS pays a contractor, a person, or an entity described in paragraph (a) of this section, or anyone who furnishes legal counsel or services to a contractor or person, a sum equal to the reasonable amount of the expenses, as determined by CMS, incurred in connection with the defense of a suit, action, or proceeding, if the following conditions are met:
(1) The suit, action, or proceeding was brought against the contractor, person or entity by a third party and relates to the contractor's, person's or entity's performance of any duty, function, or activity under a contract entered into with CMS under this subpart.
(2) The funds are available.
(3) The expenses are otherwise allowable under the terms of the contract.
CMS may enter into a contract with an entity to perform the activities described at § 455.232, if it meets the following conditions:
(a) The entity has demonstrated capability to carry out the activities described below.
(b) In carrying out such activities, the entity agrees to cooperate with the Inspector General of the Department of Health and Human Services, the Attorney General, and other law enforcement agencies, as appropriate, in the investigation and deterrence of fraud and abuse in relation to Title XIX of the Social Security Act and in other cases arising out of such activities.
(c) Maintains an appropriate written code of conduct and compliance policies that include, without limitation, an enforced policy on employee conflicts of interest.
(d) The entity complies with such conflict of interest standards as are generally applicable to Federal acquisition and procurement.
(e) The entity meets such other requirements the Secretary may impose.
[73 FR 55771, Sept. 26, 2008]
The contract between CMS and a Medicaid integrity audit program contractor specifies the functions the contractor will perform. The contract may include any or all of the following functions:
(a) Review of the actions of individuals or entities furnishing items or services (whether on a fee-for-service, risk, or other basis) for which payment may be made under a State Plan approved under title XIX of the Act (or under any waiver of such plan approved under section 1115 of the Act) to determine whether fraud, waste, or abuse has occurred, is likely to occur, or whether such actions have the potential for resulting in an expenditure of funds under title XIX in a manner which is not intended under the provisions of title XIX.
(b) Auditing of claims for payment for items or services furnished, or administrative services rendered, under a State Plan under title XIX to ensure proper payments were made. This includes: cost reports, consulting contracts, and risk contracts under section 1903(m) of the Act.
(c) Identifying if overpayments have been made to individuals or entities receiving Federal funds under title XIX.
(d) Educating providers of service, managed care entities, beneficiaries, and other individuals with respect to payment integrity and quality of care.
[73 FR 55771, Sept. 26, 2008]
(a) CMS awards and administers Medicaid integrity audit program contracts in accordance with acquisition regulations set forth at 48 CFR chapters 1 and 3, this subpart, and all other applicable laws and regulations. These competitive procedures and requirements for awarding Medicaid integrity audit program contracts are to be used as follows:
(1) When entering into new contracts under this section.
(2) At any other time considered appropriate by the Secretary.
(b) An entity is eligible to be awarded a Medicaid integrity audit program contract only if meets the eligibility requirements established in § 455.202, 48 CFR chapter 3, and all other applicable laws and requirements.
[73 FR 55771, Sept. 26, 2008]
(a) CMS specifies the initial contract term in the Medicaid integrity audit program contract. CMS may, but is not required to, renew a Medicaid integrity audit program contract without regard to any provision of law requiring competition if the contractor has met or exceeded the performance requirements established in the current contract.
(b) CMS may renew a Medicaid integrity audit program contract without competition if all of the following conditions are met:
(1) The Medicaid integrity audit program contractor continues to meet the requirements established in this subpart.
(2) The Medicaid integrity audit program contractor meets or exceeds the performance requirements established in its current contract.
(3) It is in the best interest of the government.
(c) If CMS does not renew a contract, the contract will end in accordance with its terms. The contractor will not have a right to a hearing or judicial review regarding CMS's renewal or non-renewal decision.
[73 FR 55771, Sept. 26, 2008]
(a) Offerors for Medicaid integrity audit program contracts, and Medicaid integrity audit program contractors, are subject to the following requirements:
(1) The conflict of interest standards and requirements of the Federal Acquisition Regulation organizational conflict of interest guidance, found under 48 CFR subpart 9.5.
(2) The standards and requirements that are contained in each individual contract awarded to perform activities described under section 1936 of the Act.
