New Guidance on Evaluating Compliance Programs

While most everyone I speak with these days relies on the Centers for Medicare & Medicaid Services (CMS) Program Audit Protocol to review their compliance program effectiveness (CPE), it is imperative to review a compliance program through another lens.

The United States Department of Justice (DOJ) recently updated their guidance for prosecutors on the evaluation of a compliance program’s effectiveness. The three fundamental questions are as follows:

  1. Is the corporation’s compliance program well designed?
  2. Is the program being applied earnestly and in good faith (implemented effectively)?
  3. Does the corporation’s compliance program work in practice?

For anyone new to reviewing a compliance program, or if you are a compliance professional performing a self evaluation, the DOJ provides key considerations and questions to ask in order to make solid determinations on these questions. Tracer samples are one way to identify patterns, and that is core to CMS’ current methodology. However, I have discussed many of these DOJ-identified additional factors with clients recently:

  • Risk Assessment: are resources devoted disproportionately to low-risk issues?
  • Third Party Management: What are the actions and consequences of third party (vendor or delegate) misconduct?
  • Culture: Do top leaders set the tone to encourage compliance? Does Compliance have sufficient seniority and autonomy to perform their duties, and has the organization allocated sufficient funds for the function?

I mentioned in a previous post that “we are most comfortable in roads we’ve traveled over and over, and therefore might be more susceptible to distraction.” If you are using the CMS CPE protocol every year, consider revising your methodology with some frequency. The industry’s methods and recommendations are evolving; make sure you change with the times.  Enforcement actions will tell a story soon enough – do not become part of that story.

Please Read then Act: PRA Redefined

A site any compliance or operations professional should be monitoring regularly is the Paperwork Reduction Act (PRA) listing. This page is a gold mine if you are looking to shape what you need to implement later. If I could change PRA to stand for something else to illustrate the importance, it would be Please Read, then Act!

Typically, this is where the Centers for Medicare & Medicaid Services (CMS) posts proposed changes and requests for information or comment. For example, when the agency proposes to change Part D reporting technical specifications, the changes and supporting statements are posted on this site. This gives the public (you!) the opportunity to review and provide comment within a comment period. And it is not just Part D; you will find documents related to other programs such as Fee For Service Medicare, PACE, Exchange and Medicaid.

Let’s walk through an example. CMS posted their proposed changes and supporting statement for the Notice of Denial of Medical Coverage (or Payment) (NDMCP – those pesky denials). Upon review of the proposed changes, I identified two areas of opportunity. In one instance, there is room to further clarify language directed at a beneficiary filing an appeal, and in the other instance, there is opportunity to clarify the instructions to the plan. To submit comments electronically, I went to and found the document in question, hit the “Comment Now!” button and voilà – submitted.

Implementation is not simple. Do not get caught in a situation where you struggle with something confusing, arguably unreasonable, or impossible to complete. Take the opportunity to review this site often, or subscribe to the RSS feed to be notified more quickly. You may often find something the agency missed, or you may provide an improved solution that reduces burden on you, your organization, and your beneficiaries.

Draft 2020 Medicare Communications and Marketing Guidelines

On March 21, 2019, the Centers for Medicare & Medicaid Services (CMS) released the draft Medicare Communications and Marketing Guidelines for contract year 2020. The agency notes most changes and updates are clarifications based on feedback from stakeholders. Regulatory citations were also updated throughout the document.

Notable clarifications are outlined below. This year, CMS is seeking feedback on nine specific questions (outlined below the key changes). Circulate this summary to your key stakeholders so they can properly evaluate the impact of these draft changes. Comments are due on April 4, 2019 at 5:00 PM Eastern and must be entered through this link.

