Office of Inspector General (OIG), Department of Health and Human Services (HHS).

ACTION:

Notice of final revised performance standards.

SUMMARY:

This document sets forth OIG guidance regarding standards OIG will apply in assessing the performance of Medicaid Fraud Control Units (MFCUs or Units). Based on its experience in overseeing MFCUs, and after consultation with key stakeholders, OIG is revising the standards. These standards replace and supersede standards published on June 1, 2012.

DATES:

Effective Date: These standards are effective upon publication.

SUPPLEMENTARY INFORMATION:

I. Background

The mission of MFCUs is to investigate and prosecute (or refer for prosecution): (1) fraud committed by Medicaid providers, (2) fraud in the administration of the Medicaid program, and (3) patient abuse or neglect of residents in health care facilities and board and care facilities and of Medicaid enrollees in noninstitutional or other settings. MFCUs receive most of their funding from the Federal Government, and each MFCU operates as “a single, identifiable entity of State government.” Each of the 50 States has a MFCU, as well as the District of Columbia, Puerto Rico, and the U.S. Virgin Islands. Except for four States, each MFCU is organized as part of the State Attorney General's office.

HHS-OIG has been delegated authority under sections 1903(q) and 1903(a)(6) of the Social Security Act (the Act) to certify and annually recertify Units as eligible for Federal financial participation (FFP), and to reimburse States for costs incurred in operating a MFCU. Through the certification and recertification process, OIG ensures that the Units meet the requirements for FFP set forth in section 1903(q) of the Act and in Federal regulations found at 42 CFR part 1007. As part of this process, OIG applies a series of performance standards, as required by section 1902(a)(61) of the Act, in determining the effectiveness of Units in carrying out required MFCU functions. The standards provide helpful guidance to MFCUs in their operations and assist OIG in its recertification process and periodic reviews of MFCUs. If OIG determines there are opportunities for a Unit to improve its adherence to the standards, OIG will work with the Unit to implement changes or may impose and monitor formal recommendations for improvement.

The standards reflect practices identified both by OIG and MFCUs that will improve MFCU effectiveness in fulfilling their oversight mission. OIG's goal, both with these standards and with OIG's other oversight activities, is to support each Unit in maximizing its effectiveness in fighting Medicaid fraud and protecting enrollees and other facility residents. We encourage Units to implement these standards in light of each State's organization and practices and to identify additional best practices that will improve their effectiveness.

OIG initially published the MFCU performance standards in 1994 (see 59 FR 49080, September 26, 1994) and revised the standards in 2012 (see 77 FR 32645, June 1, 2012). Based on its experience in overseeing MFCUs, OIG has updated the standards. The updated standards were developed in consultation with the National Association of Medicaid Fraud Control Units. OIG welcomes stakeholder feedback on the standards and may consider future revisions in response to feedback.

II. Standards for Assessing MFCU Performance

Performance Standard 1—Compliance With Requirements

A. Section 1903(q) of the Social Security Act, containing the basic requirements for operation of a MFCU;

B. Regulations for operation of a MFCU contained in 42 CFR part 1007;

C. Federal administrative requirements, cost principles, and audit requirements referenced in the notice of grant award terms and conditions;

D. Applicable State and Federal requirements and standards pertaining to information security as described in Standard 7F;

E. OIG policy transmittals as maintained on the OIG website; and

F. Terms and conditions of the notice of the grant award as maintained on the OIG website.

Performance Standard 2—Staffing

A Unit maintains reasonable staff levels and office locations in relation to the State's Medicaid program expenditures and has a salary and benefit package that allows the Unit to recruit and retain qualified staff. To determine whether a Unit meets this standard, OIG will consider the following performance indicators:

A. The Unit seeks to employ a total number of professional staff that is commensurate with the State's total Medicaid program expenditures and that enables the Unit to effectively investigate and prosecute (or refer for prosecution) an appropriate volume of case referrals and workload for both Medicaid fraud and abuse or neglect of patients or residents.

B. The Unit employs an appropriate mix and number of attorneys, auditors, investigators, and other professional staff that is commensurate with the State's total Medicaid program expenditures and that allows the Unit to effectively investigate and prosecute (or refer for prosecution) an appropriate volume of case referrals and workload for both Medicaid fraud and abuse or neglect of patients or residents.

