Rule2024-20416
Performance Standards for Medicaid Fraud Control Units
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
September 18, 2024
Issuing agencies
Health and Human Services DepartmentInspector General Office, Health and Human Services Department
Abstract
This document sets forth OIG guidance regarding standards OIG will apply in assessing the performance of Medicaid Fraud Control Units (MFCUs or Units). Based on its experience in overseeing MFCUs, and after consultation with key stakeholders, OIG is revising the standards. These standards replace and supersede standards published on June 1, 2012.
Full Text
<html>
<head>
<title>Federal Register, Volume 89 Issue 181 (Wednesday, September 18, 2024)</title>
</head>
<body><pre>
[Federal Register Volume 89, Number 181 (Wednesday, September 18, 2024)]
[Rules and Regulations]
[Pages 76431-76434]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2024-20416]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Office of Inspector General
42 CFR Part 1007
Performance Standards for Medicaid Fraud Control Units
AGENCY: Office of Inspector General (OIG), Department of Health and
Human Services (HHS).
ACTION: Notice of final revised performance standards.
-----------------------------------------------------------------------
SUMMARY: This document sets forth OIG guidance regarding standards OIG
will apply in assessing the performance of Medicaid Fraud Control Units
(MFCUs or Units). Based on its experience in overseeing MFCUs, and
after consultation with key stakeholders, OIG is revising the
standards. These standards replace and supersede standards published on
June 1, 2012.
DATES: Effective Date: These standards are effective upon publication.
FOR FURTHER INFORMATION CONTACT: Susan Burbach, OIG Office of
Evaluation and Inspections, 202-731-8516, <a href="/cdn-cgi/l/email-protection#067573756768286473746467656e46696f61286e6e7528616970"><span class="__cf_email__" data-cfemail="cab9bfb9aba4e4a8bfb8a8aba9a28aa5a3ade4a2a2b9e4ada5bc">[email protected]</span></a>.
SUPPLEMENTARY INFORMATION:
I. Background
The mission of MFCUs is to investigate and prosecute (or refer for
prosecution): (1) fraud committed by Medicaid providers, (2) fraud in
the administration of the Medicaid program, and (3) patient abuse or
neglect of residents in health care facilities and board and care
facilities and of Medicaid enrollees in noninstitutional or other
settings. MFCUs receive most of their funding from the Federal
Government, and each MFCU operates as ``a single, identifiable entity
of State government.'' Each of the 50 States has a MFCU, as well as the
District of Columbia, Puerto Rico, and the U.S. Virgin Islands. Except
for four States, each MFCU is organized as part of the State Attorney
General's office.
HHS-OIG has been delegated authority under sections 1903(q) and
1903(a)(6) of the Social Security Act (the Act) to certify and annually
recertify Units as eligible for Federal financial participation (FFP),
and to reimburse States for costs incurred in operating a MFCU. Through
the certification and recertification process, OIG ensures that the
Units meet the requirements for FFP set forth in section 1903(q) of the
Act and in Federal regulations found at 42 CFR part 1007. As part of
this process, OIG applies a series of performance standards, as
required by section
[[Page 76432]]
1902(a)(61) of the Act, in determining the effectiveness of Units in
carrying out required MFCU functions. The standards provide helpful
guidance to MFCUs in their operations and assist OIG in its
recertification process and periodic reviews of MFCUs. If OIG
determines there are opportunities for a Unit to improve its adherence
to the standards, OIG will work with the Unit to implement changes or
may impose and monitor formal recommendations for improvement.
The standards reflect practices identified both by OIG and MFCUs
that will improve MFCU effectiveness in fulfilling their oversight
mission. OIG's goal, both with these standards and with OIG's other
oversight activities, is to support each Unit in maximizing its
effectiveness in fighting Medicaid fraud and protecting enrollees and
other facility residents. We encourage Units to implement these
standards in light of each State's organization and practices and to
identify additional best practices that will improve their
effectiveness.