Key Changes

  • 30.3 Non-English Speaking Population: When translations are required for templates or model documents, the variable data must also be translated. For example, a coverage determination notice template cannot be in a non-English language and the custom denial populated in English.
  • 30.7 Prohibited Terminology/Statements: Clarification was made to provisions regarding what is prohibited for a Dual Eligible Special Needs Plan.
  • 60.1 Provider-Initiated Activities: CMS clarifies the list in this section are considered outside of the definition of marketing.
  • 70.1.3 Required Content: CMS requires a link to the provider directory on the Medicare Advantage landing page.
  • 80.1 Customer Service Call Center Requirements and Standards: CMS proposes hold time messages that’s promote the plan or include benefit information be submitted via HPMS, and clarifies hold time messages may not be used to sell other products.
  • 80.2 Customer Service Call Center Hours of Operations: CMS proposes separate phone lines or call centers established for the sole purpose of selling Plan products or enrollment are not required to comply with the customer service call center hours of operation standard. The standard is outlined in this section and is unchanged.
  • 90.1 Material Identification: MS provides clarification and notes if a third party, such as a PBM, creates member specific materials such as explanations of benefit on behalf of multiple organizations, it is acceptable to use the material ID for only one organization.
    • Point to ponder: This clarification would allow a PBM or other first tier, downstream or related entity (FDR) working with 15 plan sponsors to use the approved template of one plan sponsor. This may cause concern with confidentiality, whereby a plan sponsor may not want their contract number used as the template for all other FDR clients.
  • 90.2 Material Replacement: Clarification provided noting materials submitted as replacement files are subject to the same review period as the original material.
  • 100.3 Changes and Corrections to Existing Documents: Additional language has been added regarding delivery of hardcopy directories. Furthermore, CMS added the following: All providers listed in hardcopy or online provider directories must have current contracts with the organization to participate in the plan network. Directories provided during the AEP for the upcoming plan year must accurately and fairly represent the network for the upcoming plan year. If a provider is listed in a directory prior to the effective date of the contract, then the directory must note the effective date. Similarly, if a provider is confirmed to leave the network, then the directory must note the termination effective date.This is in addition to the organization’s responsibilities to provide individual, written notice under 42 CFR § 422.111(e) to patients when a provider is terminated from the network.
    • Point to ponder: Should organizations choose to list providers before their effective date, this could prove to be operationally burdensome as systems would require placement of a new date field. Furthermore, it is unclear how the agency would determine when a provider is “confirmed to leave the network”, therefore requiring a sponsor to note the termination effective date.
  • 110.7.1 Rapid Disenrollment: CMS clarified rapid disenrollment compensation recovery applies when a beneficiary uses OEP to make an enrollment change.
  • 110.8 Payments other than Compensation: CMS provides additional clarification on administrative payments, including examples of mileage or materials, but expects organizations to pay actual expenses when possible. Paid expenses must reflect a fair market value.

Specific Stakeholder Questions

  1. CMS is seeking feedback on marketing, as it relates to using the term “free” in marketing materials. CMS is also seeking comments on Plan/Part D Sponsor experience with product endorsements and testimonials.
  2. CMS is seeking comments on Plan/Part D Sponsor experience, as it relates to Plan Comparisons.
  3. CMS seeks your feedback on the changes made last year regarding Plan-initiated provider activities and marketing in a health care setting. Do you believe the current flexibilities are broad enough to allow beneficiaries to receive information about their plan choices while not disrupting health care services being provided?
  4. CMS seeks your feedback on the required disclaimers associated with the use of Star Ratings. Are there barriers associated with the current disclaimers that have prevented your organization from using the Star Ratings in your marketing materials in a manner you had desired?
  5. CMS has received feedback that our current marketing submission requirements may unduly impact organization that have a high degree of provider-plan integration. CMS welcomes your comments on provider-based activities and whether changes to our guidance are needed to better support co-branding relationships.
  6. CMS seeks comment on subsection 110.8 – Payments other than Compensation. Please provide comment on how our organization determines and pays the fair market value (FMV) of administrative costs to agents. CMS understands that a certain level of flexibility is needed in reimbursing administrative costs; however, we are concerned that too much flexibility may result in a rapid escalation of FMV amounts and/or result in administrative payment that are close to compensation levels. We welcome your feedback on how to address this potential outcome.
  7. CMS seeks comment on the impact, if any, of the January through March 31 Open Enrollment Period (OEP), on enrollment/disenrollment; the recoupment of agent/broker compensation based on rapid disenrollment; and if current guidance was clear regarding what marketing activities were allowable during the OEP.
  8. CMS seeks comment on the appropriateness of current Call Center timeliness requirements in subsection 80-1 – Customer Service Call Center Requirements and Standards. Specifically, CMS seeks feedback on the standards for average hold time, availability of TTY services, answering of incoming calls, and interpreter services.
  9. CMS seeks feedback on the Pre-enrollment checklist and welcomes any suggested changes.


