United States: CMS Issues Final Part D Guidance on Controlling Fraud, Waste, and Abuse

On April 25, 2006, the Centers for Medicare and Medicaid Services (CMS) issued its final guidance (Final Guidance) for sponsors of Medicare Part D prescription drug plans (Sponsors) on detecting, correcting, and preventing fraud, waste, and abuse (FWA). The Final Guidance is available at http://www.cms.hhs.gov. Even though CMS has heralded the Final Guidance as taking a flexible approach, it nevertheless imposes considerable obligations on Sponsors and other parties involved in the delivery and administration of the Part D benefit. Some of the requirements bear striking similarity to the often onerous Corporate Integrity Agreement provisions with which health care entities accused of violating federal fraud and abuse laws must comply. Further, enforcement authorities, including the Office of Inspector General (OIG) for the Department of Health and Human Services, have made clear that Part D enforcement is a top priority, and whistleblowers undoubtedly will assist them in their efforts. For these reasons, Sponsors and other Part D stakeholders (including employer or union sponsored plans, pharmacy benefit managers, pharmacies, prescribers, wholesalers, pharmaceutical manufacturers, and Medicare beneficiaries) will need to devote substantial time, money, and other resources to effective compliance program implementation.

The highlights of the Final Guidance, which updates Chapter 9 of the Prescription Drug Benefit Manual and clarifies the draft guidance document issued on February 8th of this year, include:

• Clarification of obligations imposed by the Final Guidance by using "should" to signal recommendations and "shall" to note statutory or regulatory requirements.
• Replacement of the term "subcontractor" with the regulatory terms "first tier entity," "downstream entity," and "related entity."
• Confirmation that self-reporting is voluntary, but recommended.
• An increase in the timeframe for reporting instances of fraud, waste, and abuse from 30 to 60 days.
• Withdrawal of the recommended timeframes for compliance training.
• An optional certification process through which Sponsors receive assurances from first tier entities, downstream entities, and related entities about their compliance practices.

According to the Final Guidance, a Sponsor may develop a comprehensive stand-alone FWA compliance program or integrate CMS’s requirements into its existing compliance plan. CMS defers to each Sponsor to make this decision based on its size, structure, and resources. Highlights of the eight compliance program requirements are discussed below.

Written Policies and Procedures and Standards of Conduct. CMS recommends that every Sponsor implement a code of conduct/ethics for its Part D business. CMS provided a laundry list of the written policies and procedures for FWA programs, including:

• a comprehensive conflict of interest disclosure protocol,
• a process to ensure lawful marketing practices,
• a commitment to Pharmacy and Therapeutic Committee decisions that are made in accordance with CMS regulations and guidance, and
• measures for timely responding to data requests by CMS and its designees, such as the Medicare Drug Integrity Contractors (MEDICs).

A Sponsor should distribute these policies and procedures to its employees at the time of hire, when the standards are updated, and annually thereafter. Employees should then certify that they have received, read, and will comply with the written standards of conduct. CMS also encourages Sponsors to share their code of conduct with first tier entities, downstream entities, and related entities upon request.

A Sponsor must carefully tailor policies and procedures to the organization and its employees. When carrying out their auditing and monitoring responsibilities, the MEDICs, which are responsible for auditing and monitoring Part D compliance, undoubtedly will expect full compliance with all written policies and procedures.

CMS has emphasized that a Sponsor ultimately is responsible for fulfilling its contractual obligations, even if it has delegated to an entity working on its behalf. The Final Guidance recommends that Sponsors seek certifications from first tier entities, downstream entities, and related entities. Certifications may cover the entity’s adoption of its own code of conduct and its review of the OIG and General Services Administration (GSA) exclusion lists with each new hire of individuals with Part D responsibilities and annually thereafter. Sponsors also should expect these entities to require their managers, officers, and directors with Part D responsibilities to sign a conflict of interest statement indicating freedom from any conflict of interest in administering or delivering Part D benefits, and the entities should certify they have done so.

Compliance Officer and Compliance Committee. CMS notes that the corporate Compliance Officer may serve as the Part D Compliance Officer, but "strongly recommends" having two separate positions. A Sponsor cannot delegate the functions of the Part D Compliance Officer or of the compliance committee to a subcontractor. The Final Guidance further outlines, in great detail, the Part D Compliance Officer’s duties as well as the compliance committee’s responsibilities. Given the size and complexity of the Part D program and its detailed compliance requirements, Sponsors should carefully evaluate whether to combine the Part D Compliance Officer responsibilities with an existing position and also should consider selecting an experienced person for the job.

Training and Education. A Sponsor should provide training and education for its Compliance Officer, compliance committee, employees, subcontractors, agents, and directors involved in the Part D benefit. With regard to training of individuals outside the Sponsor’s organization, CMS provides that staff of first tier entities, downstream entities, and related entities should be permitted to attend the Sponsor’s training or agree to conduct their own Part D compliance training. In addition, the Sponsor should provide specialized training to employees who have specific responsibilities related to Medicare Part D. This training may cover issues such as calculating TrOOP, submitting Part D data to CMS, negotiating pharmacy network agreements, reconciling payments, and managing employer group plans. In the Final Guidance, CMS withdrew its specific recommendations regarding the length of training.

Effective Lines of Communication. Effective lines of communication must exist among the Compliance Officer and the Sponsor’s employees, contractors, agents, directors, and members of the compliance committee. In addition, each Sponsor should develop a system to field compliance questions and misconduct reports, such as a hotline or a similar anonymous, easily accessible mechanism. Sponsors should initiate follow-up investigations stemming from hotline inquiries and other complaints within two weeks of receiving the complaint. Further, Sponsors must have and make available to CMS or its designee its complaint tracking system log, as well as methods for educating enrollees about Part D FWA.