(b) Post-award conflicts of interest: CMS considers that a post-award conflict of interest has developed if, during the term of the contract, one of the following occurs:
(1) The contractor or any of its employees, agents, or subcontractors received, solicited, or arranged to receive any fee, compensation, gift (defined at 5 CFR 2635.203(b)), payment of expenses, offer of employment, or any other thing of value from any entity that is reviewed, audited, investigated, or contacted during the normal course of performing activities under the Medicaid integrity audit program contract.
(2) CMS determines that the contractor's activities are creating a conflict of interest.
(c) If CMS determines that a conflict of interest exists during the term of the contract, among other actions, CMS may:
(1) Not renew the contract for an additional term.
(2) Modify the contract.
(3) Terminate the contract.
[73 FR 55771, Sept. 26, 2008]
(a) Review Board: CMS may establish a Conflicts of Interest Review Board to assist in resolving organizational conflicts of interest.
(b) Resolution: Resolution of an organizational conflict of interest is a determination by the contracting officer that:
(1) The conflict is mitigated.
(2) The conflict precludes award of a contract to the offeror.
(3) The conflict requires that CMS modify an existing contract.
(4) The conflict requires that CMS terminate an existing contract.
(5) It is in the best interest of the government to contract with the offeror or contractor even though the conflict of interest exists and a request for waiver is approved in accordance with 48 CFR 9.503.
[73 FR 55771, Sept. 26, 2008]
73 FR 77951, Dec. 19, 2008, unless otherwise noted.
This subpart implements Section 1923(j)(2) of the Act.
For the purposes of this subpart—
Independent certified audit means an audit that is conducted by an auditor that operates independently from the Medicaid agency or subject hospitals and is eligible to perform the DSH audit. Certification means that the independent auditor engaged by the State reviews the criteria of the Federal audit regulation and completes the verification, calculations and report under the professional rules and generally accepted standards of audit practice. This certification would include a review of the State's audit protocol to ensure that the Federal regulation is satisfied, an opinion for each verification detailed in the regulation, and a determination of whether or not the State made DSH payments that exceeded any hospital's specific DSH limit in the Medicaid State plan rate year under audit. The certification should also identify any data issues or other caveats that the auditor identified as impacting the results of the audit.
Medicaid State Plan Rate Year means the 12-month period defined by a State's approved Medicaid State plan in which the State estimates eligible uncompensated care costs and determines corresponding disproportionate share hospital payments as well as all other Medicaid payment rates. The period usually corresponds with the State's fiscal year or the Federal fiscal year but can correspond to any 12-month period defined by the State as the Medicaid State plan rate year.
(a) General rule.
(1) The State must submit an independent certified audit to CMS for each completed Medicaid State plan rate year, consistent with the requirements in this subpart, to receive Federal payments under Section 1903(a)(1) of the Act based on State expenditures for disproportionate share hospital (DSH) payments for Medicaid State plan rate years subsequent to the date the audit is due, except as provided in paragraph (e) of this section.
(2) FFP is not available in expenditures for DSH payments that are found in the independent certified audit to exceed the hospital-specific eligible uncompensated care cost limit, except as provided in paragraph (e) of this section.
(b) Timing. For Medicaid State plan rate years 2005 and 2006, a State must submit to CMS an independent certified audit report no later than the last day of calendar year 2009. Each subsequent audit beginning with Medicaid State plan rate year 2007 must be completed by the last day of the Federal fiscal year ending three years from the end of the Medicaid State plan rate year under audit. Completed audit reports must be submitted to CMS no later than 90 days after completion. Post-audit adjustments based on claims for the Medicaid State plan rate year paid subsequent to the audit date, if any, must be submitted in the quarter the claim was paid.
(c) Documentation. In order to complete the independent certified audit, States must use the following data sources:
(1) Approved Medicaid State plan for the Medicaid State plan rate year under audit.
(2) Payment and utilization information from the State's Medicaid Management Information System.
(3) The Medicare 2552-96 hospital cost report(s) applicable to the Medicaid State plan rate year under audit. If the Medicare 2552-96 is superseded by an alternate Medicare developed cost reporting tool during an audit year, that tool must be used for the Medicaid State plan rate year under audit.
(4) Audited hospital financial statements and hospital accounting records.
(d) Specific requirements. The independent certified audit report must verify the following:
(1) Verification 1: Each hospital that qualifies for a DSH payment in the State is allowed to retain that payment so that the payment is available to offset its uncompensated care costs for furnishing inpatient hospital and outpatient hospital services during the Medicaid State plan rate year to Medicaid eligible individuals and individuals with no source of third party coverage for the services in order to reflect the total amount of claimed DSH expenditures.