CMP Methodology Comments Due April 15

If you are like most people I encounter these days, you don’t have a free moment to catch up on items which do not have a deadline of “TODAY”. Understandable, because there is a lot going on this quarter from financial audits to program audits to timeliness monitoring to everything else on your plate.

On March 15, the Centers for Medicare & Medicaid Services (CMS) released their revised Civil Money Penalty calculation methodology for comment (bottom of this page). The proposed changes include:

  • Clarifying how per determination standard penalties are calculated for Program of All-Inclusive Care for the Elderly organizations (which is “consistent with our statutory and regulatory authority”)
  • Proposing to add an aggravating factor for enrollees who never received their Part C services or Part D medications due to violation of program requirements
    • The section used to refer to delay/denial of drugs, but now includes reference to enrollee never receiving their Part C service or Part D medication. It makes sense as it steps up the severity of access to Part C services.
  • Changes to existing aggravating factors
    • Proposing to remove aggravating factors previously identified as common conditions in audit and enforcement reports
    • Proposing to remove the reference to Evidence of Coverage from an aggravating factor
    • Proposing to change reference from 24 hours to one day relative to the aggravating factor for delay/denial of prescription drugs for acute conditions
  • Proposing a method for increasing penalty amounts, whereby the agency tracks the accrual of penalty amounts each year, but updates the standard penalty amount no more often than every three years.

Additional nuanced changes not included in the introductory memo include:

  • A note confirming the agency is also applying this new methodology to Medicare Medicaid Plans, Cost Plans, and PACE organizations and inclusion of regulatory authority references
  • A note reserving the right to use different methodology as permitted by law depending on various circumstances
  • A change in reference to regulation for “a complete list of the reasons that may lead to a determination” to “examples of bases that may lead to a determination”
  • Clarification that CMS may calculate a per determination penalty if the per enrollee impact cannot be analyzed (meaning, you provided the Impact Analysis but CMS cannot analyze it)
  • Reference to access to enrollee rights under Beneficiary Impact, namely the appeals process, has been included in examples of a sponsor’s deficiency which could adversely affect the enrollee physically
    • This could be seen as a significant change, or as further clarification of what is meant by Beneficiary Impact. The section includes the more direct examples of not receiving a medication or service. However, if a beneficiary is not aware a service has been denied, in general, the provider simply does not provide or order the service. In the case of a claim denial, the member may be inappropriately billed. Appeal rights are warranted in both cases, and plans should be prepared to demonstrate delivery of these rights come audit time.
  • A proposal to take into account whether sponsor substantially mitigated adverse impact to beneficiaries; in those cases, CMS may remove those where impact was substantially mitigated
    • An example is provided, when the beneficiary receives medication within one day of initial rejection.
  • Per enrollee aggravating factors now includes reference to inappropriate delay/denial of “appeal rights”
    • Think about how multiple aggravating factors will be taken into account using the example provided in the document. For example: if there was a delay in completing a Part D coverage determination, appeal rights were not communicated, but the drug does not generally require access within one day, yet this was a prior offense… if it is not clear to you, then request additional examples or further clarification.

If your organization plans on providing feedback, asking clarifying questions, or providing general comment, make sure you do so in an organized fashion. Don’t have three different people emailing CMS  – collaborate, collect, and submit to with the subject line 2019 CMP Methodology Comments. The due date/time is April 15, 2019 at 11:59PM Eastern.

Download: Prescription for Compliance Wellness

The Health Care Compliance Association (HCCA) held their annual Managed Care Compliance Conference from January 27-30, 2019.

From my sea of notes, I provide you key soundbites along with follow-up questions to help you spark internal discussion. Consider this your prescription for compliance wellness to help you see your compliance program through a different lens and make improvements using best practices and innovation. And don’t worry, you don’t need an OTC benefit to download – just a willingness to get healthy:

Send me a download link

Name *

Email *

Materials from sessions are made available by HCCA here. Thanks to all presenters for their preparation and delivery and for helping the industry kick off the new year with relevant content.

Compliance Today Article on Risk Assessment

Recently I penned an article for Compliance Today about the obligation to perform a risk assessment as part of Medicare Advantage and Part D operations. Compliance Today is the monthly, members-only publication of the Health Care Compliance Association. As the content author, I am permitted to provide access the full article on this platform.

Those new to a compliance role will learn how this requirement came to be. For the experienced compliance professional, I provide factors, questions, and techniques to consider for incorporation into a compliance program.