OIG initially published the MFCU performance standards in 1994 (see
59 FR 49080, September 26, 1994) and revised the standards in 2012 (see
77 FR 32645, June 1, 2012). Based on its experience in overseeing
MFCUs, OIG has updated the standards. The updated standards were
developed in consultation with the National Association of Medicaid
Fraud Control Units. OIG welcomes stakeholder feedback on the standards
and may consider future revisions in response to feedback.
II. Standards for Assessing MFCU Performance
Performance Standard 1--Compliance With Requirements
A Unit conforms with applicable statutes, regulations, and policy
directives, including:
A. Section 1903(q) of the Social Security Act, containing the basic
requirements for operation of a MFCU;
B. Regulations for operation of a MFCU contained in 42 CFR part
1007;
C. Federal administrative requirements, cost principles, and audit
requirements referenced in the notice of grant award terms and
conditions;
D. Applicable State and Federal requirements and standards
pertaining to information security as described in Standard 7F;
E. OIG policy transmittals as maintained on the OIG website; and
F. Terms and conditions of the notice of the grant award as
maintained on the OIG website.
Performance Standard 2--Staffing
A Unit maintains reasonable staff levels and office locations in
relation to the State's Medicaid program expenditures and has a salary
and benefit package that allows the Unit to recruit and retain
qualified staff. To determine whether a Unit meets this standard, OIG
will consider the following performance indicators:
A. The Unit seeks to employ a total number of professional staff
that is commensurate with the State's total Medicaid program
expenditures and that enables the Unit to effectively investigate and
prosecute (or refer for prosecution) an appropriate volume of case
referrals and workload for both Medicaid fraud and abuse or neglect of
patients or residents.
B. The Unit employs an appropriate mix and number of attorneys,
auditors, investigators, and other professional staff that is
commensurate with the State's total Medicaid program expenditures and
that allows the Unit to effectively investigate and prosecute (or refer
for prosecution) an appropriate volume of case referrals and workload
for both Medicaid fraud and abuse or neglect of patients or residents.
C. The Unit, when warranted for the number of employees, designates
one or more supervisory staff, such as senior investigators, to
supervise the activities of individual investigators or other
employees.
D. The Unit employs a number of administrative staff in relation to
its overall size that allows the Unit to operate effectively.
E. The Unit, consistent with State requirements, offers a
competitive salary and benefits package that permits the Unit to
recruit and retain qualified professional staff in the region where the
Unit operates.
F. To the extent that a Unit maintains multiple office locations,
such locations are distributed throughout the State and are adequately
staffed, commensurate with the volume of case referrals and workload
for each location.
Performance Standard 3--Policies and Procedures
A Unit establishes written policies and procedures for its
operations and ensures that staff are familiar with, and adhere to,
policies and procedures. To determine whether a Unit meets this
standard, OIG will consider the following performance indicators:
A. The Unit has written guidelines or manuals that contain current
policies and procedures, consistent with these performance standards
and any applicable laws, regulations, and policy transmittals, for the
investigation and (for those Units with prosecutorial authority)
prosecution of Medicaid fraud and abuse and neglect of patients or
residents.
B. The Unit adheres to current policies and procedures in its
operations.
C. The Unit periodically reviews and updates its policies and
procedures and creates and implements new policies and procedures as
appropriate.
D. Policies and procedures also address, at a minimum, the
following:
1. A timeframe for conducting periodic supervisory case reviews
(see Standard 5C);
2. A process for referring cases, when appropriate, to Federal and
State agencies;
3. Training standards for Unit employees;
4. A policy to ensure collaboration with Federal partners as
required by 42 CFR 1007.11(e)(5); and
5. For those Units with sworn law enforcement agents, policies and
procedures to address the exercise of the Unit's law enforcement
authorities.
E. Written guidelines and manuals are readily available to all Unit
staff, either electronically or in hard copy.
