Health Alliance Plan utilizes the Centers for Medicare and Medicaid Services (CMS) current definitions to define (FDRs):

January 2017

Table of Contents INTRODUCTION... 1 Definition of a First Tier, Downstream and Related Entity... 1 Definition of a Delegated Downstream Entity (DDE)... 2 REQUIREMENTS FOR FDRs/DDEs... 2 Compliance Program... 2 Training... 2 Fraud Waste and Abuse Training... 3 Screening for Excluded and Debarred Individuals and Entities... 3 Compliance Investigation and Reporting... 4 Disciplinary Standards... 5 Monitoring and Auditing... 5 Record Retention... 6 Annual Attestation... 6 Appendix A: HAP s First Tier, Downstream and Related Entity & Delegated Downstream Entity Code of Conduct... 6 Appendix B: Laws that Must Be Addressed in FDR Compliance and FWA Training... 9 Appendix C: Indicators for Potential FWA... 10 Appendix D: HAP s Attestations... 11

INTRODUCTION Health Alliance Plan is committed to compliance with all applicable laws, regulations and HAP policies, as well as demonstrating high ethical standards in our business practices. HAP s Compliance Program is designed to reduce or eliminate fraud, waste, abuse, and inefficiencies; ensure Health Alliance Plan s compliance with applicable regulations; and reinforce Health Alliance Plan s commitment to identifying and mitigating or resolving potential non-compliance or fraud, waste and abuse activities. Our First Tier, Downstream and Related Entities and Delegated Downstream Entities play an integral role in helping to reach these goals. We have created the HAP First Tier, Downstream and Related Entity & Delegated Downstream Entity (FDR/DDE) Compliance Guide to provide compliance information and education to those individuals, entities, businesses, and providers that we work with. Throughout this document, First Tier, Downstream and Related Entities as well as Delegated Downstream Entities will be collectively referred to as FDR/DDE. Additional information about compliance requirements for the Medicare Advantage and Part D program can be found in the Centers for Medicare and Medicaid Services (CMS) regulations and guidance, including the CMS Medicare Managed Care Manual Chapter 21 and the Prescription Drug Benefit Manual Chapter 9. Information about FDR compliance requirements for Qualified Health Plans (QHPs) are outlined in 45 CFR 156.340: Standards for Delegated and Downstream Entities. Additional information on the Health Alliance Plan s (HAP) Compliance Program is also available upon request by contacting the Compliance Department at ComplianceOffice@hap.org. Definition of a First Tier, Downstream and Related Entity Health Alliance Plan utilizes the Centers for Medicare and Medicaid Services (CMS) current definitions to define (FDRs): 1. Downstream Entity any party that enters into a written arrangement, acceptable to CMS, with persons or entities involved with the MA benefit or Part D benefit, below the level of the arrangement between HAP and a First Tier Entity. These written arrangements continue down to the level of the ultimate provider of both health and administrative services. 2. First Tier Entity any party that enters into a written arrangement, acceptable to CMS, with HAP to provide administrative services or health care services to a Medicare eligible individual under the Medicare Advantage or Part D program. 3. Related Entity means any entity that is related to HAP by common ownership or control and: a. Performs some of HAP s management functions under contract or delegation; b. Furnishes services to Medicare enrollees under an oral or written agreement; or c. Leases real property or sells materials to HAP at a cost of more than $2,500 during a contract period. 1