February 2019 Compliance Today, Regan Pennypacker

Copyright 2019 Compliance Today, a publication of the Health Care Compliance Association (HCCA).

Compliance Controls in Spotlight

As Oscar season approaches, who can forget the very serious face on Jordan Horowitz as he held up the correct winner for Best Picture for the 89th Academy Awards? Despite powerhouse accountancy firm PricewaterhouseCoopers (PwC) at the helm, things took a wrong turn.

Jordan Horowitz Moonlight

So what happened? News outlets and social media were quick to focus on presenters Warren Beatty and Faye Dunaway. However, as the layers of onion were peeled, the public learned about the root causes: prohibited social media use, mistaken envelope delivery, and a significant delay in addressing the issue, which allowed the wrong producers about two minutes to give thanks in a bubble of blissful ignorance.

PwC had been the firm of choice of the Academy for over 80 years when this happened, and though this issue had only occurred one other time, it proves even established, reputable systems can break down. From the outside looking in, you might think handing the right envelope to the right person at the right time is a seemingly simple task. You would think the same about driving close to home, which according to many surveys and insurance data, is where most accidents occur. How are these two situations connected? Because we are most comfortable in roads we’ve traveled over and over, and therefore might be more susceptible to distraction.

So often, corrective action plans (CAPs) do not address the true root causes. In this example, the public was made aware of a few factors, but PwC may have identified even more. Was there a relaxed culture around adherence to protocol? Were there outside factors that distracted the two PwC partners onsite? Whatever was found, PwC took full responsibility for the issue and created a CAP, outlining a multi-step plan to avoid this type of issue from recurring. In addition, the Academy took ownership and will regularly review PwC’s policies and procedures to make sure something like this never happens again.

Compliance professionals will see correction, detection, and prevention controls all over this. If any Tinseltown executives are reading, I am happy to provide my services to do some CAP validation during the big day.

Past Performance: There is Still Time to Get it Wrong

Applying for a 2020 Part C, Part D, or Cost plan? CMS will post final past performance methodology soon, most likely early February, but one thing that is final is the past performance review period is down from 14 months to 12. There is reason not to rest easy.

Applicants had complained that 14 months was unfair, stating non-compliance that occurs during January and February of a given year is counted against them in 2 consecutive past performance review cycles, while non-compliance occurring in all other months is counted in only one review cycle. The agency previously believed a full contract year was necessary to capture all relevant aspects of an organization’s performance, but they have determined there is little value on counting a true contract year.

Starting with the 2020 applications, CMS will review the previous 12 months, counting the application deadline month (February) in its entirety; therefore, the review period will be March 1 of previous year to end of February when application is due.

For those applicants who have already counted your points, do not rest on laurels this month or next month. If your organization incurs additional points while you are working so hard on your application (think program audit CMPs and ad-hoc CAPs), it could derail your efforts for another year.

Breaking: 2019 Program Audit Protocol

Let’s get right into it. Last night, the Centers for Medicare & Medicaid Services (CMS) provided detailed information regarding changes to the 2019 Program Audit process. Here, I break down the memo and briefly explain impact.

