CMS Part D UPDATES Kim Brandt Director, Program Integrity Centers for Medicare & Medicaid Services
Regulatory Changes - 42 CFR Parts 422 and 423 Outline of the presentation: I. Regulatory changes that may impact industry operations (42 CFR Parts 422 and 423) Key issues related to: - Program Operations - Program Accountability and Compliance - Program Integrity - Fraud, Waste and Abuse II. OIG Report: CMS Part D Safeguards - OIG Findings and CMS Responses 2
42 CFR Parts 422 and 423 Part 422 Medicare Advantage Program Part 423 Voluntary Medicare Prescription Drug Benefit 3
42 CFR Parts 422 and 423 Plans affected by the regulation: - Medicare Advantage Plans - Medicare Advantage Prescription Drug Plans - Stand-alone Prescription Drug Plans 4
Regulatory Changes Program Operations: 1. Contract Determinations Eliminating the reconsideration process for review of contract determinations 2. Appeal Rights 1. Applicable for all contract determinations 2. Same appeal rights 5
Regulatory Changes Program Accountability and Compliance: Intermediate sanctions and civil monetary penalties: Clarifying the intermediate sanctions and civil money penalty s provisions that apply to MA organizations and Part D prescription drug plan sponsors The current reconsideration step has been moved for intermediate sanctions, permitting a plan to go to a hearing concerning an intermediate sanction. 6
Regulatory Changes Program Integrity- Fraud, Waste and Abuse Training and Education Definitions (clarification of key terms) Access to books and records Self-reporting 7
Regulatory Changes TRAINING and EDUCATION Issue: Are Part D sponsors required to provide training and education directly to all contracted entities? Response: CMS does not require Part D sponsors to directly provide training and education to its first tier, downstream and related entities. However, sponsors need to ensure that these entities are adhering to the requirement either through their own or the sponsors training and education program. 8
Program Integrity Training and Education TRAINING and EDUCATION Issue: How might a Part D sponsor fulfill the training and education requirement? Response: Guidance on providing training and education are provided in Chapter 9 of the Prescription Drug Benefit Manual. - 50.2.3.1 (General Compliance Training): Inform staff of the Compliance officer, compliance committee, work plan of the organization, etc. - 50.2.3.2 (Specialized Compliance Training): Training in the particular aspects of Part D and their responsibilities in limiting compliance risks. - 50.2.3.3 (Methods of Training): Various onsite and offsite methods discussed. 9
Program Integrity Definitions DEFINITIONS Issue: Clarify who is considered a subcontractor? Response: The term subcontractor has been replaced by First Tier, Downstream, and Related Entity to provide further clarity. These terms indicate entities such as Pharmacy Benefit Managers, Pharmacies, etc. 10
Program Integrity - Definitions DEFINITIONS (Sections 422.2 and 423.4) First Tier Entity means any party that enters into a written arrangement acceptable to CMS, with a Part D sponsor or a MA organization or applicant to provide administrative or health care services for a Medicare eligible individual under the Part D or MA program. 11
Program Integrity - Definitions DEFINITIONS (Sections 422.2 and 423.4) Downstream Entity means any party that enters into a written arrangement acceptable to CMS, with persons or entities involved with the Part D benefit, below the level of the arrangement between a Part D sponsor or a MA organization (or applicant) and a first tier entity. These written arrangements continue down to the level of the ultimate provider of both health and administrative services. 12
Program Integrity Definitions DEFINITIONS (Sections 422.2 and 423.4) Related Entity means any entity that is related to the Part D sponsor or MA organization by common ownership or control and: (1) Performs some of the Part D sponsor or MA organization s management functions under contract or delegation; (2) Furnishes services to Medicare Enrollees under an oral or written agreement; or (3) Leases real property or sells materials to the Part D sponsor or MA organization at a cost of more than $2,500 during a contract period. 13
Program Integrity - Access to Books and Records ACCESS TO BOOKS AND RECORDS CMS has existing legal authority to access books and records of first tier, downstream and related entities under section 1860D- 12 (b)(3)(c ) of the Medicare Modernization Act and 422.504(e)(2) and 423.505 (e) (2) of the regulation. 14
Program Integrity - Access to Books and Records ACCESS TO BOOKS AND RECORDS Issue: How should information requested from first tier, downstream and related entities be submitted to CMS? Response: First tier, downstream and related entities are given the option of either submitting the requested information directly to the Part D sponsor or to CMS or its designee. This decision should be made through the contractual negotiation process. 15