(2) Verification 2: DSH payments made to each qualifying hospital comply with the hospital-specific DSH payment limit. For each audited Medicaid State plan rate year, the DSH payments made in that audited Medicaid State plan rate year must be measured against the actual uncompensated care cost in that same audited Medicaid State plan rate year.
(3) Verification 3: Only uncompensated care costs of furnishing inpatient and outpatient hospital services to Medicaid eligible individuals and individuals with no third party coverage for the inpatient and outpatient hospital services they received as described in Section 1923(g)(1)(A) of the Act are eligible for inclusion in the calculation of the hospital-specific disproportionate share limit payment limit, as described in Section 1923(g)(1)(A) of the Act.
(4) Verification 4: For purposes of this hospital-specific limit calculation, any Medicaid payments (including regular Medicaid fee-for-service rate payments, supplemental/enhanced Medicaid payments, and Medicaid managed care organization payments) made to a disproportionate share hospital for furnishing inpatient hospital and outpatient hospital services to Medicaid eligible individuals, which are in excess of the Medicaid incurred costs of such services, are applied against the uncompensated care costs of furnishing inpatient hospital and outpatient hospital services to individuals with no source of third party coverage for such services.
(5) Verification 5: Any information and records of all of its inpatient and outpatient hospital service costs under the Medicaid program; claimed expenditures under the Medicaid program; uninsured inpatient and outpatient hospital service costs in determining payment adjustments under this Section; and any payments made on behalf of the uninsured from payment adjustments under this Section has been separately documented and retained by the State.
(6) Verification 6: The information specified in paragraph (d)(5) of this Section includes a description of the methodology for calculating each hospital's payment limit under Section 1923(g)(1) of the Act. Included in the description of the methodology, the audit report must specify how the State defines incurred inpatient hospital and outpatient hospital costs for furnishing inpatient hospital and outpatient hospital services to Medicaid eligible individuals and individuals with no source of third party coverage for the inpatient hospital and outpatient hospital services they received.
(e) Transition Provisions: To ensure a period for developing and refining reporting and auditing techniques, findings of State reports and audits for Medicaid State Plan years 2005-2010 will not be given weight except to the extent that the findings draw into question the reasonableness of State uncompensated care cost estimates used for calculations of prospective DSH payments for Medicaid State plan year 2011 and thereafter.
76 FR 5968, Feb. 2, 2011, unless otherwise noted.
This subpart implements sections 1866(j), 1902(a)(39), 1902(a)(77), and 1902(a)(78) of the Act. It sets forth State plan requirements regarding the following:
(a) Provider screening and enrollment requirements.
(b) Fees associated with provider screening.
(c) Temporary moratoria on enrollment of providers.
A State plan must provide that the requirements of § 455.410 through § 455.450 and § 455.470 are met.
(a) The State Medicaid agency must require all enrolled providers to be screened under to this subpart.
(b) The State Medicaid agency must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers.
(c) The State Medicaid agency may rely on the results of the provider screening performed by any of the following:
(1) Medicare contractors.
(2) Medicaid agencies or Children's Health Insurance Programs of other States.
The State Medicaid agency must—
(a) Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State.
(b) Confirm that the provider's license has not expired and that there are no current limitations on the provider's license.
The State Medicaid agency must revalidate the enrollment of all providers regardless of provider type at least every 5 years.
The State Medicaid agency—
(a) Must terminate the enrollment of any provider where any person with a 5 percent or greater direct or indirect ownership interest in the provider did not submit timely and accurate information and cooperate with any screening methods required under this subpart.
(b) Must deny enrollment or terminate the enrollment of any provider where any person with a 5 percent or greater direct or indirect ownership interest in the provider has been convicted of a criminal offense related to that person's involvement with the Medicare, Medicaid, or title XXI program in the last 10 years, unless the State Medicaid agency determines that denial or termination of enrollment is not in the best interests of the Medicaid program and the State Medicaid agency documents that determination in writing.
(c) Must deny enrollment or terminate the enrollment of any provider that is terminated on or after January 1, 2011, under title XVIII of the Act or under the Medicaid program or CHIP of any other State.
(d) Must terminate the provider's enrollment or deny enrollment of the provider if the provider or a person with an ownership or control interest or who is an agent or managing employee of the provider fails to submit timely or accurate information, unless the State Medicaid agency determines that termination or denial of enrollment is not in the best interests of the Medicaid program and the State Medicaid agency documents that determination in writing.