  • CMS incorporated validation audit updates to the Program Audit Validation-Close Out document. No surprises here as this information was previously communicated in the Call letter of the 2019 Final Announcement.
  • Audit notices are scheduled to be sent between the months of March and July, 2019. This window is two months shorter than the 2018 window, which ended in September. While teams can plan accordingly based on this information, CMS may issue an ad hoc or unplanned audit notice based on a tip, allegation, or newly identified risk. Do not let July pass by and start breathing a sigh of relief. Talk to your Compliance Officers: CMS account managers continually request information regarding plan performance and significant issues. These matters may be referred to the Central Office for further action.
  • The agency is suspending the collection of Supplemental Questionnaires for Coverage Determinations, Appeals, and Grievances (CDAG), Part C Organization Determinations, Appeals, and Grievances (ODAG), and Medicare-Medicaid Plan (MMP) Service Authorization Requests, Appeals, and Grievances (SARAG). They note the info is relevant when conducting root cause or pulling together impact analyses, so best bet is to still have them ready.
  • Arguably the most significant change, modifications are being made to the methodology to review misclassification of beneficiary calls, including the suspension of collecting the Call Log tables. Instead, CMS will review a sponsor’s oversight of the call routing process during its review of Compliance Program Effectiveness (CPE). In my recent experience, the collection of call log data as well as the classification of calls continued to frustrate sponsors. However, the targeting of call log samples was one of the most eye-opening and direct avenues to identify misclassification. It also shed light on opportunities to improve customer service overall, especially when it came to listening to calls handled by a vendor. Shifting from targeted samples to a review of process appears to be a step backwards. Since processes vary sponsor to sponsor, listening to targeted calls was a consistent method to uniformly measure a sponsor’s compliance.
  • Speaking of CPE, CMS will suspend some data collection including the Self-Assessment Questionnaire and some universe data points in the review of the compliance program. The agency realized some of this information was either covered in tracer samples, not pertinent to identifying increased risk of non-compliance or no longer required. It is not expected this will significantly reduce sponsor burden, however it does demonstrate the agency is continually evaluating methodology to make it more meaningful.
  • Additional program audit elements suspended to reduce overlap include the Website Review, previously conducted in Formulary Administration, and Enrollment Verification in Special Needs Plan – Model of Care.
  • Part D, take note: CMS will be evaluating the implementation of the Comprehensive Addiction and Recovery Act (CARA) of 2016 through the program audit process. How so? CARA allows sponsors to limit “at risk beneficiary” access to coverage for frequently abused drugs via drug management (DM) programs starting next year. The agency is clarifying that these decisions made under DM programs are not defined as coverage determinations, and therefore will not be collected in data universes. However, at-risk redeterminations (appeals) will be collected as part of the appeals tables 6 and 8 (Standard and Expedited Redeterminations, respectively).
  • Timing is everything, and sponsors should welcome the anticipation of the February, 2019 release of the final appeals guidance. While CMS acknowledges they do not anticipate significant changes from the draft to the final, they note they will provide opportunity to the industry to implement the updates before auditing these changes to compliance standards. Once the final guidance is released, CMS notes they will communicate how and when any audit standards will be affected. Keep in mind, audit review periods are retrospective. Ideally, CMS would provide a future effective date for the appeals guidance so that sponsors can fully evaluate and implement changes. This is done in the annual enrollment guidance as well as for many provisions in the Marketing Guidelines, so why not for key appeals guidance? Time will tell.

We still wait for the 2020 Program Audit Protocol 30-day notice for public comment to be released. All in all, reduction of burden on sponsors and focus on patient care seem to be a factors in implementing these changes.

What to do next: Sponsors should evaluate what changes need to be made to current audit preparation processes. While some items are easily implemented (such as the suspension of data collection), questions remain. Will CMS be reviewing the call routing process desktop procedures only, or will they solicit training tools and other procedures? Will vendor call routing processes be collected and reviewed, or will vendors be required to explain their processes during CPE week? Will the appeals chapter really be released in February? Contact me to schedule a call to discuss what these changes mean for your own audit planning and general oversight. I’ll be caffeinated and ready!

Readiness: A Year-Round Effort

A solid, compliant sponsor isn’t perfect, but they know how to react swiftly when the unexpected arises, and it will come up year-round. Take it from recent enforcement notices issued by the Centers for Medicare & Medicaid Services (CMS).

Within a matter of days, the agency first imposed and then lifted an immediate suspension of enrollment and marketing sanction on a Prescription Drug Plan (PDP) sponsor new to the market. Operated by a highly reputable organization with over 100 years in the finance and insurance industries, the enrollment and marketing freeze was imposed due to the sponsor not providing CMS with evidence of a valid license within the state of Florida. The sponsor had disclosed to the agency that the state had recently informed them an amendment was required for their license to be complete. Therefore, based on what was in effect with the state, the sponsor was not in compliance with the Part D regulation 42 C.F.R. § 423.401(a) which requires each PDP sponsor have a license under state law as a risk bearing entity eligible to offer health insurance or health benefits coverage.

The issue was quickly remedied when the Office of Insurance Regulation provided notice to CMS it had approved the additional line of business on the sponsor’s license. As a result, CMS lifted the sanction. The requirement to be properly organized and licensed under state law is confirmed upon submission of a Part D application, unless a waiver is requested and approved. That should generally be the end of it, but in this sponsor’s case, there was more to come.

As illustrated by this recent enforcement action, things you think are in place might not be, and no checklist can prepare you for those instances. Those most successful in administering government programs are honest about what they know, unafraid to pick up the phone and verify, and driven to implement effective corrections.