Featured Health Business Daily Story, July 20, 2016

CMS Says 19 of 23 MA Program Audits Reviewed in ’16 Resulted in IA Mandates

Reprinted from MEDICARE ADVANTAGE NEWS, biweekly news and business strategies about Medicare Advantage plans, product design, marketing, enrollment, market expansions, CMS audits, and countless federal initiatives in MA and Medicaid managed care. Sign up for an $87 two-month trial subscription today.

By Lauren Flynn Kelly, Managing Editor
July 7, 2016Volume 22Issue 13

Nineteen of the 23 program audits conducted in 2015 of Medicare Advantage plans that were reviewed by CMS since the beginning of 2016 have resulted in the plan involved being directed to hire an independent auditor (IA) to verify that the problems found have been corrected, a CMS official said at a conference session June 16. This figure and other comments made by Doreen Gagliano, technical advisor in the Division of Audit Operations at CMS’s Medicare Parts C & D Oversight and Enforcement Group (MOEG), surprised some observers queried by MAN. They suggest that the agency is looking to broaden the use of required IAs as a way of rectifying numerous kinds of problems turned up in MA organization (MAO) audits while also coping with agency staffing and budget limitations.

What the 19-IAs figure used at CMS’s annual audit and enforcement conference in Baltimore for MA insurers and stand-alone Prescription Drug Plans (PDPs) indicates, for instance, is that an IA is no longer a requirement “just for the handful of MAOs that came under sanction,” suggests Michael Adelberg, a former high-level CMS MA official who now is senior director at FaegreBD Consulting. He tells MAN that instead “it is becoming a common result of a program audit.”

Gagliano indeed hinted at such broader usage in her own comments at the conference. CMS now may require MA plans to hire an IA when a program audit finds “deficiencies that may become the basis for intermediate sanctions,” even if they haven’t reached that threshold yet, she said. Intermediate sanctions refer to such CMS directives as halting marketing to and enrollment of new members and generally have been reserved for the most egregious violations the agency finds.

Medicare Advantage News

CMS implemented its revised IA process at the beginning of 2016, Gagliano said. Of the 19 MAOs directed to hire IAs so far this year, according to Gagliano, only three were facing intermediate sanctions, and one of those already has come off those sanctions.

She noted that the agency has the authority to compel a sponsor to hire an IA to determine if the deficiencies that were found during a program audit and/or were the basis for a sanction have been corrected and are not likely to recur. CMS will decide whether to order hiring of an IA for an MA plan based on numerous factors, including the sponsor’s audit score, the data needed to validate correction of deficiencies, whether intermediate sanctions were imposed as a result of the audit, and previous enforcement actions taken against the sponsor for related issues, she said.

Gagliano added that if the IA hiring occurs in the case of intermediate sanctions, the sponsor must hire the IA to validate both sanction-related and non-sanction-related deficiencies. This represents a broader use of IAs than formerly, when their task was basically just to confirm the cause of the sanctions had been rectified while plans themselves submitted data designed to show correction of lesser offenses. The change, observers say, resulted from CMS’s realization that it didn’t have the resources to confirm those plan submissions.

CMS expects IAs hired by MA plans to have “subject-matter expertise,” understanding of industry best practices, and no actual or perceived conflicts of interest, Gagliano emphasized. The independence required, she explained, means a consulting firm may not have prior experience with the MAO’s Medicare/Medicaid lines of business. An external Quality Review Organization could qualify, as could a quality improvement organization that contracts with a state Medicaid agency or the sponsor to perform non-audit-related activities, but an unaffiliated contractor that the MAO in the past had hired to do “pre-review” or “mock audit” services would be “on the fence” although probably OK if it had not recommended or participated in corrective action plans (CAPs) resulting from this role, she added.

Other CMS speakers said in response to questions during the session that a firm doing “data validation” for an MAO would meet the independence criteria “at the present time.”

Examples of when there would be conflicts of interest, Gagliano said, include consulting firms that previously had assisted the MAOs in creating processes to meet Medicare Part C or D requirements or in developing CAPs to “remediate deficiencies” related to them. She noted that CMS does not recommend specific IAs.