Definition of a Delegated Downstream Entity (DDE) Health Alliance Plan utilizes the ACA definition to define Delegated Downstream Entities (DDEs): 1. Delegated Downstream Entity - Downstream entity means any party, including an agent or broker, that enters into an agreement with a delegated entity or with another downstream entity for purposes of providing administrative or health care services related to the agreement between the delegated entity and the QHP issuer. The term downstream entity is intended to reach the entity that directly provides administrative services or health care services to qualified individuals, qualified employers, or qualified employees and their dependents. REQUIREMENTS FOR FDR/DDE Compliance Program Health Alliance Plan requires that all of its FDRs/DDEs maintain their own effective compliance program that complies with the CMS requirements as set forth in CMS Medicare Managed Care Manual Chapter 21, CMS Prescription Drug Manual Chapter 9 and Part 156 Health Insurance Issuer Standards under the Affordable Care Act, including standards related to Exchanges. The HAP First Tier, Downstream and Related Entity & Delegated Downstream Entity Code of Conduct in Appendix A communicates the minimum standards by which all FDRs/DDEs and their employees are expected to conduct themselves when providing goods and services to Health Alliance Plan, our enrollees, or employees. The HAP Office of Compliance will review the FDRs/DDEs compliance program at the time of contracting, and, based on HAP s current risk assessment, periodically thereafter. First tier FDRs are expected to implement policies and procedures to ensure that any downstream entities or subcontractors have effective compliance programs of their own. Training Applicable FDRs/DDEs must administer effective training and education to their employees who are responsible for the administration of HAP s Medicare Advantage, Medicare Part D, and QHP programs. This training must occur within 90 days of the contract effective date and at least annually thereafter. New employees to FDRs/DDEs must receive training within 90 days of hire. Training must cover: 1) general compliance training, 2) CMS Fraud Waste and Abuse (FWA), 3) Medicare Advantage compliance training related to the job responsibilities of those involved in the administration of HAP s Medicare Advantage and/or Medicare Part D programs; and 4) QHP compliance training related to job responsibilities of those involved in the administration of HAP s QHP plans. FDRs/DDEs must maintain documentation related to training, including the date, time, attendance, topics, training materials and results of training and must provide such documentation to HAP or CMS, or their designees upon request. A more detailed list of specific Federal and State laws regarding false claims, privacy and the Social Security Act are in Appendix B. 2

Fraud Waste and Abuse Training Health Alliance Plan deploys fraud, waste and abuse programs aimed at prevention, identification, investigation and resolution of risks related to potential fraud, waste and abuse including continuous monitoring capabilities aimed at early detection of incidents, including FDRs/DDEs. CMS requires that FWA training be completed annually by employees involved in the administration or delivery of Medicare Parts C and D benefits and administration of QHP plans. FWA training must include, but is not limited to: Laws and Regulations for MA and Part D such as False Claims Act, Anti-Kickback and HIPAA/HITECH Obligations of FDRs to have appropriate Policies and Procedures to address FWA Processes for FDR employees to report suspected FWA to HAP or to their employer Protections for FDR employees who report suspected FWA Types of FWA that can occur in the setting in which FDR employees work Some FDRs/DDEs may have completed their FWA training requirements through accreditation or utilizing the CMS Medicare Learning Network. FDRs and subcontractors enrolled in Medicare Parts A or B or accredited as a supplier of durable medical equipment, prosthetics, orthotics and supplies (DMEPOS) are deemed to have met the FWA training requirements. Most Administrative FDRs/DDEs are not deemed. FDRs/DDEs are encouraged to utilize the CMS Fraud Waste and Abuse training on the Medicare Learning Network: http://www.cms.gov/outreach-and-education/medicare-learning-network- MLN/MLNProducts/ProviderCompliance.html. Fraud, Waste and Abuse Zip File/FWA-GCT_Final.ppt issued February 2013. Screening for Excluded and Debarred Individuals and Entities Health Alliance Plan may not use federal funds to pay for services, equipment or drugs prescribed or provided by an FDR/DDE Vendor excluded by the Department of Health and Humans Services, Office of Inspector General and the United States General Services Administration. HAP requires that its FDRs/DDEs review the OIG List of Excluded Individuals and Entities and the GSA System for Award Management prior to the hiring or contracting with any of the following entities or persons. Thereafter, FDRs/DDEs are required to conduct screenings on a monthly basis to ensure none of these persons or entities that have involvement in the administration or delivery of HAP s Medicare Advantage and Part D program are excluded or become excluded from participation in federal programs. Categories of individuals in an FDR/DDE who should be screened include: Workforce members such as: o o employees, temporary employees, volunteers, interns, and externs Governing Body Members 3