Program Integrity - Access to Books and Records ACCESS TO BOOKS AND RECORDS Issue: What is the standardized format to submit information? Response: The information requested may vary depending on the circumstances and as a result it may not be possible to develop a single standardized format. The format will be determined based upon the specific request from CMS. 16
Program Integrity Self Reporting SELF-REPORTING Issue: Should self reporting be mandatory? Response: Further comments solicited as CMS explores the benefits and challenges of requiring mandatory selfreporting. Comments are due February, 2008. 17
II. Office of Inspector General CMS Safeguard Report The U.S. Department of Health and Human Services Office of the Inspector General (OIG) Report: CMS Implementation of Safeguards During Fiscal Year 2006 to Prevent and Detect Fraud and Abuse in Medicare Prescription Drug Plans 18
OIG Finding #1 Neither CMS nor the MEDIC has conducted any significant data analysis for fraud detection purposes. CMS Response - PDPs only began submitting data in mid 2006, so CMS was not able to begin data analysis efforts until after a significant amount of data had been compiled. CMS knew this would be a limitation of the MEDICs initially and planned accordingly. - All three MEDICs became fully operational in December of 2006. Discussions began about allowing them access to the data so they could begin doing analysis. This process has only recently concluded and as of mid-2007 the MEDICs are in a position to begin full utilization of the PDP data. 19
OIG Finding #1 Neither CMS nor the MEDIC has conducted any significant data analysis for fraud detection purposes. CMS Response CMS did conduct targeted data analysis on the PDP data in the interim time period on specific areas of vulnerability identified by either the MEDICs or law enforcement. 20
OIG Finding #2 Efforts to monitor PDP sponsor compliance are in place, but compliance audits have been delayed. CMS Response - CMS conducted PDP auto-enrollment readiness audits in the fall of 2006, and the routine PDP compliance audits began in February 2007. Since then, CMS has conducted numerous audits of PDP and MA-PD organizations aimed at ensuring compliance with Medicare program requirements. 21
OIG Finding #3 CMS issued requirements for PDP sponsors fraud, waste, and abuse compliance plans. CMS Response - CMS has instituted the Compliance Plan Best Practices Self-Assessment Tool which will explain all aspects of a PDP s Compliance Plans. The Self-Assessment will cover all of the required Compliance Plan elements, as well as the best practices and recommendations described in CMS final guidance on Fraud, Waste, and Abuse. - The Self-Assessment will serve three purposes: 1) compel PDPs to scrutinize every element of their Compliance Plans in accordance with our requirements and guidelines; 2) report to CMS the extent to which best practice recommendations are being implemented so that CMS can provide better training, if necessary, and 3) identify Part D sponsors that are not meeting CMS basic requirements so that we can take appropriate corrective actions. 22
OIG Finding #4 Many education efforts are under way, but the slow release of two key documents raises concern (the Prescription Drug Benefit Manual and Fraud Alerts). CMS Response Manuals: The OIG findings indicate that only three chapters of the Prescription Drug Benefit Manual were released by the end of FY 2006. This is not correct. CMS released five chapters by the end of FY 2006. In addition, during this same period, we released 3 chapters in draft: 23
Fraud alerts: There was a delay in releasing the fraud alert regarding the $299 Ring Scams. Fraud alerts are early warnings for law enforcement entities and PDP sponsors. CMS took deliberate steps to ensure that its first Part D fraud alert was comprehensive and provided all of the necessary information to warn our stakeholders about the scams. CMS was confident that waiting to release the fraud alert during the marketing and open enrollment period would promote awareness about the $299 Ring scams at a critical juncture for our stakeholders. 24
Fraud alerts: Fraud alerts are not the sole means of warning our public about fraud schemes. CMS routinely disseminates information about fraud through fact sheets and press releases to alert beneficiaries of potential scams and to provide them with information to protect themselves from unscrupulous individuals. Specifically related to the $299 Ring scams, CMS issued two press releases, prior to the official fraud alert, to warn beneficiaries about these scams. The press releases outlined the methods that perpetrators use to prey upon Medicare beneficiaries and information about how beneficiaries can distinguish between scam artists and legitimate Medicare representatives. 25