C. The Unit, when warranted for the number of employees, designates one or more supervisory staff, such as senior investigators, to supervise the activities of individual investigators or other employees.

D. The Unit employs a number of administrative staff in relation to its overall size that allows the Unit to operate effectively.

E. The Unit, consistent with State requirements, offers a competitive salary and benefits package that permits the Unit to recruit and retain qualified professional staff in the region where the Unit operates.

F. To the extent that a Unit maintains multiple office locations, such locations are distributed throughout the State and are adequately staffed, commensurate with the volume of case referrals and workload for each location.

Performance Standard 3—Policies and Procedures

A Unit establishes written policies and procedures for its operations and ensures that staff are familiar with, and adhere to, policies and procedures. To determine whether a Unit meets this standard, OIG will consider the following performance indicators:

A. The Unit has written guidelines or manuals that contain current policies and procedures, consistent with these performance standards and any applicable laws, regulations, and policy transmittals, for the investigation and (for those Units with prosecutorial authority) prosecution of Medicaid fraud and abuse and neglect of patients or residents.

B. The Unit adheres to current policies and procedures in its operations.

C. The Unit periodically reviews and updates its policies and procedures and creates and implements new policies and procedures as appropriate.

D. Policies and procedures also address, at a minimum, the following:

1. A timeframe for conducting periodic supervisory case reviews (see Standard 5C);

2. A process for referring cases, when appropriate, to Federal and State agencies;

3. Training standards for Unit employees;

4. A policy to ensure collaboration with Federal partners as required by 42 CFR 1007.11(e)(5); and

5. For those Units with sworn law enforcement agents, policies and procedures to address the exercise of the Unit's law enforcement authorities.

E. Written guidelines and manuals are readily available to all Unit staff, either electronically or in hard copy.

Performance Standard 4—Maintaining Adequate Referrals

A Unit takes steps to maintain an adequate volume and quality of referrals from the State Medicaid agency and other sources. To determine whether a Unit meets this standard, OIG will consider the following performance indicators:

A. The Unit takes steps to ensure that the State Medicaid agency, managed care organizations, and other pertinent entities refer to the Unit suspected provider fraud. Steps to ensure referrals may include having consistent communication and meetings with referring entities, providing feedback on the quality and volume of referrals, and training on the characteristics of an effective referral.

B. The Unit, unless prohibited by law, provides timely information to the referring entity when the entity requests information on the status of MFCU investigations, including when the Medicaid agency requests quarterly certification pursuant to 42 CFR 455.23(d)(3)(ii).

C. The Unit takes steps to encourage pertinent entities to refer complaints of patient or resident abuse or neglect to the Unit. Pertinent entities may include licensing and certification agencies, the State Long-Term Care Ombudsman, and adult protective services offices.

D. The Unit takes steps through public outreach or other means to encourage the public to make referrals to the Unit.

Performance Standard 5—Maintaining Case Progression

A Unit takes steps to maintain reasonable case progression and to complete cases within an appropriate timeframe based on the complexity of the cases. To determine whether a Unit meets this standard, OIG will consider the following performance indicators:

A. Each stage of an investigation and prosecution is completed within an appropriate timeframe.

B. Supervisors document the approval to open and close all investigations in the case files or electronic case management system.

C. Supervisors conduct periodic case reviews, consistent with a specific timeframe established in the Unit's policies and procedures. Case reviews include a review of case progress and ensure that staff complete each stage of an investigation and prosecution within an appropriate timeframe. The Unit maintains a record of these reviews in the case files or electronic case management system.

D. Significant delays to cases are documented and explained in the case files or electronic case management system.

E. The Unit pursues, when warranted for the case, the availability and use of appropriate technology, such as digital forensics, surveillance technology, and data analytics.

F. Unit staff are issued, or have appropriate access to, electronic devices and other technology to effectively perform their duties.

Performance Standard 6—Case Mix

A Unit's case mix, as practicable, covers all significant provider types and includes a balance of cases involving fraud and abuse or neglect of patients or residents. To determine whether a Unit meets this standard, OIG will consider the following performance indicators:

A. The Unit seeks to have a broad mix of cases among the significant provider types in the State and seeks to allocate resources among provider types based on levels of Medicaid expenditures or other objective measures of risk.

B. For those States that cover a significant number of Medicaid enrollees under managed care plans, the Unit investigates an appropriate number of cases arising in a managed care setting in its mix of cases.