Subcontractors (downstream entities) The websites below should be utilized to perform the required screening. OIG List of Excluded Individuals/Entities (LEIE): http://oig.hhs.gov/exclusions/exclusions_list.asp General Services Administration (GSA) database of excluded individuals/entities: https://www.sam.gov/portal/public/sam/#1#1 If HAP or its FDRs/DDEs identify an excluded or debarred individual employed or contracted by its FDR or the FDR s Downstream Entity, prompt notification must be made to HAP s Office of Compliance at ComplianceOffice@hap.org. FDRs/DDEs must maintain evidence of exclusionary checks (i.e., logs or other records) to document that each category of individual as noted above has been screened in accordance with current regulations and requirements. FDR/DDE must attest to having completed these exclusionary checks and HAP will perform periodic monitoring to ensure compliance with this requirement. Compliance Investigation and Reporting FDRs/DDEs are expected to disclose to HAP potential violations of law, regulation, or program requirements as well as potential compliance and FWA issues in a timely manner, but in no event less than one (1) week from the date the potential misconduct was identified. FDRs/DDEs are also expected to cooperate with HAP in the investigation and resolutions of such issues. Upon discovery of an incident or report of potential non-compliant or FWA issue, the FDR/DDE is expected to initiate a thorough investigation of the incident. All applicable deficiencies and instances of noncompliance must be tracked and monitored by formal corrective action plans (CAP) to ensure that they are remedied and not likely to reoccur. In addition the FDR/DDE must maintain effective lines of communication within its organization and with HAP. Health Alliance Plan FDRs have a responsibility to report any alleged compliance, fraud, waste and abuse, and/or conflict of interest issues that involves Health Alliance Plan. FDRs/DDEs may confidentially report a potential violation of our compliance policies or any applicable regulation by utilizing the following methods: Health Alliance Plan Reporting Health Alliance Plan s 24/7, confidential & anonymous hotline1-877-746-2501 Email to ComplianceOffice@hap.org. CMS/OIG Reporting Office of Inspector General at 1-800-HHS-TIPS (1-800-447-8477), TTY 1-800-377-4950 Centers for Medicare and Medicaid (CMS) at 1-800-Medicare (1-877-486-2048) For additional information on how to detect and report Medicare fraud, you may access this link at www.stopmedicarefraud.gov. 4

Health Alliance Plan requires each FDR/DDE to publicize confidential reporting mechanisms for all employees, contractors, and sub-contractors. If an FDR/DDE does not maintain a confidential reporting mechanism, the Health Alliance Plan Confidential Hotline information must be distributed to encourage reporting of potential compliance issues, fraud, waste, abuse, conflict of interests, violations of compliance policies and/or any applicable regulation. Disciplinary Standards Applicable FDRs/DDEs must maintain disciplinary standards to ensure that their employees who commit compliance or FWA violations are subject to disciplinary and corrective actions. Monitoring and Auditing HAP requires FDRs/DDEs to conduct self-monitoring and self-auditing of their operational performance, remedy all identified areas of deficiency, and disclose them to HAP. In addition, HAP is obligated to oversee and routinely monitor the FDRs/DDEs performance and compliance relative to its delegated functions. FDRs/DDEs are required to provide and report operational performance metrics that reflect the FDRs/DDEs compliance with regulatory and business standards. HAP s Office of Compliance also routinely monitors and assesses the FDRs/DDEs operational performance as it relates to compliance measures. In accordance with CMS guidelines, HAP s Office of Compliance has the authority to: Review company FDR contracts pertinent to the administration of HAP s Medicare Advantage and Part D programs and administration of QHP plans. Review or delegate the responsibility to review the submission of data to CMS to ensure accuracy and compliance with CMS reporting requirements. Review FDR/DDE policies and procedures pertinent to delegated activities. Report potential FWA to CMS, its designee or law enforcement. Conduct and/or direct audits and investigations of any FDR. Conduct and/or direct audits of any area of function involved with Medicare Part C or D plans and QHP plans. Require FDR/DDE to supply data sets/universes to support mock audits and risk assessments. In lieu of doing a direct audit, HAP may require the FDR/DDE to provide a summary of the FDR/DDE work plans and audit results. All FDRs/DDEs are expected to maintain regular operational meetings with the HAP Business Unit/Department (and the Office of Compliance when appropriate) to ensure issue resolution, process enhancements and coordination of communication. At a minimum, this should occur on a quarterly basis. External Regulatory Reporting and Audit Requirements During a CMS, ACA, or State audit of Health Alliance Plan, the applicable FDR/DDE must provide access to information that pertains to any aspect of services performed, reconciliation of benefit liabilities and determination of amounts payable under the contract or as the Secretary of HHS may deem necessary. Failure of an FDR/DDE to provide records may result in CMS: 1) referring HAP and FDR/DDE to law 5

