On July 13, 2022, the Office of the Medicaid Inspector General (OMIG) issued a proposed Rulemaking to implement statutory changes to Social Services Law §363-d adopted in the State Fiscal Year 2020-21 Enacted Budget (Chapter 56, Part QQ) and Medicaid program integrity reform initiatives of the MRT II related to (i) provider compliance programs; (ii) Medicaid managed care plan fraud, waste and abuse prevention programs; and (iii) the obligation to report, return and explain Medicaid overpayments through OMIG’s Self-Disclosure program. The proposed rule would repeal and replace 18 N.Y.C.R.R. 521 and has three Subparts. Public comments on the proposed rule will be accepted until Sept. 11, 2022 and should be sent to rulemaking@omig.ny.gov.
Proposed Subpart 521-1 significantly builds upon compliance program requirements set forth in New York’s Social Services Law §363-d and the existing Part 521 Regulations. The proposed Subpart would alter the definition of “Required Provider,” to include Medicaid Managed Care or Long-Term Care Providers (MMCOs), who are not covered by the existing Regulation, and exclude small business that claim or receive less than $1 million in Medicaid payments, a significant change from the current $500,000 threshold. Key additions to the requirements of a Required Provider’s “effective compliance program,” are noted below. Required Providers will need to review and update their compliance programs to ensure they meet these new requirements, and MMCOs previously not covered by the Regulation will now need to develop and implement an effective compliance program to ensure continued receipt of Medicaid payments.1
Subpart 521-2 specifically applies to MMCOs and their fraud, waste and abuse prevention programs, and is in addition to regulations enforced under 10 N.Y.C.R.R. 91-1.21 and 11 N.Y.C.R.R. 86.6.2 While the existing Regulations apply only to MMCOs with 10,000 or more enrollees, Subpart 521-2 applies to all MMCOs regardless of enrollment. The most significant addition is the requirement that MMCOs with an enrolled population of 1,000 or more establish a full-time Special Investigation Unit (SIU) that employs one full-time lead investigator and one director. Further, the SIU must employ one full-time investigator per 60,000 enrollees for MMCOs and one fulltime investigator per 6,000 enrollees for managed long-term care plans—unless alternative staffing requirements are approved by OMIG. Once effective, MMCOs may see increased costs associated with staffing the SIU and other compliance-related positions.
Subpart 521-3 essentially codifies New York’s Social Services Law §363-d (7), effective as of April 1, 2020. This Subpart applies to all “Persons,” defined as (i) a Medicaid provider pursuant to §504.1 of the Regulations (“any person who has enrolled under the medical assistance program to furnish medical care, services, or supplies[.]”) and (ii) MMCOs and any subcontractors or network providers of an MMCO. Subpart 521-3, as proposed, does not significantly change what is already required by law regarding Medicaid program overpayments; however, under this revision it appears all identified overpayments are to be reported and repaid exclusively through the self-disclosure mechanism. Other key provisions of the proposed Subpart can be found below.
Notable revisions to Subpart 521-1, Compliance Programs
Required Providers' compliance programs must have written policies that, among other requirements, identify government laws and regulations applicable to risk areas and establish a duty to refuse to participate in and report any unethical or illegal conduct to compliance officer. Required Providers must now annually review written policies, with specific procedures for doing so outlined in the Subpart.
Required Providers must retain records relating to their compliance program for six years and MMCOs for 10 years.
A Required Provider’s compliance program must now explicitly consider 10 risk areas , with the addition of (i) ordered services and (ii) contractor, subcontractor, agent, or independent contractor oversight. For MMCO’s, additional risk areas to be addressed include: (i) compliance with terms of the MMCOs contract with the departments, (ii) cost reporting, (iii) submission of encounter data to departments, (iv) network adequacy and contracting, (v) provider and subcontractor oversight, (vi) underutilization, (vii) marketing, (viii) provision of medically necessary services, (ix) payments and claims processing and (x) statistically valid service verification.
Required Providers must designate a compliance officer and compliance committee. Eligibility and reporting structure, among other items, are contained in the Subpart along with detailed responsibilities of each and the need to establish a compliance work plan which outlines the proposed strategy for meeting regulatory requirements.
Requirements regarding Required Providers’ training programs, including a requirement that the trainings occur at least annually, and that Required Providers develop and maintain a training plan, which is further outlined in the Subpart.
Requirements for establishing an effective monitoring and auditing system, which include the performance of ongoing internal and external audits, reviewing results for risk areas, and sharing results with appropriate officers.
Requirements for establishing lines of communication, which include implementing a method for anonymous reporting of potential fraud.
Required Providers must undertake an annual review of entire compliance program. Requirements for the review are contained with the Subpart.