(e) Must terminate or deny enrollment if the provider, or any person with a 5 percent or greater direct or indirect ownership interest in the provider, fails to submit sets of fingerprints in a form and manner to be determined by the Medicaid agency within 30 days of a CMS or a State Medicaid agency request, unless the State Medicaid agency determines that termination or denial of enrollment is not in the best interests of the Medicaid program and the State Medicaid agency documents that determination in writing.
(f) Must terminate or deny enrollment if the provider fails to permit access to provider locations for any site visits under § 455.432, unless the State Medicaid agency determines that termination or denial of enrollment is not in the best interests of the Medicaid program and the State Medicaid agency documents that determination in writing.
(g) May terminate or deny the provider's enrollment if CMS or the State Medicaid agency—
(1) Determines that the provider has falsified any information provided on the application; or
(2) Cannot verify the identity of any provider applicant.
After deactivation of a provider enrollment number for any reason, before the provider's enrollment may be reactivated, the State Medicaid agency must re-screen the provider and require payment of associated provider application fees under § 455.460.
The State Medicaid agency must give providers terminated or denied under § 455.416 any appeal rights available under procedures established by State law or regulations.
The State Medicaid agency—
(a) Must conduct pre-enrollment and post-enrollment site visits of providers who are designated as “moderate” or “high” categorical risks to the Medicaid program. The purpose of the site visit will be to verify that the information submitted to the State Medicaid agency is accurate and to determine compliance with Federal and State enrollment requirements.
(b) Must require any enrolled provider to permit CMS, its agents, its designated contractors, or the State Medicaid agency to conduct unannounced on-site inspections of any and all provider locations.
The State Medicaid agency—
(a) As a condition of enrollment, must require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.
(b) Must establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program.
(1) Upon the State Medicaid agency determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets the State Medicaid agency's criteria hereunder for criminal background checks as a “high” risk to the Medicaid program, the State Medicaid agency will require that each such provider or person submit fingerprints.
(2) The State Medicaid agency must require a provider, or any person with a 5 percent or more direct or indirect ownership interest in the provider, to submit a set of fingerprints, in a form and manner to be determined by the State Medicaid agency, within 30 days upon request from CMS or the State Medicaid agency.
The State Medicaid agency must do all of the following:
(a) Confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases.
(b) Check the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe.
(c)
(1) Consult appropriate databases to confirm identity upon enrollment and reenrollment; and
(2) Check the LEIE and EPLS no less frequently than monthly.
The State Medicaid agency must require all claims for payment for items and services that were ordered or referred to contain the National Provider Identifier (NPI) of the physician or other professional who ordered or referred such items or services.
A State Medicaid agency must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.” If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable.
(a) Screening for providers designated as limited categorical risk. When the State Medicaid agency designates a provider as a limited categorical risk, the State Medicaid agency must do all of the following:
(1) Verify that a provider meets any applicable Federal regulations, or State requirements for the provider type prior to making an enrollment determination.
(2) Conduct license verifications, including State licensure verifications in States other than where the provider is enrolling, in accordance with § 455.412.
(3) Conduct database checks on a pre- and post-enrollment basis to ensure that providers continue to meet the enrollment criteria for their provider type, in accordance with § 455.436.
(b) Screening for providers designated as moderate categorical risk. When the State Medicaid agency designates a provider as a “moderate” categorical risk, a State Medicaid agency must do both of the following:
(1) Perform the “limited” screening requirements described in paragraph (a) of this section.
(2) Conduct on-site visits in accordance with § 455.432.
(c) Screening for providers designated as high categorical risk. When the State Medicaid agency designates a provider as a “high” categorical risk, a State Medicaid agency must do both of the following:
(1) Perform the “limited” and “moderate” screening requirements described in paragraphs (a) and (b) of this section.
(2)
(i) Conduct a criminal background check; and
(ii) Require the submission of a set of fingerprints in accordance with § 455.434.
(d) Denial or termination of enrollment. A provider, or any person with 5 percent or greater direct or indirect ownership in the provider, who is required by the State Medicaid agency or CMS to submit a set of fingerprints and fails to do so may have its—
(1) Application denied under § 455.434; or
(2) Enrollment terminated under § 455.416.
