External Audits: CMS Validation Audits and … Audits: CMS Validation Audits and Beyond. 1. ......
25
Presented by Julie Mason, Medicare Compliance Solutions June 21, 2017 External Audits: CMS Validation Audits and Beyond
Transcript of External Audits: CMS Validation Audits and … Audits: CMS Validation Audits and Beyond. 1. ......
Presented by Julie Mason, Medicare Compliance SolutionsJune 21, 2017
External Audits:CMS Validation Audits
and Beyond
1. CMS Validation Audits– The why, who, when, what and how
2. Other External Audits– Types and reasons for them
– Advantages
– Pitfalls
TODAY’S AGENDA
Which audits are we talking about?
Post-CMS Program Audit Validation
– Not marketplace Initial Validation Auditor (i.e., part of the HHS-RADV audit process)
– Not data validation audits
RAD-V audits
Part C and D data validation audits (Pt. C/D reporting requirements)
CMS Validation Audits
The 4 Ws (and an H):
Why did CMS move to external validation auditors?
Who can/should plans hire as an IA?
When should we hire an IA and what are the timeframes of a validation
audit?
What will the IA audit and what can we expect from the IA?
How should we prepare for a validation audit?
CMS Validation Audits
Why did CMS move to external (independent) validation auditors?
In 2015, CMS began requiring the use of Independent Auditors (IAs) to validate correction of CMS-identified deficiencies in program audits.
Budget savings
Shifts financial burden to non-compliant plans
CMS Validation Audits—the “Why”
Selecting an Independent Auditor
CMS criteria:
1. Independent and free of conflicts of interest that would prevent, or give the appearance of preventing, the IA from providing an objective assessment of the Sponsor’s performance, including current or prior consulting relationships.
CMS Validation Audits—the “Who”
So what does this mean?
The IA cannot be an employee(s), an FDR, a contractor or a sub-contractor.
– In practice, CMS has approved IAs that are contracted with the plan for separate and unrelated work.
Example:
An MAO contracts with an outside firm to review the accuracy of the MA provider directory. CMS approves that firm as the plan’s IA because they have significant Medicare Part C and D experience and their provider directory work for the plan isn’t related to the CMS-audited areas of CPE, ODAG, CDAG, or FA.
CMS Validation Audits—the “Who”
2. The IA must have subject matter expertise in the areas of Medicare Part C & Part D.
– CMS reviews the IA’s background to determine if there is sufficient Medicare Part C and Part D expertise.
There are many new entrants into the Medicare consulting field. Is it better to hire a less experienced IA or a very experienced one?
CMS Validation Audits—the “Who”
Tips for the selecting an IA:
1. Research all you can about a potential IA before contacting them.
2. Ask for referrals from other health plans (but not from CMS!)
3. Consider current or previous contractors who are/were not involved in any related aspect of the CMS program audit.
5. Ask for references (especially previous IA clients).
6. Do not automatically choose the lowest bidder.
– Increased competition from new entrants
CMS Validation Audits—the “Who”
4. Ask LOTS of questions:– How many validation audits (for CMS program audits) has your firm conducted
since 2015?
– How much experience does your firm have using the CMS audit protocols? How closely would you follow the CMS protocols for a validation audit?
– Who would lead the validation audit? Who will else would be on the audit team? What Medicare Part C/D experience do they each have? How “deep is the bench,” in case you have to replace team members?
– Do any of the audit team members have CMS experience? What relationships have you established with CMS staff?
– If one area is remediated before another, are you willing to conduct the validation audit at separate times, if approved by CMS?
CMS Validation Audits—the “Who”
CMS Validation Audits—the “When”
CMS Final Audit
Report
Submission of CAP
CMS Approval of
CAP
Start of 150 days
CAP implementation
Clean period
Validation Audit
CEO attestation
End of 150 daysStart the IA search
When should we start the search for an IA?
What are the timeframes of the audit?
CMS Validation Audits—the “When”
Work plan development
CMS review, discussions,
revisions, approval
Validation activities:
• Universe submission
• Universe integrity webinars
• Case sample webinars
• CPE tracer webinars
• Interviews
• Documentation reviews
Draft validation audit report
CMS review, discussions,
revisions, approval
1-2 weeks
2-3 weeks
4-8 weeks
2-3 weeks
2-3 weeks
~ 10-20 weeks
What will the IA audit?