Requirement that Required Providers establish procedures for promptly responding to compliance issues, which include the documentation of any investigation and disciplinary action; and obligation of Required Providers to report any violation of state of federal law, rule or regulation to the appropriate entity and to report and repay any identified Medicaid overpayments.
Notable additions to Subpart 521-2, Fraud, Waste and Abuse Prevention Program
SIU eligibility requirements and reporting structure, as well as its duty to annually prepare a work plan, which must explicitly consider MMCOs risk areas, among other items.
Requirement that MMCOs audit, investigate, and report cases of fraud, waste or abuse to OMIG, and the components of such audits, including the requirement that audits be of clinical and billing records.
Requirements regarding MMCOs obligation to report, return and explain overpayments within 60 days of identification and to post on the MMCO website information on how and where to report, return and explain overpayments.
Requirement that MMCOs develop a fraud, waste and abuse detection procedures manual; public awareness program; and prevention plan, which is to be submitted to OMIG within 90 days of the proposed rule becoming effective or upon signing a new contract with NYSDOH; and requirements regarding an annual report that must be submitted and filed with OMIG.
Subpart 521-3 Self-Disclosure Program
While this Subpart will not change the requirements for “Persons” to return, report and explain Medicaid overpayments, Medicaid providers should re-familiarize themselves with the requirements and procedures contained in the new Subpart. Important provisions include:
Requirements of a Self-Disclosure Statement, which is how a person applies to the Self-Disclosure Program
Procedures for applying to repay through installment payments or to waive interest on repayments.
Procedures by which OMIG reviews self-disclosures; procedures governing the return of the overpayment, after final review, to OMIG and other appropriate entities.
Explanation of all enforcement penalties available for non-compliance with the dictates of the Program.
The foregoing is a non-exhaustive compilation of the key changes contained in OMIG’s proposed rule. Should you have questions or are seeking assistance, please contact Catherine A. Graziose, John F. Darling, Gabriel S. Oberfield, or any of the attorneys with whom you regularly work.
The attorneys would like to give credit to Bond Summer Law Clerk, Emily Ahlqvist, who assisted in co-authoring this memo.
1 The proposed Regulations explicitly state that compliance with Subpart 521-1 is a condition for receipt of Medicaid Payments.
2 If the proposed Subpart conflicts with either existing Regulation, it will apply only to MMCOs participation in the Medicaid Program.
On July 13, 2022, the Office of the Medicaid Inspector General (OMIG) issued a proposed Rulemaking to implement statutory changes to Social Services Law §363-d adopted in the State Fiscal Year 2020-21 Enacted Budget (Chapter 56, Part QQ) and Medicaid program integrity reform initiatives of the MRT II related to (i) provider compliance programs; (ii) Medicaid managed care plan fraud, waste and abuse prevention programs; and (iii) the obligation to report, return and explain Medicaid overpayments through OMIG’s Self-Disclosure program. The proposed rule would repeal and replace 18 N.Y.C.R.R. 521 and has three Subparts. Public comments on the proposed rule will be accepted until Sept. 11, 2022 and should be sent to rulemaking@omig.ny.gov.
Proposed Subpart 521-1 significantly builds upon compliance program requirements set forth in New York’s Social Services Law §363-d and the existing Part 521 Regulations. The proposed Subpart would alter the definition of “Required Provider,” to include Medicaid Managed Care or Long-Term Care Providers (MMCOs), who are not covered by the existing Regulation, and exclude small business that claim or receive less than $1 million in Medicaid payments, a significant change from the current $500,000 threshold. Key additions to the requirements of a Required Provider’s “effective compliance program,” are noted below. Required Providers will need to review and update their compliance programs to ensure they meet these new requirements, and MMCOs previously not covered by the Regulation will now need to develop and implement an effective compliance program to ensure continued receipt of Medicaid payments.1
Subpart 521-2 specifically applies to MMCOs and their fraud, waste and abuse prevention programs, and is in addition to regulations enforced under 10 N.Y.C.R.R. 91-1.21 and 11 N.Y.C.R.R. 86.6.2 While the existing Regulations apply only to MMCOs with 10,000 or more enrollees, Subpart 521-2 applies to all MMCOs regardless of enrollment. The most significant addition is the requirement that MMCOs with an enrolled population of 1,000 or more establish a full-time Special Investigation Unit (SIU) that employs one full-time lead investigator and one director. Further, the SIU must employ one full-time investigator per 60,000 enrollees for MMCOs and one fulltime investigator per 6,000 enrollees for managed long-term care plans—unless alternative staffing requirements are approved by OMIG. Once effective, MMCOs may see increased costs associated with staffing the SIU and other compliance-related positions.