C. The Unit investigates a balance of cases of fraud and cases of abuse or neglect of patients or residents, for those Units with the responsibility and jurisdiction to investigate or prosecute abuse or neglect of patients or residents.

Performance Standard 7—Maintaining Case Information

A Unit maintains case files in an effective manner and uses an electronic case management system that allows efficient access to case information and other performance data. To determine whether a Unit meets this standard, OIG will consider the following performance indicators:

A. The Unit has an electronic case management system that manages and tracks case information from initiation to resolution.

B. Case file documentation is included within the Unit's electronic case management system unless particular circumstances ( e.g., space limitations or security concerns) require the selective use of another storage system.

C. Case files or the electronic case management system include all relevant information, including investigative reports and data analyses.

D. Significant litigation documents, such as charging documents, judgments, and settlement agreements, are included in the case files.

E. Investigative reports, consistent with the Unit's policies and procedures, address all relevant aspects of the investigation and are accurate, clear, complete, concise, logically organized, timely, and objective.

F. The Unit's electronic case management system ensures the protection of sensitive data, case information, and confidential sources.

1. The Unit's information system, including the electronic case management system, complies with applicable State requirements pertaining to information security and breach reporting and with current cybersecurity standards and guidelines as maintained in either: (a) the applicable version of the U.S. Department of Justice FBI Criminal Justice Information Services Division (CJISD) “Security Policy,” CJISD-ITS-DOC-08140-5.9, or (b) the applicable version of the National Institute of Standards and Technology (NIST), special publication, “Security and Privacy Controls for Information Systems and Organizations,” NIST SP 800-53.

2. The Unit maintains documentation of its compliance with policies identified in subsection F1.

3. Any audits, reviews, or risk assessments of the Unit's information system are shared with OIG as a part of the Unit's annual recertification submission.

4. Any known security breaches are reported within 30 days of discovering the incident to the OIG Information Systems Security Officer, isso@oig.hhs.gov.

G. The Unit's electronic case management system allows for monitoring cases and for monitoring and reporting case outcome data to OIG as specified in 42 CFR 1007.17(a)(2).

H. The Unit stores nondocumentary evidence securely and records the evidence in an effective and accessible system.

Performance Standard 8—Cooperation With Federal and Other State Authorities on Fraud Cases

A Unit cooperates with OIG and other Federal and State agencies in the investigation and prosecution of Medicaid and other health care fraud. To determine whether a Unit meets this standard, OIG will consider the following performance indicators:

A. The Unit communicates on a regular basis with OIG and other Federal or State agencies investigating or prosecuting health care fraud in the State.

B. For criminal or civil cases that are regional or national in scope, the Unit collaborates with Federal agencies and other State MFCUs as appropriate.

C. The Unit cooperates and, as appropriate, coordinates with OIG's Office of Investigations and other Federal agencies on cases being pursued jointly, cases involving the same suspects or allegations, and cases that have been referred to the Unit by OIG or another Federal agency.

D. The Unit makes available, to the extent authorized by law and upon request by Federal investigators and prosecutors, all information in its possession concerning provider fraud or fraud in the administration of the Medicaid program.

E. For cases that require the granting of extended authority under 42 CFR 1007.11(a)(2) to investigate Medicare or other Federal health care fraud, the Unit seeks approval from the OIG regional Special Agent in Charge following procedures set by OIG or other relevant Federal Inspectors General under procedures set by those agencies.

F. For cases that have civil fraud potential, the Unit investigates and prosecutes such cases under State authority or refers such cases to OIG or the U.S. Department of Justice.

G. The Unit transmits to OIG, for purposes of program exclusions under section 1128 of the Social Security Act, all pertinent information on MFCU convictions, including joint cases. Pertinent information includes judgments of conviction, charging documents, plea agreements, and sentencing orders. Information will be provided within 30 days of sentencing, or as soon as practicable if the Unit encounters delays in receiving the necessary information from the court, as required by 42 CFR 1007.11(g)(3).

H. The Unit reports qualifying cases, as defined by 45 CFR 60.5, to the National Practitioner Data Bank, or successor data bases, within 30 days of sentencing or other reportable action.

