Independent Auditor (IA) Validation Process for Medicare Part C and D Program Audits

CMS has issued an updated memorandum mandating an Independent Auditor (IA) Validation Process for Medicare Advantage and Prescription Drug Plan Program Audits. This is a follow-up to a final rule issued early this year (see CMS-4159-F2) that established CMS authority to require a sponsoring organization (“Sponsor”) to hire an Independent Auditor (IA)  to ensure any issues found during a CMS full or partial program audit are corrected.

Rita Isnar, JD, an expert consultant on Medicare Managed Care, explains, “The IA will be conducting operational reviews, not financial reviews. As such, what is needed is not a CPA but a firm with the requisite subject expertise in Medicare Part C & Part D that will be subject to review in the validation. The focus will be on the ability to properly establish a universe, against which they can test the compliance outcomes of sampled cases and/or an entire universe of data.”

CMS will inform Sponsors whether an IA is required in the final audit report. CMS has now outlined the steps an IA must follow, as well as the roles and responsibilities of all parties involved. In its November 12, 2015 communication, CMS described five new steps in this process.

Step 1:  Hiring an IA

CMS will not provide recommendations on IA firms. However, the IA hired must meet the following requirements:

• Must attest that the IA is independent and has no conflicts of interest. Specifically, the IA must attest that it has not employed, contracted, sub-contracted, or represented the sponsoring organization; and is not considered to be a first-tier, downstream, or related entity by the sponsoring organization.

• Must have subject matter expertise in the areas of Medicare Part C & Part D that will be subject to review in the validation.

• If a sanction is imposed as a result of the initial audit, the IA will need to validate correction of all sanction related conditions as well as non-sanction related conditions.

CMS also recommends that Sponsors move quickly in the post-audit phase (i.e., once CMS issues the final audit report to the Sponsor), as hiring an IA must be completed before a Sponsor is eligible to enter the validation phase of its program audit.

Step 2:  Developing a Validation Work Plan & Timeline

The purpose of the validation review is for the Sponsor to demonstrate corrections of the conditions of non-compliance identified in the final CMS audit report and to serve as the basis for the CEO attestation that the conditions are corrected and are not likely to recur. Sponsors should provide the final CMS audit report and its Corrective Action Plans (CAPs) to assist the IA in understanding what needs to be evaluated during the validation. The IA will create a validation work plan that details how it will conduct the validation to test the compliance outcomes of sampled cases and/or an entire universe of data. The validation work plan is not just a review of only policies, procedures, or processes. The IA should test the effectiveness of the CAPs and whether the Sponsor’s transactions now comply with CMS requirements. The IA must test transactions dating back to the “clean” period, where a Sponsor believes its operations were free from any audit-related deficiencies. The Sponsor will submit the validation work plan to CMS and schedule a call with CMS and the IA, where the IA can walk through the validation work plan, which will include explaining the proposed duration of the validation process and permitting CMS to ask questions and/or request changes.

Step 3:  Conducting the Validation

The IA must follow the validation work plan approved by CMS. The Sponsor must provide unfettered access to information related to the areas of validation and be responsive to requests for additional information. CMS expects that should the IA need to deviate from the approved validation work plan, the IA and Sponsor would need to contact CMS to seek approval for the change in work plan. The IA must conduct data integrity tests of universe submissions to assure they are complete and an accurate representation of the Sponsor’s systems. If the IA is unable to ascertain complete and reliable data universes from the Sponsor, the IA should not proceed with the validation and should contact CMS for further guidance.

If the IA discovers sample case failures during its review, it should request that the Sponsor review the failed cases and determine if additional beneficiaries have been impacted. If the IA discovers additional beneficiaries were impacted by the condition of non-compliance, it should provide a beneficiary impact analysis (BIA) to the IA for the IA to include in its validation report to the Sponsor. The IA should validate whether the beneficiary impact analysis from the Sponsor is accurate.

CMS also expects the Sponsor to respect the IA’s independence during the execution of the validation, and not attempt to inappropriately influence how the validation is conducted or the findings derived from the review, regardless of the Sponsor’s financial responsibility to the IA.

Step 4:  Reporting the Results of the Validation Audit

The IA will draft a validation report that details the findings from the validation, but will not make any recommendations to CMS about whether violations or audit conditions have been adequately corrected. It should report the outcomes of the sample cases and universes reviewed. CMS will make determinations about whether individual deficiencies have been corrected and whether to close the audit process.

The IA will submit the validation report to the Sponsor, who should thoroughly review the results and discuss with the IA about addressing any disagreements or responses.

If the Sponsor decides it has sufficiently corrected its audit-related deficiencies based on the IA’s validation report, it must attest within HPMS that all the deficiencies have been corrected and are not likely to recur. The Sponsor must include with its attestation the IA’s report and any additional information the Sponsor would like CMS to consider when reviewing the final validation report. If the Sponsor decides that it has not adequately corrected all of the audit-related deficiencies, it should contact its CMS Validation Lead to discuss issues that need further correction. The Sponsor will need to implement new CAPs and repeat the validation process until its CEO can attest within HPMS that all of the findings from the audit final report have been corrected.

Step 5: CMS Review of the Validation Report and Other Information

CMS will review the IA’s validation report and additional information submitted by the Sponsor. CMS will likely request a follow-up call with the IA and the Sponsor to seek clarification and ask questions about the information provided. Once CMS has all the information needed, CMS will make a determination about whether to close the audit process. CMS will schedule a phone call with the Sponsor’s CEO and Medicare Compliance Officer to inform them of CMS’s determination and next steps, or issue an audit close-out notice.

For more general information regarding this subject, see a recent free Webinar on Managed Care Hot Topics.