OIG Finding #5 Shortly after the close of FY 2006, the MEDIC investigators faced a backlog of 24 percent (1,475) of the 6,132 complaints they had received. CMS Response - Upon receipt of a fraud allegation, which is categorized as a complaint, the MEDIC s staff enters the complaint into the complaint tracking module and its own internal tracking system. - If the complaint staff determines that a complaint involves potential fraud, the MEDIC fraud unit will conduct a review. - Should the MEDIC fraud unit substantiate evidence of potential fraud, the complaint becomes part of an investigation or case that is developed for law enforcement review. These complaints will remain open in both tracking systems until the MEDIC concludes its review or a case is referred to law enforcement and is accepted or declined. 26
CMS Response Since the inception of the 3-pronged MEDIC structure, we have made progress toward processing complaints even more efficiently. For example, from December 2006 to June 30, 2007, the MEDICs have received 5,286 complaints. Of those complaints, only 2 are older than 30 days. Since the MEDICs are often not given correct contact information when a complaint is made, it can sometimes take a while to actually contact the beneficiary and receive their authorization to work on the case. * Of the 1,475 open complaints cited in the report, 1,242 (84 percent) were part of ongoing fraud investigations or cases that the MEDIC was preparing for law enforcement review. There were only 233 complaints open and awaiting review by MEDIC staff and CMS does not view this as a backlog. 27
OIG Finding #6 Insurance brokers, one of the most frequent subjects of fraud complaints made to the MEDIC, are regulated by State Insurance commissions and are beyond regulatory reach of CMS. CMS Response - While CMS has no direct regulatory authority over insurance brokers, they are not entirely beyond the regulatory reach of CMS. CMS holds Part D sponsors responsible for the conduct of any agents and brokers they may hire to sell Part D products. - Currently, when CMS determines that agents and brokers are not in compliance with Part D marketing and enrollment requirements CMS takes enforcement actions against the PDP sponsor whose products the agents are selling. 28
CMS Response Depending on the severity and frequency of the violations, CMS may take a range of compliance actions, from issuing formal warning notices to the sponsor up to the imposition of intermediate sanctions (e.g., suspension of marketing and enrollment activities) and PDP sponsor contract termination. Thus, through its authority to take compliance actions against Part D sponsors, CMS exercises a form of regulatory influence over insurance brokers hired by these sponsors. 29
OIG Finding #7 Overutilization of drugs for the purpose of personal drug abuse or selling prescription drugs for profit poses a significant cost risk to Medicare Part D; however, plans are limited in their ability to monitor suspect enrollees. CMS Response - The OIG suggests that similar monitoring programs used in Medicaid, such as pharmacy restrictions, be used in Medicare to curb overutilization. Chapter 7 of the Prescription Drug Benefit Manual, Quality and Improvement and Medication Management, stipulates that Part D sponsors should not implement programs that decrease beneficiaries access to their Part D benefit. This includes any sort of a lock-in program that limits beneficiaries to utilizing only a single pharmacy. Instead, CMS directs plans that, upon notification or discovery of an allegation of fraud, abuse, or a suspected pattern of inappropriate drug utilization, the Part D sponsor must review the case to rule out billing or claims processing errors, and, if necessary, direct the case to the appropriate authorities (i.e., MEDIC or local law enforcement). 30
CMS Response - In addition, Part D sponsors must provide appropriate education to both prescribers and beneficiaries. For instance, if a potential drug problem is discovered, intervention letters should be sent to all providers who ordered a drug relevant to the identified problem. An intervention might consist of an informational letter to the prescriber, a response form for the prescriber to complete and a patient drug profile. 31
OIG Finding #8 Develop a comprehensive safeguard strategy for Medicare Part D PDPs with specific activities and target dates and ensure that all activities are progressing in a timely manner. CMS Response - Since the implementation of the program, CMS has had a comprehensive safeguard strategy for the Part D program in place. As stated in our prior response, the individual task orders and the Umbrella Scope of Work (USOW) are CMS safeguard strategy. - The three MEDICS work collaboratively to identify national fraud schemes by analyzing data. CMS has also assigned a Government Task Leader (GTL) to each regional MEDIC. The GTLs are responsible for monitoring MEDIC activities, ensuring that target dates are met, and facilitating effective communication between CMS and the MEDICs. 32