Performance Standard 9—Program Recommendations

A Unit makes statutory or programmatic recommendations, when warranted and appropriate, to the State government. To determine whether a Unit meets this standard, OIG will consider the following performance indicators:

A. The Unit, when warranted and appropriate, makes statutory recommendations to the State legislature to improve the operation or effectiveness of the Unit, including amendments to the enforcement provisions of the State code.

B. The Unit, when warranted and appropriate, makes other regulatory or administrative recommendations regarding program integrity issues to the State Medicaid agency and to other agencies responsible for Medicaid operations or funding.

C. The Unit monitors and maintains records regarding actions taken by the State legislature and the State Medicaid agency or other agencies in response to Unit recommendations.

Performance Standard 10—Agreement With Medicaid Agency

A Unit periodically reviews its memorandum of understanding (MOU) with the State Medicaid agency to ensure that the MOU reflects current practice, policy, and legal requirements. To determine whether a Unit meets this standard, OIG will consider the following performance indicators:

A. The MOU complies with Federal regulations contained in 42 CFR 1007.9(d), “Relationship and agreement between Unit and Medicaid agency,” including: (1) an agreement for regularly scheduled meetings or communication with the Medicaid agency (and procedures for how the two agencies will coordinate their efforts), (2) procedures (as applicable) for managed care referrals as required by 42 CFR 438.608(a)(7), (3) a requirement that the Unit reviews the MOU at least every 5 years, and (4) an agreement that the Unit renegotiates the MOU as necessary to ensure that it addresses current law and practice.

B. The MOU meets other current Federal legal requirements as contained in law or regulation, including 42 CFR 455.21, “Cooperation with State Medicaid fraud control units,” and 42 CFR 455.23, “Suspension of payments in cases of fraud.”

C. The MOU is consistent with current Federal and State policy, including any policies issued by OIG or the Centers for Medicare & Medicaid Services (CMS).

D. Consistent with Performance Standard 4, the MOU establishes a process to encourage the receipt of an adequate volume and quality of referrals to the Unit from the State Medicaid agency and, as applicable, from managed care organizations.

E. The MOU incorporates by reference CMS's “Performance Standard for Referrals of Suspected Fraud from a Single State Agency to a Medicaid Fraud Control Unit.”

F. Consistent with 42 CFR 1007.11(c), the MOU specifies that overpayments will be referred to the State agency when the Unit is unable to recover such overpayments as a part of a fraud action.

Performance Standard 11—Fiscal Control

A Unit exercises proper fiscal control over Unit resources. To determine whether a Unit meets this standard, OIG will consider the following performance indicators:

A. The Unit promptly submits to OIG its preliminary budget estimates, proposed budget application, and Federal financial expenditure reports.

B. The Unit limits its requests for grant funding, including its requested staffing levels, to operational amounts and staffing levels that it reasonably expects to fulfill in the upcoming fiscal period.

C. The Unit makes reasonable efforts to employ the number of staff that is included in the Unit's budget application request as approved by OIG.

D. The Unit maintains a property inventory that is updated regularly to reflect all equipment (as defined under 2 CFR 200.1) under the Unit's control and includes all property that may contain personally identifiable information or sensitive information or may be a potential security concern, such as computing devices, weapons, and investigative tools ( e.g., surveillance video or audio equipment).

E. The Unit maintains an effective time and attendance system and personnel activity records.

F. The Unit applies generally accepted accounting principles in its control of Unit funding.

G. The Unit employs a financial system in compliance with the standards for financial management systems contained in Federal grant administration requirements.

Performance Standard 12—Training

A Unit conducts training that aids the mission of the Unit. To determine whether a Unit meets this standard, OIG will consider the following performance indicators:

A. The Unit maintains a training plan for each professional discipline that includes an annual minimum number of training hours and that is at least as stringent as required for professional certification.

B. The Unit ensures that professional staff comply with their training plans and maintains records of completed training.

C. Professional certifications are maintained for all staff, including those that fulfill continuing education requirements.

D. The Unit participates in MFCU-related training, including training offered by OIG, other MFCUs, and other relevant organizations, as such training is available and as funding permits.

E. The Unit participates in cross-training with the fraud detection staff of the State Medicaid agency. As part of such training, Unit staff provide training on the elements of successful fraud referrals and receive training on the role and responsibilities of the State Medicaid agency. Unit training of Medicaid staff should be supplemented as appropriate with training for staff of managed care special investigations units.

[FR Doc. 2024-20416 Filed 9-17-24; 8:45 am]