Performance Standard 4--Maintaining Adequate Referrals
A Unit takes steps to maintain an adequate volume and quality of
referrals from the State Medicaid agency and other sources. To
determine whether a Unit meets this standard, OIG will consider the
following performance indicators:
A. The Unit takes steps to ensure that the State Medicaid agency,
managed care organizations, and other pertinent entities refer to the
Unit suspected provider fraud. Steps to ensure referrals may include
having consistent communication and meetings with referring entities,
providing feedback on the quality and volume of referrals, and training
on the characteristics of an effective referral.
B. The Unit, unless prohibited by law, provides timely information
to the referring entity when the entity requests information on the
status of MFCU investigations, including when the Medicaid agency
requests quarterly certification pursuant to 42 CFR 455.23(d)(3)(ii).
C. The Unit takes steps to encourage pertinent entities to refer
complaints of patient or resident abuse or neglect to the Unit.
Pertinent entities may include licensing and certification agencies,
the State Long-Term Care Ombudsman, and adult protective services
offices.
[[Page 76433]]
D. The Unit takes steps through public outreach or other means to
encourage the public to make referrals to the Unit.
Performance Standard 5--Maintaining Case Progression
A Unit takes steps to maintain reasonable case progression and to
complete cases within an appropriate timeframe based on the complexity
of the cases. To determine whether a Unit meets this standard, OIG will
consider the following performance indicators:
A. Each stage of an investigation and prosecution is completed
within an appropriate timeframe.
B. Supervisors document the approval to open and close all
investigations in the case files or electronic case management system.
C. Supervisors conduct periodic case reviews, consistent with a
specific timeframe established in the Unit's policies and procedures.
Case reviews include a review of case progress and ensure that staff
complete each stage of an investigation and prosecution within an
appropriate timeframe. The Unit maintains a record of these reviews in
the case files or electronic case management system.
D. Significant delays to cases are documented and explained in the
case files or electronic case management system.
E. The Unit pursues, when warranted for the case, the availability
and use of appropriate technology, such as digital forensics,
surveillance technology, and data analytics.
F. Unit staff are issued, or have appropriate access to, electronic
devices and other technology to effectively perform their duties.
Performance Standard 6--Case Mix
A Unit's case mix, as practicable, covers all significant provider
types and includes a balance of cases involving fraud and abuse or
neglect of patients or residents. To determine whether a Unit meets
this standard, OIG will consider the following performance indicators:
A. The Unit seeks to have a broad mix of cases among the
significant provider types in the State and seeks to allocate resources
among provider types based on levels of Medicaid expenditures or other
objective measures of risk.
B. For those States that cover a significant number of Medicaid
enrollees under managed care plans, the Unit investigates an
appropriate number of cases arising in a managed care setting in its
mix of cases.
C. The Unit investigates a balance of cases of fraud and cases of
abuse or neglect of patients or residents, for those Units with the
responsibility and jurisdiction to investigate or prosecute abuse or
neglect of patients or residents.
Performance Standard 7--Maintaining Case Information
A Unit maintains case files in an effective manner and uses an
electronic case management system that allows efficient access to case
information and other performance data. To determine whether a Unit
meets this standard, OIG will consider the following performance
indicators:
A. The Unit has an electronic case management system that manages
and tracks case information from initiation to resolution.
B. Case file documentation is included within the Unit's electronic
case management system unless particular circumstances (e.g., space
limitations or security concerns) require the selective use of another
storage system.
C. Case files or the electronic case management system include all
relevant information, including investigative reports and data
analyses.
D. Significant litigation documents, such as charging documents,
judgments, and settlement agreements, are included in the case files.
E. Investigative reports, consistent with the Unit's policies and
procedures, address all relevant aspects of the investigation and are
accurate, clear, complete, concise, logically organized, timely, and
objective.
F. The Unit's electronic case management system ensures the
protection of sensitive data, case information, and confidential
sources.
