Compliance Today Article on Risk Assessment

Recently I penned an article for Compliance Today about the obligation to perform a risk assessment as part of Medicare Advantage and Part D operations. Compliance Today is the monthly, members-only publication of the Health Care Compliance Association. As the content author, I am permitted to provide access the full article on this platform.

Those new to a compliance role will learn how this requirement came to be. For the experienced compliance professional, I provide factors, questions, and techniques to consider for incorporation into a compliance program.

February 2019 Compliance Today, Regan Pennypacker

Copyright 2019 Compliance Today, a publication of the Health Care Compliance Association (HCCA).

Compliance Controls in Spotlight

As Oscar season approaches, who can forget the very serious face on Jordan Horowitz as he held up the correct winner for Best Picture for the 89th Academy Awards? Despite powerhouse accountancy firm PricewaterhouseCoopers (PwC) at the helm, things took a wrong turn.

Jordan Horowitz Moonlight

So what happened? News outlets and social media were quick to focus on presenters Warren Beatty and Faye Dunaway. However, as the layers of onion were peeled, the public learned about the root causes: prohibited social media use, mistaken envelope delivery, and a significant delay in addressing the issue, which allowed the wrong producers about two minutes to give thanks in a bubble of blissful ignorance.

PwC had been the firm of choice of the Academy for over 80 years when this happened, and though this issue had only occurred one other time, it proves even established, reputable systems can break down. From the outside looking in, you might think handing the right envelope to the right person at the right time is a seemingly simple task. You would think the same about driving close to home, which according to many surveys and insurance data, is where most accidents occur. How are these two situations connected? Because we are most comfortable in roads we’ve traveled over and over, and therefore might be more susceptible to distraction.

So often, corrective action plans (CAPs) do not address the true root causes. In this example, the public was made aware of a few factors, but PwC may have identified even more. Was there a relaxed culture around adherence to protocol? Were there outside factors that distracted the two PwC partners onsite? Whatever was found, PwC took full responsibility for the issue and created a CAP, outlining a multi-step plan to avoid this type of issue from recurring. In addition, the Academy took ownership and will regularly review PwC’s policies and procedures to make sure something like this never happens again.

Compliance professionals will see correction, detection, and prevention controls all over this. If any Tinseltown executives are reading, I am happy to provide my services to do some CAP validation during the big day.

Past Performance: There is Still Time to Get it Wrong

Applying for a 2020 Part C, Part D, or Cost plan? CMS will post final past performance methodology soon, most likely early February, but one thing that is final is the past performance review period is down from 14 months to 12. There is reason not to rest easy.

Applicants had complained that 14 months was unfair, stating non-compliance that occurs during January and February of a given year is counted against them in 2 consecutive past performance review cycles, while non-compliance occurring in all other months is counted in only one review cycle. The agency previously believed a full contract year was necessary to capture all relevant aspects of an organization’s performance, but they have determined there is little value on counting a true contract year.

Starting with the 2020 applications, CMS will review the previous 12 months, counting the application deadline month (February) in its entirety; therefore, the review period will be March 1 of previous year to end of February when application is due.

For those applicants who have already counted your points, do not rest on laurels this month or next month. If your organization incurs additional points while you are working so hard on your application (think program audit CMPs and ad-hoc CAPs), it could derail your efforts for another year.

Breaking: 2019 Program Audit Protocol

Let’s get right into it. Last night, the Centers for Medicare & Medicaid Services (CMS) provided detailed information regarding changes to the 2019 Program Audit process. Here, I break down the memo and briefly explain impact.