CMS: “The purpose of the validation review is for the Sponsor to demonstrate corrections of the conditions of non-compliance identified in the final CMS audit report and to serve as the basis for the CEO attestation that the conditions are corrected and are not likely to recur.”
The scope of the audit is therefore focused on the operational activities or compliance issues that were cited as conditions (CARs and ICARs) cited in the CMS audit report.
CMS Validation Audits—the “What”
What will the IA audit? (cont.)
IAs generally follow the CMS audit protocol:
– Not a document review, though reviews may include some documents;
– Universe integrity tests;
– All universes relevant to a finding May be more than the universe in which the condition was found
– Case sample reviews.
What if the clean period results in 0 cases?– IA will use other means of evaluation (P&Ps, meeting minutes, etc.)
CMS Validation Audits—the “What”
What if the review uncovers additional conditions not cited in the CMS audit report?
The validation audit does not “seek out” additional conditions, but sometimes results in their discovery.
CMS has stated that the IA should:
– Request a beneficiary impact analysis from the health plan;
– Report the new conditions in the final validation audit report.
CMS will then determine how to proceed with these new identified issues.
CMS Validation Audits—the “What”
What can we expect from the validation audit/auditor?
Clear communication:
– Pre-audit (audit work plan, discussions with health plan and CMS);
– During the webinars, including results of the case sample reviews;
– The final validation audit report should include sufficient detail for CMS to determine whether the condition has been adequately remediated.
CMS Validation Audits—the “What”
What can we expect from the validation audit/auditor?
Transparency: The IA should be clear and forthcoming about how and when they will be conducting each part of the audit, and how they will be evaluating remediation of the condition.
Independence: although you have hired the IA, they are representing CMS.
Flexibility: things don’t always go according to plan.
CMS Validation Audits—the “What”
How should we prepare for a validation audit?
Much the same way as for a CMS program audit:
– Give it high priority;
– Develop a road map;
– Ensure accurate universes, run universes prior the audit;
– Test the technology beforehand;
– Ensure FDR availability, as applicable;
– Conduct a CMS audit refresher course;
– Assign roles (plan audit lead, primary speaker for webinars, notetakers, etc.);
– Provide follow-up documentation and impact analyses timely.
CMS Validation Audits—the “How”
Other External Audits
Why hire an external auditor?
Short staffed/resource limitations
Inexperienced staff
Outside perspective
Annual CPE audit
External Audits
Hide known issues;
Dictate the audit outcome/findings.
The health plan should not…
Establish the objectives of the audit;
Define the scope;
Approve the process;
Set the pace;
Receive status updates from the auditor.
The health plan should…
External Audits
This is YOUR audit…make the most of it!
Advantages of an outside perspective:
Gain insights/best practices learned from other MA plans/PDPs.
Learn what CMS is looking for, what their perspective is.
Identify additional risks/avoid poor CMS audit results.
Achieve annual compliance goals.
Demonstrate to the BOD or other governing body that the Compliance Department (or other auditing department) is on the right track.
External Audits
What to avoid:
A one-size-fits all approach
– There is no one “right” way to conduct an audit, even using the CMS audit protocols.
Lack of flexibility of the external auditor
Objectives that are not well-defined
– Know why you are seeking an external audit
– What are you trying to get out of it?
An audit report lacking specificity
– Ask for more written detail if needed
External Audits
Questions?
Medicare Compliance Solutions (MCS) is a well-respected, successful independent consulting practice that provides clients with high-quality service delivered in a timely, efficient, and affordable manner. Our goal is to help organizations understand and implement the CMS and State regulations in a manner that ensures compliance, provides the highest quality service to Medicare beneficiaries, and is in concert with corporate financial goals.
MCS was created in 2010 and has continually proven itself to be an industry leader for high quality solutions. MCS is strongly committed to serving the specific needs of its clients; has developed effective solutions based on decades of experience in the health plan and regulatory environments; and provides actionable insights and recommendations for optimizing performance in all Medicare Part C and D functional areas.
T
E
T
E
Principal
415.596.5277
6/12/2017COPYRIGHT © 2017 MEDICARE COMPLIANCE SOLUTIONS 25
JULIE MASON