enforcement or 2) corrective action. FDRs/DDEs are required to cooperate with CMS or their contractors. Record Retention The FDR/DDE must retain records related to its compliance programs, training (and participation), screening and the distribution of HAP s FDR/DDE code of conduct. This record retention is required by the agreement between FDR/DDE and HAP for ten (10) years from the longer of (a) the termination or expiration of the HAP agreement with FDR/DDE or (b) the completion of any audit, whichever is later Annual Attestation FDRs/DDEs will be required to attest annually in writing to the following: The HAP First Tier, Downstream and Related Entity & Delegated Downstream Entity Code of Conduct has been made available to employees. FWA and Compliance training was completed by the appropriate employees or the FDR/DDE is deemed to have met the FWA training requirement (records of training attendance, course materials, or documentation to establish FDR/DDE is deemed may be requested). Maintenance of a compliance program that complies with CMS requirements Exclusion and Debarment Checking. Record retention. Status of Offshore Operations and Downstream Contracted Vendors. Data and Information Relating to CMS Payment to a Medicare Organization. The required Attestations are included in Appendix D. Appendix A: HAP s First Tier, Downstream and Related Entity & Delegated Downstream Entity Code of Conduct Health Alliance Plan First Tier, Downstream and Related Entity & Delegated Downstream Entity Code of Conduct Health Alliance Plan is committed to compliance with all applicable laws, regulations and HAP policies, as well as demonstrating ethical standards in our business practices. Our First Tier, Downstream and Related Entities/Delegated Downstream Entities play an integral role in helping to reach these goals. We have created the HAP First Tier, Downstream and Related Entity & Delegated Downstream Entity (FDR/DDE) Code of Conduct to communicate the minimum standards by which all FDRs/DDEs are expected to conduct themselves when providing goods and services to Health Alliance Plan. This Code embodies HAP s commitment to ethical business conduct and our standards of behavior that support the overall mission, vision and values of HAP and its parent organization, Henry Ford Health System. HAP requires all of our FDRs/DDEs to share this Code of Conduct with their employees and to support HAP s commitment to ethical and compliant business practices. 6

HAP s Commitment to FDRs/DDEs HAP employees work with honesty, integrity, and impartiality and follow all applicable laws, regulations, professional organization requirements and HAP or HFHS policies and procedures. Following these principals and standards is critical for our success. HAP leadership is expected to communicate and create a supportive culture that encourages compliance and trust as well as observing business practices closely for violations, and correcting these swiftly when detected. HAP s Board of Directors is committed to oversight of HAP s compliance and ethics program as well as ensuring that compliance and ethical issues are raised, reviewed and resolved openly and honestly without fear of retaliation. If you have any questions or concerns about this Code of Conduct or any situation or activity, contact HAP s compliance hotline at 877.746.2501 or via email at ComplianceOffice@hap.org. Protecting the Rights of HAP Members HAP expects its FDRs/DDEs to recognize that each member is an individual with unique health care needs and to ensure that members are treated with respect. HAP and its FDRs/DDEs must recognize members dignity and rights regardless of nationality, race, creed, color, age, economic status, gender or lifestyle. Conflicts of Interest HAP and its FDRs/DDEs must never use their official position or influence to gain an improper advantage, economic or non-economic, for themselves, their family members, other vendors, members, customer or associates. Conflicts of interest between a FDR/DDE and HAP workforce members, or the appearance thereof, should be avoided. We recognize that there are circumstances in which members of the same family or household work for Health Alliance Plan and a FDR/DDE. When an actual, potential, or perceived conflict of interest occurs, that conflict must be disclosed, in writing, by the FDR/DDE to HAP s Office of Compliance at ComplianceOffice@hap.org. Gifts and Business Courtesies Health Alliance Plan will not permit any personal or financial relationships with vendors that could appear to influence decision making by HAP workforce members, physicians or contractors ( HAP Personnel ). HAP Personnel are prohibited from accepting any personal gifts, loans, services, fees, gratuities, or consideration of any kind, regardless of value, from a FDR/DDE. Unsolicited gifts given to HAP Personnel will be reported to HAP s Compliance Officer 7