Hiring IAs Is Costly, Though Valuable

Adelberg says MAOs should be able to find IAs that meet these criteria, including both large national consulting firms and “Medicare niche” consultants. The cost, he tells MAN, could be $50,000 or more for a small plan and thus can be substantial for it, “but these independent auditors see successful practices across the industry. If they catch some things that help an MAO turn a vulnerability into a strength, that’s added value.” While the new emphasis on IAs is significant, he added, this is “not an existential crisis” for the MA industry.

In her presentation, Gagliano summarized the steps CMS wants IAs to follow in determining whether deficiencies have been remedied. The theme was thoroughly documenting what was done, and she pointed out that IAs and MAOs may use separate efforts to validate correction of sanction-related and non-sanction-related deficiencies.

While Gagliano pointed out that CMS never yet has denied validation of an IA’s report, it can do so. Says Adelberg: “The agency reserves the right to reject an IA’s findings. Whether this will happen depends on the IAs themselves. Are they, when appropriate, making the MA plans do some re-work?”

SilverScript Tells About Working With PDP IA

As a guide for MA plans wanting to know how the IA process has worked in the recent past, the same conference session included a presentation by Todd Meek, president of SilverScript Insurance Co., a CVS Health Corp. unit that operates one of the nation’s largest stand-alone Medicare Prescription Drug Plans (PDPs) and had to use an IA to verify correction of deficiencies found in a spring 2015 CMS program audit. SilverScript began the IA process last December, one month after issuance of CMS’s Final Audit Report, and completed the validation process this February. Meek noted that CMS closed the program audit March 23, 2016.

The company, which has 5.3 million PDP enrollees, “anticipated we’re going to get audited every year because of our size.” SilverScript therefore had internal audit programs and teams, including a validation task force headed by its chief compliance officer, that it tested “rigorously” ahead of the IA process, Meek said. “Make sure you really understand what CMS is looking for” as new guidance from the agency comes out, he advised.

SilverScript, according to Meek, put a lot of emphasis on the independence and subject-matter expertise of the IA it hired: BluePeak Advisors, one of whose principals is Babette Edgar, Pharm.D., a former top CMS Part D official. “They had no fear in maintaining their independence,” Meek asserted.

Edgar herself tells MAN that the firm began working with SilverScript last fall and has done eight IA audits since Jan. 1, 2016, mostly for MA firms but also for PDPs. While she declines, citing contractual commitments, to discuss specifics about what her firm did with SilverScript or any prior work relationship with that firm, she does say that BluePeak encountered no resistance from the firm to its efforts to determine whether problems had been fixed.

The keys to successful IA experiences for MAOs and PDPs center on them being “completely unbiased,” she contends. The IA must audit just as CMS does, using the same protocols and timelines, Edgar says, explaining that BluePeak knows them since it has sat in on program audits with other plans and has former CMS auditors working with it.

IA validation audits, she says, are different from some others because it is already known what the regulator’s findings are and the task therefore is to ensure that those problems have been “remediated.” Toward that end, BluePeak does such things as verify data are correct, look at documentation for timelines and tailor sample selections for testing to the condition found by CMS.

At the end of its IA process, according to Edgar, BluePeak reports its findings to the client and sometimes is told that the plan doesn’t agree with one. BluePeak then asks for documentation. She also notes that CMS policies and practices change each year, so the IA has to keep up on those.

Edgar recalls that in the first two IA assignments it had this year, BluePeak had questions for CMS, and it handled those in conjunction with the clients. It is very important, she says, to keep “open communication” with the CMS audit lead person assigned to the plan by the agency.

Asked what the differences are in IAs for MAOs versus PDPs, she responds that while there are “no real differences,” the validation process may be longer and “more involved” for MAOs since it takes into account not only medical categories but also such aspects as Organization Determinations, Appeals & Grievances (ODAGs) and Special Needs Plans’ Models of Care not in the Part D side.

Overall, though, says Edgar, “CMS is becoming more standardized in what it is looking for in a validation process.” She adds, “This is a learning experience for everybody.”

View the Gagliano and Meek presentations at www.cms.gov/Outreach-and-Education/Training/CTEO/Event_Archives.html.

© 2016 by Atlantic Information Services, Inc. All Rights Reserved.


The AIS E-Savings Club offers regular opportunities to buy AIS products and services at substantial savings. Click here to see the current specials — including a discount on the all-new AIS’s Medicare and Medicaid Market Data: 2016.

It's quick and easy to sign up for FREE access to AISHealth.com!

Why do I need to register?