There are no more excuses for failing to adopt a comprehensive compliance program. Section 6401 of the Patient Protection and Affordable Care Act (PPACA), enacted on March 23, 2010, mandates that all health care providers enrolled in Medicare, Medicaid, and the Children's Health Insurance Program (CHIP) establish a compliance program as a condition of enrollment.1 Given this condition of enrollment, health care providers are urged to develop new, or update existing, compliance programs as quickly as possible. This is especially the case for Medicare Advantage (MA) organizations and Medicare Prescription Drug Plan (PDP) sponsors (collectively defined as "Sponsors"), in the wake of the Centers for Medicare & Medicaid Services (CMS)'s July 2012 issuance of Final Compliance Program Guidelines ("Final Program Guidelines").2 Although a set of final compliance program guidelines has not been released as to physician practices or other health care providers, the issuance of Final Compliance Program Guidelines applicable to Sponsors nonetheless serves as an important roadmap to all health care providers for the development and refinement of compliance programs.

MA Organization & PDP Sponsor Program Requirements

CMS has issued the Final Program Guidelines as both Chapter 9 of the Medicare Prescription Drug Benefit Manual and Chapter 21 of the Medicare Managed Care Manual. The content of both Chapters 9 and 21 is identical and applies equally to the MA and Part D Programs. CMS initially issued and solicited public comment on draft Compliance Program Guidelines ("Draft Guidelines") on February 8, 2012. CMS issued the revised, Final Program Guidelines, after its review of comments from 68 separately identified entities, including Sponsors, pharmacy associations, and health plan associations. Pursuant to 42 C.F.R. §§ 422.503(b)(4)(vi) ("Conditions necessary to contract as an MA organization") and 423.504(b)(4)(vi) ("Conditions necessary to contract as a Part D plan sponsor"), all Sponsors must implement an effective compliance program that incorporates a set of seven core requirements. The Department of Health and Human Services (HHS) and its Office of Inspector General (OIG) have consistently cited these components in guidance materials as the basic elements for inclusion in compliance programs for health care providers, regardless of industry sector or category type.3 The seven core requirements set forth in sections 422.503(b)(4)(vi) and 423.504(b)(4)(vi) serve as the framework for the Final Program Guidelines for Sponsors. The Guidelines are chiefly broken down into seven sections, each of which fleshes out the regulatory requirements and CMS expectations for Sponsors corresponding to each core requirement. The seven core requirements and the key points from the Final Program Guidelines pertaining to each are summarized below:

  1. Written Policies, Procedures and Standards of Conduct: Sponsors must maintain documentation that clearly articulates a commitment to abiding by federal and state health care laws and to fostering an overall culture of compliance. As is a general theme throughout the guidance, CMS recommends the involvement of the Sponsor's full governing body, in this instance, in the form of a resolution signaling commitment to compliant and ethical practices. Sponsors are also to ensure that the written policies are regularly distributed to all individuals supporting Medicare business. These include the Sponsor's own employees,4 as well as the Sponsor's "first tier, downstream, or related entities" ("FDRs")5 and the FDRs' employees.6
  2. Compliance Officer, Compliance Committee and High Level Oversight: Sponsors must designate a compliance officer ("CO") and compliance committee ("CC") who directly report to the CEO or other senior management, and have direct, unfiltered access to the CEO. CMS expectation is that CO position will be full-time. The CC should meet at least on a quarterly basis. The Final Program Guidelines again stress that the Sponsor's governing body be engaged in the compliance program, mandating that the body be "knowledgeable" as to the content and operation of the program, "exercise reasonable oversight" of implementation and effectiveness, and receive training and education as to program structure and operation.
  3. Effective Training and Education: General compliance training must occur at least annually and be provided in orientation sessions for new employees, which include the CEO, senior management, governing body members and FDRs. Such personnel must receive training within 90 days of hiring. Personnel involved in the administration or delivery of benefits must receive fraud, waste and abuse ("FWA") training according to the same time table.
  4. Effective Lines of Communication: The CEO must have an effective manner of communicating with personnel. The Sponsor's written policies and procedures must require all employees, including FDRs, to report compliance concerns and suspected or actual violations. The reporting mechanism(s) should be user-friendly and available 24 hours a day. Sponsors must maintain a tracking system for questions or reports.
  5. Well-Publicized Disciplinary Standards: Sponsors must establish and publicize disciplinary policies and procedures for their employees and FDRs. These policies must set forth the Sponsor's expectations for compliance issue reporting and resolution, and that personnel participate in required training.
  6. Effective System for Routine Monitoring, Auditing and Identification of Compliance Risks: Sponsors must establish and implement an effective system for routine monitoring and the identification of compliance risks, which includes internal monitoring and auditing and external audits to ensure program compliance. Before developing a monitoring and audit work plan, sponsors must undertake a baseline assessment of major compliance and FWA risk areas, which evaluates all Medicare business operational areas. The Final Program Guidance emphasizes that a Sponsor must plan to monitor and audit FDRs. It further calls on Sponsors to establish Special Investigation Units ("SIUs"), which are internal investigation units "responsible for conducting surveillance, interviews, and other methods of investigation relating to potential FWA."7
  7. Procedures and System for Prompt Response to Compliance Issues: Sponsors must conduct timely, well-documented and reasonable inquiries into any potential Medicare noncompliance or FWA. These inquiries are to include noncompliance or FWA at the FDR level, and should occur within 2 weeks after the potential noncompliance or FWA incident was identified. All corrective action must be designed to correct the root cause of the noncompliance.