Ethical, Legal and Compliance Standards Vendors are expected to conduct their business activities in compliance with applicable laws and regulations, including laws that are applicable to individuals and entities receiving federal funds. FDRs/DDEs are also expected to take appropriate action against their employees who have been found to have violated the law or their own internal policies. Workplace Standards FDRs/DDEs are expected to ensure proper and legal employment practice(s) and to maintain appropriate standards for the workplace environment. HAP is committed to maintaining a diverse and inclusive workforce and vendor base. Where applicable, Health Alliance Plan expects its FDRs/DDEs to mirror our commitment, through employment practices and subcontracting opportunities with diverse businesses. FDRs/DDEs are also expected to create a workplace environment that does not tolerate harassment, which may be of a sexual, physical, written or verbal nature. Additionally FDRs/DDEs are expected to maintain a safe and healthy work environment free from the effects of alcohol or drugs that adversely affect the vendor s ability to render services and products to HAP. Ineligible FDRs/DDEs Health Alliance Plan will not do business with any FDR/DDE if it or any of its officers, directors or employees is, or becomes, excluded by, debarred from, or ineligible to participate in any state or federal government program, or is convicted of a criminal offense in relation to the provision of health care. Health Alliance Plan expects each FDR/DDE to assume full responsibility for taking all necessary steps to assure that its employees involved in providing goods and services to Health Alliance Plan, directly or indirectly, have not been or are not currently excluded from participation in any federal program. Confidentiality, Privacy and Security Federal and state laws require Health Alliance Plan and our FDRs/DDEs to maintain the privacy and security of Health Alliance Plan member and patient information (PHI). FDRs/DDEs are responsible for assuring that all FDR/DDE employees who provide services to Health Alliance Plan know about the requirements of both the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules and, where applicable, those state laws and Health Alliance Plan policies that provide more stringent protection of PHI. If your business relationship with Health Alliance Plan includes access to or the use of PHI, you will be required to sign a business associate agreement with us. Confidential information about HAP strategies and operations is a valuable asset. FDRs/DDEs are expected to treat such information with care and sensitivity and must not share such information with others unless the individuals have a legitimate need to know and have agreed to confidentiality protections. Preservation of Institutional Assets HAP and its stakeholders must be protected from fraud, waste and abuse. FDRs/DDEs must keep records that are accurate, complete and which appropriately reflect transactions and events. These records must conform to applicable regulatory, legal and accounting requirements. Improper or fraudulent accounting, documentation or financial reporting will not be tolerated and may be in violation of applicable laws. Health Alliance Plan will investigate allegations of FDR/DDE Fraud, Waste and Abuse, and, where appropriate, will take corrective action, including but not limited to civil or criminal action. Health Alliance Plan prohibits, and expects its FDRs/DDEs to prohibit, retaliation of any kind against individuals exercising their rights under the Federal False Claims Act or similar state laws. How to Report FDRs/DDEs are expected to report any suspected or actual wrongdoing, including fraud, waste and abuse, safety concerns and compliance violations. HAP s Compliance Hotline is a convenient and anonymous way for FDRs/DDEs to report issues without fear of retaliation. It is available 24 hours a day, 365 days a year. Our toll free Compliance Hotline number is 1-877-746-2501. FDRs/DDEs can also report issues or ask questions by emailing HAP s Office of Compliance at ComplianceOffice@hap.org. Appropriate action is taken against those found to have violated applicable law or Health Alliance Plan policy. 8