  • CMS incorporated validation audit updates to the Program Audit Validation-Close Out document. No surprises here as this information was previously communicated in the Call letter of the 2019 Final Announcement.
  • Audit notices are scheduled to be sent between the months of March and July, 2019. This window is two months shorter than the 2018 window, which ended in September. While teams can plan accordingly based on this information, CMS may issue an ad hoc or unplanned audit notice based on a tip, allegation, or newly identified risk. Do not let July pass by and start breathing a sigh of relief. Talk to your Compliance Officers: CMS account managers continually request information regarding plan performance and significant issues. These matters may be referred to the Central Office for further action.
  • The agency is suspending the collection of Supplemental Questionnaires for Coverage Determinations, Appeals, and Grievances (CDAG), Part C Organization Determinations, Appeals, and Grievances (ODAG), and Medicare-Medicaid Plan (MMP) Service Authorization Requests, Appeals, and Grievances (SARAG). They note the info is relevant when conducting root cause or pulling together impact analyses, so best bet is to still have them ready.
  • Arguably the most significant change, modifications are being made to the methodology to review misclassification of beneficiary calls, including the suspension of collecting the Call Log tables. Instead, CMS will review a sponsor’s oversight of the call routing process during its review of Compliance Program Effectiveness (CPE). In my recent experience, the collection of call log data as well as the classification of calls continued to frustrate sponsors. However, the targeting of call log samples was one of the most eye-opening and direct avenues to identify misclassification. It also shed light on opportunities to improve customer service overall, especially when it came to listening to calls handled by a vendor. Shifting from targeted samples to a review of process appears to be a step backwards. Since processes vary sponsor to sponsor, listening to targeted calls was a consistent method to uniformly measure a sponsor’s compliance.
  • Speaking of CPE, CMS will suspend some data collection including the Self-Assessment Questionnaire and some universe data points in the review of the compliance program. The agency realized some of this information was either covered in tracer samples, not pertinent to identifying increased risk of non-compliance or no longer required. It is not expected this will significantly reduce sponsor burden, however it does demonstrate the agency is continually evaluating methodology to make it more meaningful.
  • Additional program audit elements suspended to reduce overlap include the Website Review, previously conducted in Formulary Administration, and Enrollment Verification in Special Needs Plan – Model of Care.
  • Part D, take note: CMS will be evaluating the implementation of the Comprehensive Addiction and Recovery Act (CARA) of 2016 through the program audit process. How so? CARA allows sponsors to limit “at risk beneficiary” access to coverage for frequently abused drugs via drug management (DM) programs starting next year. The agency is clarifying that these decisions made under DM programs are not defined as coverage determinations, and therefore will not be collected in data universes. However, at-risk redeterminations (appeals) will be collected as part of the appeals tables 6 and 8 (Standard and Expedited Redeterminations, respectively).
  • Timing is everything, and sponsors should welcome the anticipation of the February, 2019 release of the final appeals guidance. While CMS acknowledges they do not anticipate significant changes from the draft to the final, they note they will provide opportunity to the industry to implement the updates before auditing these changes to compliance standards. Once the final guidance is released, CMS notes they will communicate how and when any audit standards will be affected. Keep in mind, audit review periods are retrospective. Ideally, CMS would provide a future effective date for the appeals guidance so that sponsors can fully evaluate and implement changes. This is done in the annual enrollment guidance as well as for many provisions in the Marketing Guidelines, so why not for key appeals guidance? Time will tell.

We still wait for the 2020 Program Audit Protocol 30-day notice for public comment to be released. All in all, reduction of burden on sponsors and focus on patient care seem to be a factors in implementing these changes.

What to do next: Sponsors should evaluate what changes need to be made to current audit preparation processes. While some items are easily implemented (such as the suspension of data collection), questions remain. Will CMS be reviewing the call routing process desktop procedures only, or will they solicit training tools and other procedures? Will vendor call routing processes be collected and reviewed, or will vendors be required to explain their processes during CPE week? Will the appeals chapter really be released in February? Contact me to schedule a call to discuss what these changes mean for your own audit planning and general oversight. I’ll be caffeinated and ready!

Readiness: A Year-Round Effort

A solid, compliant sponsor isn’t perfect, but they know how to react swiftly when the unexpected arises, and it will come up year-round. Take it from recent enforcement notices issued by the Centers for Medicare & Medicaid Services (CMS).

Within a matter of days, the agency first imposed and then lifted an immediate suspension of enrollment and marketing sanction on a Prescription Drug Plan (PDP) sponsor new to the market. Operated by a highly reputable organization with over 100 years in the finance and insurance industries, the enrollment and marketing freeze was imposed due to the sponsor not providing CMS with evidence of a valid license within the state of Florida. The sponsor had disclosed to the agency that the state had recently informed them an amendment was required for their license to be complete. Therefore, based on what was in effect with the state, the sponsor was not in compliance with the Part D regulation 42 C.F.R. § 423.401(a) which requires each PDP sponsor have a license under state law as a risk bearing entity eligible to offer health insurance or health benefits coverage.

The issue was quickly remedied when the Office of Insurance Regulation provided notice to CMS it had approved the additional line of business on the sponsor’s license. As a result, CMS lifted the sanction. The requirement to be properly organized and licensed under state law is confirmed upon submission of a Part D application, unless a waiver is requested and approved. That should generally be the end of it, but in this sponsor’s case, there was more to come.

As illustrated by this recent enforcement action, things you think are in place might not be, and no checklist can prepare you for those instances. Those most successful in administering government programs are honest about what they know, unafraid to pick up the phone and verify, and driven to implement effective corrections.

Draft Part C and Part D Appeals Guidance for Industry Comment

On October 1, 2018, the Centers for Medicare & Medicaid Services (CMS) released consolidated draft chapter guidance based on Chapter 13 of the Medicare Managed Care Manual and Chapter 18 of the Prescription Drug Benefit Manual.

