Page 14
health care businesses affected by the inappropriate conduct in which the health care provider is involved, all efforts by the health care provider to prevent a recurrence of the incident or practice in the affected division as well as in any related health care entities (e.g., new accounting or internal control procedures, increased internal audit efforts, increased supervision by higher management, or additional training). • Description of any disciplinary action recommended against corporate officials, employees and First-Tier, Downstream and Related Entities as a result of the matter. • Description of appropriate notices, if applicable, provided to other Government agencies, (e.g., Internal Revenue Service, AHCA, CMS or its designee(s) etc.) in connection with the disclosed matter, including, if applicable, a voluntary self-disclosure. III. Final Report Upon conclusion of the investigation, the Compliance Officer shall deliver to the CEO a report containing the investigation findings, and, if applicable, recommendations for corrective and disciplinary actions. In some instances, appropriate corrective action will be outside the control of any one manager. In these instances, the Compliance Officer will organize a meeting of the appropriate staff, including, if appropriate, the staff of applicable First-Tier, Downstream and Related Entities, to create a working group to address the issue. Depending on the issues presented, it may be appropriate for a Task Force to assume primary responsibility for coordinating this response. Violations of the Code of Conduct and/or Compliance Plan may result in discipline ranging from warnings and reprimand to discharge or, where appropriate, informing the relevant government authorities. Employees will be informed of the violation(s) against them and will be given an opportunity to defend their actions before any disciplinary action is imposed. In addition, managers and supervisors may be sanctioned for failure to adequately instruct their subordinates or for failing to detect noncompliance with applicable policies and legal requirements, where reasonable diligence on the part of the manager or supervisor would have led to the discovery of any problems or violations and given FHCP the opportunity to correct them earlier. Compliance Plan 5 - 3 Revised December 12, 2018 Once disciplinary or corrective action has occurred, the Compliance Officer will update the case file to include appropriate notations documenting the resolution of the case. Within 15 days of initiation of corrective action, the individual who initiated the report shall be notified of the outcome of the investigation. Compliance Plan 6 - 1 Revised December 12, 2018 RISK ASSESSMENT, WORKPLAN, MONITORING AND AUDITING I. Risk Assessment FHCP shall conduct a formal baseline assessment of all major compliance and FWA risk areas. FHCP shall take into account all Medicare business operational areas with each area being assessed for the types and levels of risk the area presents to FHCP and its Medicare program. Factors that FHCP may consider in determining the risks associated with each area include, but are not limited to: • Size of department; • Complexity of work; • Amount of training that has taken place; • Past compliance issues; and • Budget. Areas of particular concern for FHCP’s Medicare Parts C and D activities include, but are not limited to, credentialing, quality assessment, appeals and grievance procedures, benefit/formulary administration, transition policy, protected classes policy, utilization management, accuracy of claims processing, detection of potentially fraudulent claims, and vendor oversight and monitoring. FHCP’s approach to risk monitoring and allocation of resources will be based on the risk of noncompliance. Risk of noncompliance may be assessed through: • Management interviews • Reports by employees • Results of employee surveys • Observed and/or reported incidents or conditions • Correspondence from government agencies and paying agents • Model compliance plans, fraud alerts and advisories issued by enforcement agencies • Work plans and audit reports of government agencies • Results of internal or external audits • Compliance industry publications Risks identified through the risk assessment will be ranked to determine which risk areas will have the greatest impact on FHCP and/or Medicare program beneficiaries and to prioritize the monitoring and auditing strategy accordingly. FHCP is aware that risks change and evolve with changes in laws, regulations, CMS requirements and operational matters. Therefore, FHCP’s review of potential risks of noncompliance and FWA shall be ongoing and include periodic reevaluation of the accuracy of the baseline assessments. Risk areas identified through CMS audits and oversight, as well as through FHCP’s own monitoring, audits, and investigations are considered priority risks. The results of FHCP’s risk assessments will be considered during the development of the compliance monitoring and auditing work plan. Compliance Plan 6 - 2 Revised December 12, 2018 II. Compliance Work Plan Risk assessment results will be considered in the development of FHCP's monitoring and auditing work plan. The work plan may include: • The audits to be performed; • Audit schedules, including start and end dates • Announced or unannounced audits; • Audit methodology; • Necessary resources; • Types of Audit: desk or onsite; • Person(s) responsible; • Final audit report due date to Compliance Officer; and • Follow up activities from findings. FHCP has included in its Compliance Plan a process for responding to all monitoring and auditing results where non-compliance was found. Follow up reviews of areas found to be noncompliant will be performed to ensure that the implemented corrective actions have fully addressed the underlying problem. Corrective action and follow-up should be led or overseen by the Compliance Officer and assisted, if desired, by the Compliance Department staff, and will include actions such as reporting findings to CMS or to the NBI MEDICs, if necessary.III. Monitoring and Auditing The Compliance Officer shall be responsible for monitoring and auditing the organization’s processes to ensure adherence to regulatory standards and FHCP’s administrative policies and procedures. Monitoring and auditing shall be ongoing and may focus on areas such as: • Fraud and abuse issues, e.g., purchasing (including payment policies and discounts); relations with physicians and charitable donations, prescription drug billing and payment practices; • Marketing and sales practices. • Food and Drug Administration and prescription drug integrity issues; • Third party billing practices, pricing practices (including transparency of prescription drug pricing), contractual relationships, and reporting and record keeping practices; • Accuracy and completeness of data submitted to government health care programs; • Regulatory compliance, e.g., claims processing, enrollee grievances, coverage determinations and appeals, accurate premium and cost-sharing charges; • Department of Health and Human Services Office of the Inspector General list of excluded and debarred individuals and entities screening pre-employment or engagement and monthly thereafter • Downstream, and Related Entities • Enrollment and Disenrollment Issues • Marketing Materials and Personnel • Over/underutilization and Quality of Care review • Anti-Kickback Statute and other Inducements • Anti-Dumping • Formulary Development, Updating, and Implementation In the event that an area of potential risk is