Appendix B: Laws that Must Be Addressed in FDR Compliance and FWA Training False Claims Act occurs when a person or entity: Knowingly presents (or causes to be presented to the federal government a false or fraudulent claim for payment. Knowingly uses (or causes to be used a false record or statement to get a claim paid by the federal government. Conspires with others to get a false or fraudulent claim paid by the federal government. Knowingly uses (or causes to be used) a false record or statement to conceal, avoid or decrease an obligation to pay or transmit money or property to the federal government Civil damages and penalties: The penalties may be triple the damages the government sustained. Civil monetary damages between $5000 and 10,000 per claim. Criminal Penalties: If convicted, the individual shall be fined, imprisoned or both. Anti-Kickback Statute prohibits: Knowingly and willfully soliciting, receiving, offering or paying remuneration (including any kickback, bribe or rebate) for referrals for services that are paid in whole or in part under a federal health care program including Medicare. Penalties Fine up to $25,000, imprisonment, or both fine and imprisonment. May invoke the False Claim Act and associated penalties Exclusion from Federal Health Care Programs prohibits: Payment for any item or service furnished, ordered or prescribed by an entity excluded for participation in federal health care programs by the Office of the Inspector General (OIG) HIPAA The Health Insurance Portability and Accountability Act of 1996 Creates greater access to health insurance, protection of privacy of health care data, and promoted standardization and efficiency in the health care industry. Instituted safeguards to prevent unauthorized access to protected health care information Established minimum privacy and security requirements for individual identifiable protected health information. 9

Appendix C: Indicators for Potential FWA Potential fraud, waste and abuse can occur with any entity associated with the business of providing health care insurance. Fraudulent activities are deception, misrepresentation, or concealment by the entity to obtain something of value for which they would not otherwise be entitled. The following are some indicators of potential fraud, waste and abuse for the various entities. Member/Enrollee Does the prescription look altered or possibly forged? Has the member/enrollee filled numerous identical prescriptions, possibly from different doctors? Is the person receiving the service/picking up the prescription the actual beneficiary? Or is there possible identity theft? Is the prescription appropriate based on the enrollee s other prescriptions? Does the member s medical history support the services being requested? Provider Does the provider write for diverse drugs or primarily only for controlled substances? Are the provider s prescriptions appropriate for the member s health conditions (medically necessary)? Is the provider writing for a higher quantity than medically necessary for the condition? Is the provider performing unnecessary services for the member? Is the provider s diagnosis for the member supported in the medical record? Does the provider bill the health plan for services not provided or a more expensive service than was actually provided? Are services being performed and billed by appropriate, qualified entities? Pharmacy or Pharmacy Benefit Manager Are the dispensed drugs expired, fake, diluted or illegal? Do you see prescriptions being altered (changing quantities or Dispense as Written)? Are proper provisions made if the entire prescription cannot be filled (no additional dispensing fees for split prescriptions)? Are generics provided when the prescription requires that brand be dispensed? Are Pharmacy Benefit Managers being billed for prescriptions that are not filled or picked up? Are drugs being diverted (drugs meant for nursing homes, hospice, etc. being sent elsewhere? Wholesaler Is the wholesaler distributing fake, diluted, expired, or illegally imported drugs? Is the wholesaler diverting drugs meant for nursing homes, hospices and AIDS clinics and then marking up the prices and sending them to other smaller wholesalers or to pharmacies? Manufacturer Does the manufacturer promote off label drug use? Does the manufacturer provide samples knowing that the samples will be billed to a federal health care program? Health Plan Does the sponsor offer cash inducements for beneficiaries to join the plan that s not permitted? Does the sponsor provide misleading information about the cost of benefits? Does the sponsor use unlicensed agents or brokers? Does the sponsor encourage/support inappropriate risk adjustment submissions? 10