(e) Adjustment of risk level. The State agency must adjust the categorical risk level from “limited” or “moderate” to “high” when any of the following occurs:
(1) The State Medicaid agency imposes a payment suspension on a provider based on credible allegation of fraud, waste or abuse, the provider has an existing Medicaid overpayment, or the provider has been excluded by the OIG or another State's Medicaid program within the previous 10 years.
(2) The State Medicaid agency or CMS in the previous 6 months lifted a temporary moratorium for the particular provider type and a provider that was prevented from enrolling based on the moratorium applies for enrollment as a provider at any time within 6 months from the date the moratorium was lifted.
Nothing in this subpart must restrict the State Medicaid agency from establishing provider screening methods in addition to or more stringent than those required by this subpart.
(a) Beginning on or after March 25, 2011, States must collect the applicable application fee prior to executing a provider agreement from a prospective or re-enrolling provider other than either of the following:
(1) Individual physicians or nonphysician practitioners.
(2)
(i) Providers who are enrolled in either of the following:
(A) Title XVIII of the Act.
(B) Another State's title XIX or XXI plan.
(ii) Providers that have paid the applicable application fee to—
(A) A Medicare contractor; or
(B) Another State.
(b) If the fees collected by a State agency in accordance with paragraph (a) of this section exceed the cost of the screening program, the State agency must return that portion of the fees to the Federal government.
(a)
(1) The Secretary consults with any affected State Medicaid agency regarding imposition of temporary moratoria on enrollment of new providers or provider types prior to imposition of the moratoria, in accordance with § 424.570 of this chapter.
(2) The State Medicaid agency will impose temporary moratoria on enrollment of new providers or provider types identified by the Secretary as posing an increased risk to the Medicaid program.
(3)
(i) The State Medicaid agency is not required to impose such a moratorium if the State Medicaid agency determines that imposition of a temporary moratorium would adversely affect beneficiaries' access to medical assistance.
(ii) If a State Medicaid agency makes such a determination, the State Medicaid agency must notify the Secretary in writing.
(b)
(1) A State Medicaid agency may impose temporary moratoria on enrollment of new providers, or impose numerical caps or other limits that the State Medicaid agency identifies as having a significant potential for fraud, waste, or abuse and that the Secretary has identified as being at high risk for fraud, waste, or abuse.
(2) Before implementing the moratoria, caps, or other limits, the State Medicaid agency must determine that its action would not adversely impact beneficiaries' access to medical assistance.
(3) The State Medicaid agency must notify the Secretary in writing in the event the State Medicaid agency seeks to impose such moratoria, including all details of the moratoria; and obtain the Secretary's concurrence with imposition of the moratoria.
(c)
(1) The State Medicaid agency must impose the moratorium for an initial period of 6 months.
(2) If the State Medicaid agency determines that it is necessary, the State Medicaid agency may extend the moratorium in 6-month increments.
(3) Each time, the State Medicaid agency must document in writing the necessity for extending the moratorium.
76 FR 57843, Sept. 16, 2011, unless otherwise noted.
This subpart implements section 1902(a)(42)(B) of the Act that establishes the Medicaid Recovery Audit Contractor (RAC) program.
(a) The Medicaid Recovery Audit Contractor program (Medicaid RAC program) is established as a measure for States to promote the integrity of the Medicaid program.
(b) States must enter into contracts, consistent with State law and in accordance with this section, with one or more eligible Medicaid RACs to carry out the activities described in § 455.506 of this subpart.
(c) States must comply with reporting requirements describing the effectiveness of their Medicaid RAC programs as specified by CMS.
As used in this subpart—
Medicaid RAC program means a recovery audit contractor program administered by a State to identify overpayments and underpayments and recoup overpayments.
Medicare RAC program means a recovery audit contractor program administered by CMS to identify underpayments and overpayments and recoup overpayments, established under the authority of section 1893(h) of the Act.
(a) Medicaid RACs will review claims submitted by providers of items and services or other individuals furnishing items and services for which payment has been made under section 1902(a) of the Act or under any waiver of the State Plan to identify underpayments and overpayments and recoup overpayments for the States.
(1) States may exclude Medicaid managed care claims from review by Medicaid RACs.
(b) States may coordinate with Medicaid RACs regarding the recoupment of overpayments.
(c) States must coordinate the recovery audit efforts of their RACs with other auditing entities.