Enforcement of Standards Through Well Publicized Disciplinary Guidelines. CMS expects a Sponsor’s senior management to be involved in the development and/or review of standards of conduct. In addition, Sponsors should ensure that disciplinary guidelines are well published using one of the four methods specified by CMS. Sponsors also should distribute the procedures for asking compliance questions and for making FWA reports to senior management, employees, first tier entities, downstream entities, and related entities as appropriate. CMS recommends that the Sponsor include in its contract with first tier entities, downstream entities, and related entities a provision that indicates violations of its disciplinary policies and standard of conduct may result in termination of the contractual relationship with the Sponsor.

Monitoring and Auditing. Sponsors have broad responsibilities regarding monitoring and auditing, as set forth in both the Part D rules and the Final Guidance. Sponsors must develop a monitoring and auditing workplan that addresses risks associated with the Part D benefit and that outlines the Sponsor’s system for responding to all monitoring and audit results, including reporting to MEDICs as necessary. CMS recommends creation of an independent, objective internal audit department if the Sponsor does not already have such a department.

The Final Guidance goes into great detail about development of a strategy for monitoring and auditing first tier entities, downstream entities, and related entities involved in the Part D benefit. Audits should include a review of contracts with these entities, as well as rebate, discount, and all other relevant agreements and supporting data. In addition, a Sponsor should collect routine reports from first tier entities, downstream entities, and related entities to monitor payment, drug utilization, and prescription patterns among physicians and enrollees who obtain multiple prescriptions from providers located outside of a normal distance for care. The workplan should state the number of first tier entities, downstream entities, and related entities the Sponsor will audit each year and how it will identify the entities for such auditing. If these entities perform their own audits related to the prescription drug benefit, Sponsors should seek written assurances from these entities that they have an adequate audit workplan in place and that corrective measures are taken when appropriate. A Sponsor should receive these audit results regularly with respect to their enrollees. In sum, CMS has high expectations for auditing and monitoring and clearly expects Sponsors and other entities involved in delivery and administration of Part D to take a proactive approach to this responsibility.

Prompt Reponses to Detected Offenses. Where evidence suggests misconduct has occurred that is related to payment or delivery of prescription drug items or services under the Part D contract, a Sponsor must initiate timely and reasonable inquiries into such conduct. CMS describes a "timely and reasonable" inquiry as occurring no later than two weeks after identification and including a preliminary investigation of the matter by the Part D Compliance Officer and/or Special Investigative Unit (SIU) for the Sponsor. The Final Guidance explains CMS’s expectations for the role of the SIU, which is an internal investigative unit that already may exist under a different name in some organizations. Sponsors that do not have the time or resources to investigate potential misconduct should refer the matter to the MEDIC within two weeks of identification of the conduct.

Corrective Action Procedures. Whenever an underlying problem results in one or more program violations, a Sponsor must initiate a corrective action plan addressing the particular misconduct identified. The plan should provide structure and timeframes to prevent continued misconduct. The Sponsor should detail any elements of this plan that affect first tier entities, downstream entities, or related entities in a written agreement with the entity. Sponsors should also ensure effectiveness by continuing to monitor corrective action plans after their implementation.

The Final Guidance emphasizes the importance of self-reporting. A Sponsor with an SIU is responsible for investigating potentially fraudulent activity and should refer any determined or suspected fraud, waste, or abuse to the appropriate MEDIC within sixty days. However, CMS does not expect Sponsors to pursue fraudulent activities in the same way as law enforcement. CMS affirmed that reporting is voluntary but is nonetheless important to protect Medicare beneficiaries and the Medicare Trust Fund. Further, the Final Guidance indicated that Sponsors should self-report fraud at the plan level as well as that at the first tier, downstream, or related entity levels.

Once a Sponsor decides to refer a matter to the MEDIC, the Sponsor should compile a referral package including certain information required by CMS. The MEDIC then may request additional information, which the Sponsor must furnish within thirty days, unless the MEDIC specifies otherwise. The Sponsor should provide updates to the MEDIC as new information regarding the matter is identified. The MEDIC will return issues to the Sponsor when it determines they do not rise to the level of potential fraud and will keep the Sponsor apprised of the development and status of the investigation to the extent possible.

CMS encourages Sponsors to consider self-reporting to government authorities such as the OIG. Providers can self-report using the OIG’s Provider Self Disclosure Protocol.

The Final Guidance gives various examples of FWA in which Part D stakeholders could engage; the risk areas are very broad in scope. For Sponsors, risk areas include duplicate payments, excessive premiums, incorrect eligibility calculations, and coordination of benefits in a way that leads to waste or inaccurate data submissions. The Final Guidance also alerts Sponsors to potential actions that could constitute less obvious forms of fraud. For example, CMS prohibits the falsification of TrOOP calculations to keep beneficiaries within the coverage gap or to advance beneficiaries through the coverage gap into catastrophic coverage. Sponsors also may be liable for first tier entities, downstream entities, or related entities who inadequately fulfill duties to beneficiaries, by, for example, incorrectly denying a beneficiary’s right to appeal, prescription splitting to receive additional dispensing fees, using bait and switch pricing (including frequent formulary changes to induce beneficiaries to sign up for a plan where the drugs are later removed), or steering a beneficiary to a particular drug or plan.

CMS does not expect Sponsors to comply with the Final Guidance until January 2007, but all Part D stakeholders affected by CMS’s comprehensive Final Guidance should take immediate steps to comply. Sponsors’ fulfillment of their compliance obligations will require substantial financial and human resources, and other entities involved in Part D, such as pharmacies and pharmacy benefit managers, also will need to incorporate certain aspects of the Final Guidance into their own compliance programs. In addition, all affected parties should consider how the Final Guidance may affect their Part D contracting practices.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.