1. The Unit's information system, including the electronic case
management system, complies with applicable State requirements
pertaining to information security and breach reporting and with
current cybersecurity standards and guidelines as maintained in either:
(a) the applicable version of the U.S. Department of Justice FBI
Criminal Justice Information Services Division (CJISD) ``Security
Policy,'' CJISD-ITS-DOC-08140-5.9, or (b) the applicable version of the
National Institute of Standards and Technology (NIST), special
publication, ``Security and Privacy Controls for Information Systems
and Organizations,'' NIST SP 800-53.
2. The Unit maintains documentation of its compliance with policies
identified in subsection F1.
3. Any audits, reviews, or risk assessments of the Unit's
information system are shared with OIG as a part of the Unit's annual
recertification submission.
4. Any known security breaches are reported within 30 days of
discovering the incident to the OIG Information Systems Security
Officer, <a href="/cdn-cgi/l/email-protection#acc5dfdfc3ecc3c5cb82c4c4df82cbc3da"><span class="__cf_email__" data-cfemail="5d342e2e321d32343a7335352e733a322b">[email protected]</span></a>.
G. The Unit's electronic case management system allows for
monitoring cases and for monitoring and reporting case outcome data to
OIG as specified in 42 CFR 1007.17(a)(2).
H. The Unit stores nondocumentary evidence securely and records the
evidence in an effective and accessible system.
Performance Standard 8--Cooperation With Federal and Other State
Authorities on Fraud Cases
A Unit cooperates with OIG and other Federal and State agencies in
the investigation and prosecution of Medicaid and other health care
fraud. To determine whether a Unit meets this standard, OIG will
consider the following performance indicators:
A. The Unit communicates on a regular basis with OIG and other
Federal or State agencies investigating or prosecuting health care
fraud in the State.
B. For criminal or civil cases that are regional or national in
scope, the Unit collaborates with Federal agencies and other State
MFCUs as appropriate.
C. The Unit cooperates and, as appropriate, coordinates with OIG's
Office of Investigations and other Federal agencies on cases being
pursued jointly, cases involving the same suspects or allegations, and
cases that have been referred to the Unit by OIG or another Federal
agency.
D. The Unit makes available, to the extent authorized by law and
upon request by Federal investigators and prosecutors, all information
in its possession concerning provider fraud or fraud in the
administration of the Medicaid program.
E. For cases that require the granting of extended authority under
42 CFR 1007.11(a)(2) to investigate Medicare or other Federal health
care fraud, the Unit seeks approval from the OIG regional Special Agent
in Charge following procedures set by OIG or other relevant Federal
Inspectors General under procedures set by those agencies.
F. For cases that have civil fraud potential, the Unit investigates
and prosecutes such cases under State authority or refers such cases to
OIG or the U.S. Department of Justice.
G. The Unit transmits to OIG, for purposes of program exclusions
under section 1128 of the Social Security Act, all pertinent
information on MFCU convictions, including joint cases. Pertinent
information includes
[[Page 76434]]
judgments of conviction, charging documents, plea agreements, and
sentencing orders. Information will be provided within 30 days of
sentencing, or as soon as practicable if the Unit encounters delays in
receiving the necessary information from the court, as required by 42
CFR 1007.11(g)(3).
H. The Unit reports qualifying cases, as defined by 45 CFR 60.5, to
the National Practitioner Data Bank, or successor data bases, within 30
days of sentencing or other reportable action.
Performance Standard 9--Program Recommendations
A Unit makes statutory or programmatic recommendations, when
warranted and appropriate, to the State government. To determine
whether a Unit meets this standard, OIG will consider the following
performance indicators:
A. The Unit, when warranted and appropriate, makes statutory
recommendations to the State legislature to improve the operation or
effectiveness of the Unit, including amendments to the enforcement
provisions of the State code.
B. The Unit, when warranted and appropriate, makes other regulatory
or administrative recommendations regarding program integrity issues to
the State Medicaid agency and to other agencies responsible for
Medicaid operations or funding.
C. The Unit monitors and maintains records regarding actions taken
by the State legislature and the State Medicaid agency or other
agencies in response to Unit recommendations.