Subpart 521-3 essentially codifies New York’s Social Services Law §363-d (7), effective as of April 1, 2020. This Subpart applies to all “Persons,” defined as (i) a Medicaid provider pursuant to §504.1 of the Regulations (“any person who has enrolled under the medical assistance program to furnish medical care, services, or supplies[.]”) and (ii) MMCOs and any subcontractors or network providers of an MMCO. Subpart 521-3, as proposed, does not significantly change what is already required by law regarding Medicaid program overpayments; however, under this revision it appears all identified overpayments are to be reported and repaid exclusively through the self-disclosure mechanism. Other key provisions of the proposed Subpart can be found below.
Notable revisions to Subpart 521-1, Compliance Programs
Required Providers' compliance programs must have written policies that, among other requirements, identify government laws and regulations applicable to risk areas and establish a duty to refuse to participate in and report any unethical or illegal conduct to compliance officer. Required Providers must now annually review written policies, with specific procedures for doing so outlined in the Subpart.
Required Providers must retain records relating to their compliance program for six years and MMCOs for 10 years.
A Required Provider’s compliance program must now explicitly consider 10 risk areas , with the addition of (i) ordered services and (ii) contractor, subcontractor, agent, or independent contractor oversight. For MMCO’s, additional risk areas to be addressed include: (i) compliance with terms of the MMCOs contract with the departments, (ii) cost reporting, (iii) submission of encounter data to departments, (iv) network adequacy and contracting, (v) provider and subcontractor oversight, (vi) underutilization, (vii) marketing, (viii) provision of medically necessary services, (ix) payments and claims processing and (x) statistically valid service verification.
Required Providers must designate a compliance officer and compliance committee. Eligibility and reporting structure, among other items, are contained in the Subpart along with detailed responsibilities of each and the need to establish a compliance work plan which outlines the proposed strategy for meeting regulatory requirements.
Requirements regarding Required Providers’ training programs, including a requirement that the trainings occur at least annually, and that Required Providers develop and maintain a training plan, which is further outlined in the Subpart.
Requirements for establishing an effective monitoring and auditing system, which include the performance of ongoing internal and external audits, reviewing results for risk areas, and sharing results with appropriate officers.
Requirements for establishing lines of communication, which include implementing a method for anonymous reporting of potential fraud.
Required Providers must undertake an annual review of entire compliance program. Requirements for the review are contained with the Subpart.
Requirement that Required Providers establish procedures for promptly responding to compliance issues, which include the documentation of any investigation and disciplinary action; and obligation of Required Providers to report any violation of state of federal law, rule or regulation to the appropriate entity and to report and repay any identified Medicaid overpayments.
Notable additions to Subpart 521-2, Fraud, Waste and Abuse Prevention Program
SIU eligibility requirements and reporting structure, as well as its duty to annually prepare a work plan, which must explicitly consider MMCOs risk areas, among other items.
Requirement that MMCOs audit, investigate, and report cases of fraud, waste or abuse to OMIG, and the components of such audits, including the requirement that audits be of clinical and billing records.
Requirements regarding MMCOs obligation to report, return and explain overpayments within 60 days of identification and to post on the MMCO website information on how and where to report, return and explain overpayments.
Requirement that MMCOs develop a fraud, waste and abuse detection procedures manual; public awareness program; and prevention plan, which is to be submitted to OMIG within 90 days of the proposed rule becoming effective or upon signing a new contract with NYSDOH; and requirements regarding an annual report that must be submitted and filed with OMIG.
Subpart 521-3 Self-Disclosure Program
While this Subpart will not change the requirements for “Persons” to return, report and explain Medicaid overpayments, Medicaid providers should re-familiarize themselves with the requirements and procedures contained in the new Subpart. Important provisions include:
Requirements of a Self-Disclosure Statement, which is how a person applies to the Self-Disclosure Program
Procedures for applying to repay through installment payments or to waive interest on repayments.
Procedures by which OMIG reviews self-disclosures; procedures governing the return of the overpayment, after final review, to OMIG and other appropriate entities.
Explanation of all enforcement penalties available for non-compliance with the dictates of the Program.
The foregoing is a non-exhaustive compilation of the key changes contained in OMIG’s proposed rule. Should you have questions or are seeking assistance, please contact Catherine A. Graziose, John F. Darling, Gabriel S. Oberfield, or any of the attorneys with whom you regularly work.
The attorneys would like to give credit to Bond Summer Law Clerk, Emily Ahlqvist, who assisted in co-authoring this memo.
1 The proposed Regulations explicitly state that compliance with Subpart 521-1 is a condition for receipt of Medicaid Payments.
2 If the proposed Subpart conflicts with either existing Regulation, it will apply only to MMCOs participation in the Medicaid Program.