(d) States must make referrals of suspected fraud and/or abuse, as defined in 42 CFR 455.2, to the MFCU or other appropriate law enforcement agency.
(e) States must set limits on the number and frequency of medical records to be reviewed by the RACs, subject to requests for exception from RACs to States.
An entity that wishes to perform the functions of a Medicaid RAC must enter into a contract with a State to carry out any of the activities described in § 455.506 under the following conditions:
(a) The entity must demonstrate to a State that it has the technical capability to carry out the activities described in § 455.506 of this subpart. Evaluation of technical capability must include the employment of trained medical professionals, as defined by the State, who are in good standing with the relevant State licensing authorities, where applicable, to review Medicaid claims.
(b) The entity must hire a minimum of 1.0 FTE Contractor Medical Director who is a Doctor of Medicine or Doctor of Osteopathy in good standing with the relevant State licensing authorities and has relevant work and educational experience. A State may seek to be excepted, in accordance with § 455.516, from requiring its RAC to hire a minimum of 1.0 FTE Contractor Medical Director by submitting to CMS a written request for CMS review and approval.
(c) The entity must hire certified coders unless the State determines that certified coders are not required for the effective review of Medicaid claims.
(d) The entity must work with the State to develop an education and outreach program, which includes notification to providers of audit policies and protocols.
(e) The entity must provide minimum customer service measures including:
(1) Providing a toll-free customer service telephone number in all correspondence sent to providers and staffing the toll-free number during normal business hours from 8:00 a.m. to 4:30 p.m. in the applicable time zone.
(2) Compiling and maintaining provider approved addresses and points of contact.
(3) Mandatory acceptance of provider submissions of electronic medical records on CD/DVD or via facsimile at the providers' request.
(4) Notifying providers of overpayment findings within 60 calendar days.
(f) The entity must not review claims that are older than 3 years from the date of the claim, unless it receives approval from the State.
(g) The entity should not audit claims that have already been audited or that are currently being audited by another entity.
(h) The entity must refer suspected cases of fraud and/or abuse to the State in a timely manner, as defined by the State.
(i) The entity meets other requirements as the State may require.
(a) General. Fees paid to RACs must be made only from amounts recovered.
(b) Overpayments. States must determine the contingency fee rate to be paid to Medicaid RACs for the identification and recovery of Medicaid provider overpayments.
(1) The contingency fees paid to Medicaid RACs must be based on a percentage of the overpayment recovered.
(2) States must determine at what stage in the Medicaid RAC audit process, after an overpayment has been recovered, Medicaid RACs will receive contingency fee payments.
(3) If a provider appeals a Medicaid RAC overpayment determination and the determination is reversed, at any level, then the Medicaid RAC must return the contingency fees associated with that payment within a reasonable timeframe, as prescribed by the State.
(4) Except as provided in paragraph (5) of this section, the contingency fee may not exceed that of the highest Medicare RAC, as specified by CMS in the Federal Register, unless the State submits, and CMS approves, a waiver of the specified maximum rate. If a State does not obtain a waiver of the specified maximum rate, any amount exceeding the specified maximum rate is not eligible for FFP, either from the collected overpayment amounts, or in the form of any other administrative or medical assistance claimed expenditure.
(5) CMS will review and consider, on a case-by-case basis, a State's well-justified request that CMS provide FFP in paying a Medicaid RAC(s) a contingency fee in excess of the then-highest contingency fee paid to a Medicare RAC.
(c) Underpayments.
(1) States must determine the fee paid to a Medicaid RAC to identify underpayments.
(2) States must adequately incentivize the detection of underpayments.
(3) States must notify providers of underpayments that are identified by the RACs.
States must provide appeal rights under State law or administrative procedures to Medicaid providers that seek review of an adverse Medicaid RAC determination.
(a) Funds expended by States for the operation and maintenance of a Medicaid RAC program, not including fees paid to RACs, are considered necessary for the proper and efficient administration of the States' plan or waivers of the plan.
(b) FFP is available to States for administrative costs of operation and maintenance of Medicaid RACs subject to CMS' reporting requirements.
A State may seek to be excepted from some or all Medicaid RAC contracting requirements by submitting to CMS a written justification for the request for CMS review and approval through the State Plan amendment process.
The aforementioned provisions in § 455.500 through § 455.516 of this subpart are applicable to Guam, Puerto Rico, U.S. Virgin Islands, American Samoa, and the Commonwealth of the Northern Mariana Islands.