Page 15
identified, either through a monitoring activity or a report to the Compliance Officer, an investigation of the suspected practice shall promptly be initiated. Investigation activities shall be undertaken under the supervision of the Compliance Officer. The investigation findings will be kept confidential to the maximum extent permitted by law. Investigations are described in Section 5-Allegations of this Plan. Compliance Plan 6 - 4 Revised December 12, 2018 IV. External Audits External audits may be initiated at the request of Leadership, the Compliance Committee, government agencies, or non-government payers. A. Audits Initiated by Compliance Committee or Leadership: Examples of audits that may be initiated by the Compliance Committee or FHCP’s Management include: • HEDIS reporting • State of Florida Quality Indicator reporting • Financial audits • Medical record chart master review • One-time reviews in risk areas requiring specialized expertise, such as risk adjustment data submissions B. Selection of Third-Party Auditors/Consultants/Reviewers For external audits initiated by the Compliance Committee or management, the following guidelines should be followed: 1. Auditors should be independent of physicians, pharmacists and line management 2. Auditors should utilize generally recognized authoritative sources in conducting their reviews, such as: • All Federal and State regulatory guidelines • The National Center for Health Care Statistics • CMS Administration Guidelines • CMS Risk Adjustment Data Training for Medicare Advantage Organizations • Medicare Prescription Drug Benefit Manual and other instructions and guidance issued by CMS in connection with Medicare Part D • Medicare Managed Care Manual and other instructions and guidance issued by CMS in connection with the Medicare Advantage Program • American Association of Certified Public Accountants (AICPA) Guidelines • National Association of Insurance Commissioners (NAIC) Guidelines • National Committee for Quality Assurance (NCQA) HEDIS Guidelines 3. The audit firm should utilize appropriately credentialed and experienced individuals to conduct reviews. Issues to consider in evaluating credentials include: • Professional designations (RHIA, RHIT, CGS, CPA, MAA, and other professional licenses) • Expertise with the subject matter • Experience • Longevity with the company Compliance Plan 6 - 5 Revised December 12, 2018 C. Engagement of third-party auditors/consultants/reviewers 1. All compliance audits by third parties should be subject to a written agreement or engagement letter. The agreement or engagement letter should include: • Language requiring the work to be performed in a professional and workmanlike manner; • A representation that the firm's personnel assigned to the work are properly trained and have appropriate expertise, e.g., substantive knowledge of the applicable laws and regulations; • A representation that any advice given will be consistent with applicable state and federal laws and regulations, and that the reviewer will immediately notify management of information which suggests that the advice may be incorrect or has been challenged by governmental authorities; • A provision requiring the reviewer to assist the organization in defending allegations of improper conduct based on the review as advice, in whole or substantial part; • A representation (and proof) that the reviewer carries errors and omissions insurance covering negligent acts or intentional misconduct by its employees or agents; • A confidentiality statement whereby the auditors will not disclose the results of their audit except to designated FHCP personnel; • A requirement that they provide a written report of their findings that identifies problem areas and recommended corrective action and that such written report will be addressed to the CEO of Florida Health Care Plan, Inc. • Reference to generally accepted standards for conducting audits; Follow-up reviews to verify that corrective actions have been implemented successfully; • A contractor agreement to pay defense costs related to the organization's adherence to the contractors’ advice. 2. The contract should not severely restrict the time within which claims under the contract can be made. Limitation of liability clauses and warranty disclaimers should be reviewed carefully. 3. If the review involves the identification of payment errors, the review should be designed to identify both underpayments and overpayments. The audit objectives must not include "optimizing" or "maximizing" revenue or reimbursement, but rather "correct" reimbursement. 4. The engagement must not provide for a contingent fee or fee based on revenue, or other incentives to withhold information regarding overpayments. The audit should include a review of internal policies and procedures. Compliance Plan 6 - 6 Revised December 12, 2018 D. Conduct of third-party audits/reviews 1. Audit scope should address known areas of risk identified internally, as well as areas that are the focus of attention by the fiscal intermediary or carrier, MEDICs, law enforcement agencies, and federal or state agencies, including CMS, OIG, AHCA, and DFS 2. The audit should be conducted using sampling protocols that are statistically valid, unbiased, and likely to identify variations from an established baseline. 3. Audit techniques to consider include: • On-site visits; • Desk-top audits; • Interviews with personnel, including First-Tier, Downstream and Related Entities, as applicable, involved in management, operations, coding, claim development and submission, patient care, and other relevant activities; • Interviews with personnel, including First-Tier, Downstream and Related Entities, as applicable, involved in enrollment, marketing, member services, member grievance, coverage determinations and appeals, and other related activities; • Questionnaires developed to solicit impressions of a broad cross-section of the organization's employees and contractors; • Reviews of medical and financial records and other source documents that support: - Payment of medical and prescription drug claims - Actuarial basis for bid submissions - Medical records and encounter data supporting member risk adjustment data submissions - Benefit tracking, including application of correct cost-sharing amounts - Member eligibility • Reviews of written materials and documentation prepared by the different divisions of the organization; and • Trend analyses, or longitudinal studies, that seek deviations, positive or negative, in specific areas over a given period. V. Government Audits, Investigations, Interviews, and Searches It is the policy of FHCP to comply fully with all of the complicated rules and regulations governing healthcare entities, including all Medicare Advantage and Part D laws, regulations, CMS instructions and guidance. Nevertheless, FHCP acknowledges that government health care regulations and their enforcement are very complex areas of the law. One purpose of the Compliance Plan is to provide a uniform method for FHCP to respond to any government employee (Federal or state) who contacts FHCP for information. Additionally, the federal and state governments have made the investigation and prosecution of health care fraud one of their highest priorities and have proposed many new initiatives for identifying fraudulent practices. A number of these initiatives include conducting