CMS requests comment on the revisions, structure and format by close of business, Monday, October 22. In a new publication, I summarize notable revisions and provide suggestions and points to ponder based on my experience with this beneficiary-impacting area of plan operations.

Whether you are a new or experienced in your role – be it Compliance Officer, VP of Operations, Appeals Director – and whether you are at a plan sponsor or entity delegated to perform these functions, my summary provides key considerations to supplement your review.

Send me a download link

Name *

Email *

Crushing Deductibles Affect RI Families

Many employer group plans today have higher than normal deductibles. In my experience (and under past employment), benefit plans generally did not have an in network deductible, and my out-of-pocket costs included either copayments of flat dollar fees, or coinsurance, percentages of a total. Deductibles were saved for out of network benefits, and even then we were talking only $500 or $1000, on a generous plan. Nowadays, a family has to meet so many out of pocket costs.  I have two anecdotes to provide in this regard.

A family member experienced a glitch, and was not able to change her plan as of January 1 of this year. A new plan with a new deductible was in effect February 1.  Unfortunately, her out-of-pocket costs incurred in January do not offset her February plan with a new organization. She has filed appeals requesting exceptions, which hopefully will be approved because the Summary of Benefits and Coverage (SBC) has been arguably watered down to incompletion. This is a great difficulty for someone self-employed and raising a family.

A close friend has been helping her sister financially as she undergoes treatment for a serious illness. Her sister was diagnosed a few months ago, and has a plan your benefit which includes a $6000 deductible starting June 1. She works for a major pharmacy benefit manager in a warehouse position, and has so for years, but barely makes a living wage considering she is single, taking care of her disabled son as well as a granddaughter. My friend is self employed herself and is now hustling as best she can to help her sister pay participating physicians who are demanding cash upfront.

These anecdotes illustrate a couple examples of how our current system is causing great financial harm to working families. More refinement is needed to make sure people don’t delay care and providers do not refuse care due to cost.

Passed the Test!

This past week I completed and passed the exam to be a Certified Compliance & Ethics Professional, or CCEP. This certification is administered by the Compliance Certification Board.  Continued education is something I personally value and in all instances of my professional activities, it enhances not only my client work but also my decision-making as a manager of staff and as a board member of a health center. I recommend anyone in this field to pursue this or a similar certification.

In other news, 2018 seems to be flying by. I am keeping busy not only with career obligations but also with my volunteer efforts. We are seeking a new CEO for our health center, as our current leader is retiring. He has some pretty big shoes to fill, so if you know anyone with some HRSA experience and a penchant for New England living, don’t hesitate to send them my way. Really, is it almost March?


January Imperatives

A few thoughts during this quiet Sunday in a temperate January come to mind that I hope all readers consider:

  • Yes everyone has their feelings about the flu shot. I’m not here to preach about the vaccination as it’s a personal decision you make with your medical professional. However, as a human, it’s not only flu season we are dealing with but also a very miserable virus. It’s scary the number of reported casualties this season. If you or a family member is under the weather, get checked out. Here are some helpful tips on choosing the right setting for your medical care.
  • The first State of the Union Address delivered by President Trump will be this coming Tuesday, January 30. Anticipated themes include tax reform, border security, immigration, and the stock market. Tune in at 9PM Eastern.
  • On the local front, while Q4 2017 data is not finalized, I am hoping that accidental drug-related overdose deaths are on the decrease for our tiny state. Every live saved is a blessing and a gift that has slipped through another family’s fingers. Continue educating yourself and promoting recovery options for all.

Looking forward to a prosperous and healthy 2018 for everyone.


My brother died of a Fentanyl overdose this year. Next year, he will be included in all the charts and bar graphs showing the thousands of overdose deaths. You won’t see his name, but I will see it, and so will his mother and father and brother, burned on every chart, graph, and state map.

The top story on my bookmarked news page earlier today  was about President Trump declaring the opioid crisis a Public Health Emergency. It is now a mere hours later and the headline is now regarding talks of a major pharmacy player that may potentially puchase the nation’s third largest health insurer. It seems to me this crisis is reduced to the fleeting hashtag level of awareness – here today, gone tomorrow.

According to the Centers for Disease Control and Prevention, an average of one hundred and seventy five people in the United States died every day last year due to overdose. One hundred and seventy five families devastated a day.

Stats and colorful maps are fantastic eye-catching tools to raise visibility, but we are all Davids and this crisis is the Goliath. When do we stop the bleeding? Who should be held accountable for immediate changes? In my work, it is all about identifying root causes and Corrective Action Plans. We create a Beneficiary Impact Analysis when there is the hint of risk to plan enrollees. When can the collective Davids join up and bring this epidemic to the ground? When will Goliath collapse?

I close this with a link to Virginia Recovery Foundation. These good people educate family members on how to get loved ones the help they need, and your donation will honor my brother. Or, please give to your local community resources.