OIG Finding #9 Ensure that all fraud complaints receive proper attention. CMS Response - CMS has and will continue to ensure that all fraud complaints receive proper attention. In order to accomplish this, CMS implemented a regional MEDIC structure. Each MEDIC has a Government Task Leader who monitors complaint processing to ensure that complaints are resolved timely. 33
CMS Response - Should the MEDIC fraud unit substantiate evidence of potential fraud, the complaint becomes part of an investigation or case that is developed for law enforcement review. These complaints will remain open in both tracking systems until the MEDIC concludes its review or a case is referred to law enforcement and is accepted or declined. Open complaints are part of ongoing fraud investigations or cases that the MEDIC was preparing for law enforcement review. - To further enhance our response time, CMS is exploring the feasibility of transferring complaints from 1800MEDICARE directly to the MEDICS. 34
OIG Finding #10 Require PDP sponsors to include standard wording regarding requirements for record retention and accessibility within subcontractor contracts. CMS Response - PDP sponsors are held accountable for the Part D-related work done on their behalf by their subcontractors. This includes making certain that sponsors comply with all record retention and accessibility requirements, regardless of whether those records are maintained by the sponsor itself or one or more of its subcontractors (first tier, downstream and related entities) - To clarify the obligations of both PDP sponsors and their subcontractors to meet the requirements of the Part D program, in the proposed rule, Revisions to the Medicare Advantage and Part D Prescription Drug Contract Determinations, Appeals, and Intermediate Sanctions Processes (published May 25, 2007 in the Federal Register), CMS recommends changes or additions to the provisions of 42 C.F.R. 423.4 and 423.505 related to the role of subcontractors in the Part D program. For example, the provisions of 42 C.F.R. 423.505(i)(3)(iv), if adopted as a part of the final rule, would make it clear that PDP sponsors must have provisions in their subcontracts that grant CMS access to Part D-related information maintained by their subcontractors. 35
CMS Response PDP sponsors are ultimately accountable by contract to CMS for the performance of all Part D functions (including those delegated to subcontractors). They are also at risk of CMS-initiated sanction or contract termination for failure to meet Part D requirements. As a result, the sponsors are in the best position to structure the terms of their subcontracts to manage that risk effectively. Implementation of the OIG s recommendations would run counter to that principle. CMS would also anticipate legal obstacles to the implementation of the recommendations arising primarily from the lack of privity of contract between CMS and subcontractors to Part D sponsors. Also, CMS believes the duration of the record retention requirement (10 years) is already effectively stated in the Part D regulation and made binding on both the sponsors and their Part D subcontractors. The appropriate time and manner for responding to CMS requests for information varies based upon the nature of the information in question. It is unreasonable to expect PDP sponsors to anticipate and itemize in their subcontracts the required timelines for responses to all types of CMS information requests. 36
CMS Response Finally, CMS should not mandate for PDP sponsors the specific penalties they must impose on their subcontractors that fail to comply with Part D record access requirements. This requirement would compromise PDP sponsors ability to manage the risk they bear for non-compliance by preventing them from crafting provisions that use liquidated damages, schedules of fees, contract termination, or some combination of all three to develop appropriate penalties for a subcontractor s failure to meet program requirements. 37
OIG Finding #11 Enforce appropriate sanctions for PDPs whose brokers violate permissible marketing practices. CMS Response CMS has taken and will continue to take the appropriate enforcement actions against PDPs whose brokers violate permissible marketing practices. 38
OIG Finding #12 Utilize the MEDICs as intermediaries for PDPs to share information about their beneficiaries suspected of inappropriate utilization. CMS Response CMS is currently evaluating the possibility and the potential implications of having the MEDICs serve as the intermediaries for PDP data. 39
Conclusions As part D data becomes more available CMS will increase its proactive measures to identify and prevent fraud. As the Part D drug program evolves so does CMS efforts to combat fraud, waste and abuse. Collaborating with our colleagues in industry and law enforcement will better assist CMS in protecting beneficiaries and the Trust Fund. 40
Questions Contact Information: Kimberly Brandt (410) 786-5704 Kimberly.Brandt@cms.hhs.gov 41