Page 9
Medicare Part D U.S. DHHS, Office of the Inspector General (OIG) Investigative arm of the federal agency with oversight of federal government health care programs State Attorney General's Office Arm of state responsible for investigating and prosecuting violations of state laws State Attorney's Office Local authority responsible for investigating/prosecuting violations of state laws Florida Agency for Health Care Administration (AHCA) State agency overseeing healthcare delivery in Florida, and regulating healthcare professionals Florida Department of Financial Services/Office of Insurance Regulation (DFS/OIR) State agency responsible for overseeing HMO and Insurance products, rate and form approval, benefit requirements, and Agent licensing U.S. DHHS, Office for Civil Rights (OCR) Federal agency overseeing enforcement of the HIPAA Privacy Regulations X. Risk Areas Identification of risk areas is a critical element in the maintenance of an effective Compliance Plan and in the development of policies and standards. The design of the program, and policies and standards are developed and/or updated based on the risk associated with noncompliance, e.g., the likelihood of harm to an enrollee. Risk areas are identified through numerous mechanisms, such as the following: • Management interviews • Reports by employees • Results of employee surveys • Observed and/or reported incidents or conditions • Reports, instructions, and guidance issued by government agencies Compliance Plan 1 - 12 Revised December 12, 2018 • Correspondence from government agencies and third-party payors • Model compliance plans, fraud alerts and advisories issued by enforcement agencies • Work plans and audit reports of government oversight agencies • Monitoring and external audits • Industry compliance publications Key categories of risk and examples of inappropriate activities for health plans include the following: Risk Areas: • Marketing Materials and Personnel, including selective marketing and enrollment • Enrollment and Disenrollment • Utilization and Quality of Care (including underutilization of medically-necessary services and over-utilization of health care services, such as prescription drugs and controlled substances) • Data Collection and Submission Process • Anti-Kickback Statute and Other Inducements • Anti-Dumping • Medical Necessity • Provider Credentialing • Provider Contracting • Confidentiality and Privacy of Information • Quality Assurance • Provider Billings • Claims Processing • Improper Bid Submissions under the Medicare Advantage and Part D Programs • Enrollee Grievances, Coverage Determinations, and Appeals • Coordination of Benefits, including Medicare Secondary Payor • Benefit Administration, including Premium Collection, Cost-Sharing, and tracking Medicare Part D True Out-of-Pocket (“TrOOP”) Costs • Reporting of Pharmaceutical Manufacturer Rebates and Other Remuneration Examples of illegal or inappropriate activities include: • Misrepresenting a provider’s qualifications, credentialing, and/or licensing • Employment of or contracting with an individual excluded from participation in federal health care programs • Regularly denying a request for benefit(s) without sufficient documentation supporting the denial • Paying kickbacks to primary care providers for referrals to fee-for-service specialists • Excluding or dissuading enrollment of identifiable groups, e.g., those with HIV, mental illness, eligible subsidies, and individuals dually-eligible for Medicare and Medicaid • Diverting an in-network patient to a non-network doctor in the same clinic and billing with the in-network doctors’ name Compliance Plan 1 - 13 Revised December 12, 2018 • Claiming procedures that are not discounted under the negotiated contract, e.g., billing for fingernail cutting as surgery • Failing to notify beneficiaries of their rights to appeal a coverage denial, including coverage of a prescription drug under the applicable FHCP formulary • Waiving copayments or deductibles to attract more patients • Splitting fees for referrals with nonparticipating providers • Claiming capitation payments for nonexistent patients, including payments under the Medicare Advantage and Part D Programs • Falsifying identifiers so as to receive both a monthly cap and fee for service for the same patient • Billing for unlicensed caregiver services under an in-network physician's name • Assigning large numbers of enrollees to a particular provider, making the provision of quality service and care impossible to achieve • Delayed payment of clean claims • Providing insufficient documentation to support billing and utilization review • Miscalculating and underreporting pharmaceutical manufacturer rebates and/or other remuneration under Medicare Part D to increase “allowable drug costs” incurred by the organization • Improper formulary administration, including prescription drug switching and prescription drug splitting or shortening • Prescription forging or altering or refill errors • Submission of incorrect data to CMS in connection with Medicare Advantage and Part D Plans, including encounter data, enrollee risk adjustment data, and prescription drug event (“PDE”) data Compliance Plan 2 - 1 Revised December 12, 2018 PERSONNEL AND ORGANIZATION I. Overview FHCP’s Compliance Officer and Compliance Committee shall provide direct oversight of this Plan. All Directors, Managers, and Supervisors shall support Plan oversight within their respective areas of responsibility. Periodic reports shall be presented to the Board of Directors to ensure that the organization is diligently adhering to the Plan, corrective actions are appropriate and timely, and, as needed, that regulatory bodies are informed of identified non-compliant activities. FHCP’s Compliance Program is reviewed annually by the Board of Directors. Although it is common practice within the industry for organizations to enter into contracts with third parties to perform certain functions that would otherwise be the responsibility of the organization, FHCP is ultimately responsible for complying with all applicable laws and regulations and fulfilling the terms and conditions of FHCP’s contracts for all FHCP’s lines of business. II. Designation of a Compliance Officer, Privacy Officer, and Security Officer FHCP shall designate a Compliance Officer, who shall also serve as the organization’s Privacy Officer and who shall report directly to the CEO. He shall be authorized to meet with the FHCP Board of Directors as necessary without the approval of the CEO. The Compliance Officer/Privacy Officer shall assume primary responsibility for formulating and implementing all compliance related activities. Additionally, the Compliance Officer/Privacy Officer will: • Provide technical assistance to operational areas regarding regulatory and ethical issues. • Conduct/oversee the compliance monitoring efforts of the organization, including in connection with FHCP’s participation as a first tier entity under the Medicare Advantage and Part D Programs. • As needed, coordinate investigations into activities that are not consistent with regulatory or organizational standards. • Formulate and oversee the implementation of corrective action that will remedy noncompliant activities and prevent recurrence. FHCP shall designate a Chief Information Officer (CIO) who shall also serve as the organization’s Security Officer and shall report directly to the CEO. He shall assume primary responsibility for the