Appendix D: HAP s Attestations ATTESTATION OF COMPLIANCE PROGRAM AND RELATED COMPLIANCE OBLIGATIONS Health Alliance Plan requires all of its First Tier, Downstream and Related Entities (FDRs) and Delegated Downstream Entities (DDEs) to annually attest to the following compliance areas. I, acting on behalf of [insert FDR/DDE name], as a first-tier, downstream or related entity (FDR) or Delegated Downstream Entity (DDE) to HAP, hereby attest that, to the best of my knowledge, information and belief, and based on a professional standard of acceptance the FDR/DDE is in compliance with all the requirements set out in HAP s First Tier, Downstream and Related Entity & Delegated Downstream Entity Compliance Guide, including but not limited to: FDR Initials Compliance Program. FDR/DDE maintains a compliance program that complies with CMS requirements as set forth in CMS Medicare Managed Care Manual Chapter 21, CMS Prescription Drug Manual Chapter 9 and, for Quality Health Plans (QHPs) Part 156 Health Insurance Issuer Standards under the Affordable Care Act, including standards related to Exchanges. Training. FDR/DDE provides (1) CMS Fraud, Waste and Abuse, (2) compliance program; and (3) Medicare Advantage/ACA compliance training to all persons, including downstream entities, involved in the administration or delivery of HAP s Medicare Advantage, Part D, or QHP program upon initial hire or contracting and then at least annually thereafter. FDR/DDE maintains the records of the date, time, attendance, topics, training materials and results of training. Code of Conduct. FDR/DDE acknowledges that HAP has provided HAP s First Tier, Downstream and Related Entity & Delegated Downstream Entity Code of Conduct and that FDR/DDE abides by the terms of HAP s FDR/DDE Code of Conduct and FDR/DDE will provide a copy of their own Code of Conduct on an annual basis. Exclusion and Debarment Checking. FDR/DDE has performed a review of the OIG and GSA exclusion lists for all employees, governing body members, and downstream entities at the time of hire or contracting and then monthly thereafter and that no persons or entities were found to be on such lists. If any of FDR/DDE employees, governing body members and downstream entities are found to be on the OIG or GSA lists, FDR/DDE shall immediately notify HAP s Office of Compliance at 877.746.2501 and shall require the immediate removal of such person from any work directly or indirectly related to HAP. Record Retention. FDR/DDE must retain records related to the items noted above and as required by the agreement between FDR/DDE and HAP for ten (10) years from the longer of (a) the termination or expiration of the HAP agreement with FDR/DDE or (b) the completion of any audit, whichever is later. Signature of FDR/DDE Representative Date Printed Name 11

ATTESTATION OF REPSONSE TO STATUS OF OFFSHORE OPERATIONS I, acting on behalf of [insert FDR/DDE name], as a first tier, downstream or related entity (FDR) or Delegated Downstream Entity (DDE) to HAP, hereby attest that, to the best of my knowledge, information and belief, and based on a professional standard of acceptance, the FDR/DDE DOES DOES NOT (please identify the appropriate response) perform contracted services at an offshore location or contract with an entity that performs contracted services at an offshore location. If FDR/DDE DOES perform contracted services offshore, please complete the following section. Offshore Entity Name(s) Offshore Entity Country(ies) Offshore Entity Address(es) Offshore Entity Functions Effective Date for use of Offshore Functions PHI Provided for Functions Description of Safeguards to Protect PHI 12

For each offshore entity, FDR/DDE attests to the following: FDR Initials Offshore subcontracting arrangement has policies and procedures to ensure that Medicare beneficiary protected health information and other personal information remains secure. Offshore subcontracting arrangement prohibits offshore entity s access to Medicare data not necessary for offshore entity to perform its functions. Offshore subcontracting arrangement includes provisions allowing for immediate termination of the arrangement upon discovery of a significant security breach and to the extent such termination is necessary, FDR/DDE has mitigation plan for continuance of services. Offshore subcontracting arrangement includes all required Medicare Part C, Part D and QHP contract language. FDR/DDE conducts an annual audit of offshore entity and such audit results are used to evaluate the continuation of its relationship. FDR/DDE agrees to share offshore entity s audit results with CMS upon request. Signature of FDR/DDE Representative Date Printed Name 13

ATTESTATION OF DATA AND INFORMATION RELATING TO CMS PAYMENT TO A MEDICARE ADVANTAGE ORGANIZATION I, acting on behalf of my FDR [insert name] to HAP, hereby acknowledge that the information described below directly affects the calculation of CMS payments to HAP or additional benefit obligations of HAP and that misrepresentations to HAP about the accuracy of such information may result in Federal civil action and/or criminal prosecution. HAP has reported to CMS during the period of (INDICATE DATES) all (INDICATE TYPE - DIAGNOSIS/ENCOUNTER/RISK ADJUSTMENT) data available to HAP with respect to HAP s Medicare Advantage plans. Based on best knowledge, information, and belief as of the date indicated below, all information submitted to HAP, which HAP in turn relied on or submitted to CMS, is accurate, complete, and truthful. Signature of FDR Representative Date Printed Name 14