It is important to note that Sponsors of all sizes are required to adopt compliance programs, and are expected to develop the programs to reflect the Final Program Guidelines. Nevertheless, Sponsors are called to tailor their compliance programs according to their individual needs and resources.8

Significance for Non-Sponsor Healthcare Providers & OIG 2013 Work Plan

While final compliance program guidelines have not been released with respect to physicians in general or other non-Sponsor providers, the new Final Program Guidelines provide a comprehensive model for developing the compliance plans for all health care providers subject to Section 6401 of the PPACA.

Moreover, the issuance of these guidelines only further emphasizes HHS's particular, and ongoing commitment to ensuring that health care providers have genuinely invested in effective compliance programs guarding against Medicare fraud. Enforcement initiatives are still increasing, and if the OIG's recently released 2013 Work Plan is any indication, health care providers will only be subjected to further scrutiny over the next year.9 The OIG Work Plan, released on an annual basis, outlines the Office's compliance, investigation, and enforcement focal points for the coming year. The 2013 version specifically sets forth agenda items implicating various categories of providers, including hospitals, nursing homes, hospices, home health agencies, and physicians. For instance, the Work Plan outlines a significant number of new OIG projects particularly geared toward reviewing Medicare payments to hospitals.10 It also targets certain physician practices by including reviews of: Medicare Part B claims for personally performed anesthesia services to determine whether such services were supported in accordance with Medicare requirements; Medicare claims data to identify "questionable billing" for ophthalmological services; and Medicare payments for high-cost diagnostic radiology tests toward assessments of medical necessity and the extent to which the same tests are ordered for a beneficiary by both primary care physicians and physician specialists for the same treatment.11 Providers should take note of the items applicable to their industry, and would be wise to adjust their current practices and compliance policies accordingly.

Footnotes

1 [A] provider of medical or other items or services or supplier within a particular industry sector or category shall, as a condition of enrollment in the program under this title, title XIX, or title XXI, establish a compliance program that contains the core elements...with respect to that provider or supplier and industry or category." 42 U.S.C. § 1395cc(j)(8). Under Section 6401, the Secretary of Health and Human Services (HHS) is to impose deadlines for mandatory compliance program implementation for providers or suppliers by industry or category. At this writing, these deadlines had not yet been established. Nursing facilities are, however, advised to implement compliance and ethics programs by March 23, 2013, the deadline imposed by PPACA section 6102.

2 Dep't of Health and Human Servs.-Ctrs. for Medicare & Medicaid Servs, Pub. 100-16 Medicare Managed Care Manual (Jul. 27, 2012) [hereinafter Final Program Guidelines]. The term "Sponsors" as used throughout this Client Alert signifies MA organizations and PDP sponsors, mirroring the Final Program Guidelines. See Final Program Guidelines sec. 20 ("Definitions").

3 See, e.g., OIG Compliance Program for Individual and Small Group Physician Practices, 65 Fed. Reg. 59434 (Oct. 5, 2000); Publication of the OIG Compliance Program Guidance for Hospitals, 63 Fed. Reg. 8987 (Feb. 23, 1998); Dep't of Health and Human Servs.-Ctrs. for Medicare & Medicaid Servs., Compliance Program Guidance for Medicare Fee-For-Service Contractors (March 2005).

4 Employee distribution must occur within 90 days of hire, when updates occur, and annually thereafter. Final Program Guidelines sec. 50.1.3.

5 The term "FDRs" signifies entities to which "the sponsor has delegated administrative or health care service functions relating to [its Medicare contracts]." Id. sec. 40.

6 Sponsors may either make their own policies available to the FDR, or may alternatively confirm that the FDR maintains comparable policies. Id. sec. 50.1.3.

7 Id. sec. 50.6.10. Although the Final Program Guidance indicates that SIUs are often separate from the Sponsor's compliance department, the Guidance recognizes that, depending on the size of and resources available to the Sponsor, the compliance department may perform those tasks generally conducted by SIUs. Id.

8 Id. sec. 10 ("In order to be effective, a sponsor's compliance program...should be tailored to each sponsor's unique organization, operations, and circumstances.") CMS additionally attests that it will take into account the following in determining whether adequate resources have been devoted to a program: "a sponsor's size, structure, business model, activities, the extent of its delegation of responsibilities to other entities, the breadth of its operation, and the risks it faces." Id.

9 See generally Dep't of Health and Human Servs. Office of Inspector General, Work Plan for Fiscal Year 2013, available at https://oig.hhs.gov/reports-and-publications/archives/workplan/2013/Work-Plan-2013.pdf.

10 Such projects include reviewing: the extent to which non-hospital-owned physician practices billing Medicare as provider-based physician practices met CMS billing requirements; whether claims relating to Medicare payments to hospitals for beneficiary discharges that should have been coded as transfers were appropriately processed and paid; Medicare payments to hospitals for beneficiary discharges coded as discharges to a swing bed in another hospital; costs incurred by Medicare connected to inpatient hospital claims for canceled surgical procedures; and whether diagnosis related group ("DRG") assignments and payments were appropriate in relation to Medicare payments for mechanical ventilation. Id. at 2-4.

11 Id. at 21, 23.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.