Performance Standard 10--Agreement With Medicaid Agency
A Unit periodically reviews its memorandum of understanding (MOU)
with the State Medicaid agency to ensure that the MOU reflects current
practice, policy, and legal requirements. To determine whether a Unit
meets this standard, OIG will consider the following performance
indicators:
A. The MOU complies with Federal regulations contained in 42 CFR
1007.9(d), ``Relationship and agreement between Unit and Medicaid
agency,'' including: (1) an agreement for regularly scheduled meetings
or communication with the Medicaid agency (and procedures for how the
two agencies will coordinate their efforts), (2) procedures (as
applicable) for managed care referrals as required by 42 CFR
438.608(a)(7), (3) a requirement that the Unit reviews the MOU at least
every 5 years, and (4) an agreement that the Unit renegotiates the MOU
as necessary to ensure that it addresses current law and practice.
B. The MOU meets other current Federal legal requirements as
contained in law or regulation, including 42 CFR 455.21, ``Cooperation
with State Medicaid fraud control units,'' and 42 CFR 455.23,
``Suspension of payments in cases of fraud.''
C. The MOU is consistent with current Federal and State policy,
including any policies issued by OIG or the Centers for Medicare &
Medicaid Services (CMS).
D. Consistent with Performance Standard 4, the MOU establishes a
process to encourage the receipt of an adequate volume and quality of
referrals to the Unit from the State Medicaid agency and, as
applicable, from managed care organizations.
E. The MOU incorporates by reference CMS's ``Performance Standard
for Referrals of Suspected Fraud from a Single State Agency to a
Medicaid Fraud Control Unit.''
F. Consistent with 42 CFR 1007.11(c), the MOU specifies that
overpayments will be referred to the State agency when the Unit is
unable to recover such overpayments as a part of a fraud action.
Performance Standard 11--Fiscal Control
A Unit exercises proper fiscal control over Unit resources. To
determine whether a Unit meets this standard, OIG will consider the
following performance indicators:
A. The Unit promptly submits to OIG its preliminary budget
estimates, proposed budget application, and Federal financial
expenditure reports.
B. The Unit limits its requests for grant funding, including its
requested staffing levels, to operational amounts and staffing levels
that it reasonably expects to fulfill in the upcoming fiscal period.
C. The Unit makes reasonable efforts to employ the number of staff
that is included in the Unit's budget application request as approved
by OIG.
D. The Unit maintains a property inventory that is updated
regularly to reflect all equipment (as defined under 2 CFR 200.1) under
the Unit's control and includes all property that may contain
personally identifiable information or sensitive information or may be
a potential security concern, such as computing devices, weapons, and
investigative tools (e.g., surveillance video or audio equipment).
E. The Unit maintains an effective time and attendance system and
personnel activity records.
F. The Unit applies generally accepted accounting principles in its
control of Unit funding.
G. The Unit employs a financial system in compliance with the
standards for financial management systems contained in Federal grant
administration requirements.
Performance Standard 12--Training
A Unit conducts training that aids the mission of the Unit. To
determine whether a Unit meets this standard, OIG will consider the
following performance indicators:
A. The Unit maintains a training plan for each professional
discipline that includes an annual minimum number of training hours and
that is at least as stringent as required for professional
certification.
B. The Unit ensures that professional staff comply with their
training plans and maintains records of completed training.
C. Professional certifications are maintained for all staff,
including those that fulfill continuing education requirements.
D. The Unit participates in MFCU-related training, including
training offered by OIG, other MFCUs, and other relevant organizations,
as such training is available and as funding permits.
E. The Unit participates in cross-training with the fraud detection
staff of the State Medicaid agency. As part of such training, Unit
staff provide training on the elements of successful fraud referrals
and receive training on the role and responsibilities of the State
Medicaid agency. Unit training of Medicaid staff should be supplemented
as appropriate with training for staff of managed care special
investigations units.
Christi A. Grimm,
Inspector General.
[FR Doc. 2024-20416 Filed 9-17-24; 8:45 am]
BILLING CODE P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on September 18, 2024.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.