Each year, the Centers for Medicare and Medicaid Services (CMS) issues its Part C and Part D Program Audit and Enforcement Report. I liked how CMS did it in years past, where actual plan audit scores as well as average scores by audit area were released. It gave you a great feel for where plans were struggling the most.
Nonetheless, the report continues to be a good tool for Medicare Advantage (MA) and Part D plans (MA-PD or standalone PDP) to review and hone their compliance chops. Here are the major findings from this most recent report (link at bottom). As well, I will go through what I heard about 2024 audits from plan friends and contacts.
Background
CMS has been expanding the audits it does, using both internal and external expertise. In 2023, a total of 69 MA-PD contracts were audited — 31 of these contracts offered special needs plans (SNPs). CMS also audited 14 PDP contracts, one 1876 Cost plan, and 4 Medicare-Medicaid Plan (MMP) contracts. It thus was able to audit all five of the traditional program audit areas as well as the two MMP areas.
Findings of note
Compliance Program Effectiveness (CPE):
CMS has been paying a lot of attention here, especially in the area of delegated oversight. In the past this has been a relatively easy area for plans to comply. But more recently, CMS has seen more issues here. It has been very concerned about a plan’s oversight of delegated sales and marketing entities, such as Third Party Marketing organizations (TPMOs). Due to complaints, CMS has instituted new oversight requirements for plans as well as sought to overhaul compensation. The compensation rule recently was stayed in federal court. Thus the compensation reform is on hold and CMS will need to up its oversight of plans in this area.
In this area in 2023, CMS found that:
- Compliance issues were not tracked, addressed, and corrected.
- Compliance departments were not aware of internal auditing and monitoring results.
- Turnover within the organization interfered with planned oversight activities.
CMS recommends that plans have clear procedures for timely communication of auditing and monitoring results to the compliance department. I would add that too many plans fail to implement best practice oversight of all their delegated vendors. Using a best practice agenda (with all delegated areas covered) and monthly or quarterly meetings would go a long way to achieving better oversight and identifying non-compliant activities. If you don’t ask your delegates if they are compliant in all areas, they will not tell you where the problems lie.
Formulary Administration (FA):
FA has always been a trouble spot for plans. CMS has been focused on ensuring correct claims system configuration of the formulary and tiers, cost-sharing, transition, and utilization management edits.
In this area in 2023, CMS found:
- Claims were inappropriately rejected at point of sale.
- Enrollee eligibility files were not updated timely to reflect active coverage.
- Prior authorization edits for new starts were not configured correctly to recognize enrollees with prior claims history of the medication.
CMS recommends that plans tailor their monitoring of rejected claims to identify patterns that may be indicative of errors in their systems. I think this is a wise recommendation. Plans simply do not spend enough time looking at claim reports to find these patterns arising from improper claims configuration.
Coverage Determinations, Appeals, and Grievances (CDAG):
CMS has always been very active on the CDAG front. In my years of tracking, I would say this is perhaps the audit area that gets the greatest oversight. Auditors tend to go deep into cases, including timeliness, medically necessity criteria, appropriate decision-making, and clear and concise direction on denials. As a plan executive, I or one of my deputies would review such reports each day.
In this area in 2023, CMS found:
- Coverage requests were misclassified and processed only as grievances.
- Staff did not recognize complaints about access to, or cost of, medications as coverage requests.
- Dismissal notice templates were not updated to include the reason for the dismissal, the right to request the plan vacate the dismissal or the right to request redetermination of the dismissal.
Note the reference above to vacating the dismissal. CMS’ new regulations require plans to have a dual strategy to help members receive needed drugs quicker. It is surprising that plans continue to struggle with appropriate classification of requests. This is easily addressed with training, job aids (which CMS has published) and auditing of workers’ cases.
CMS recommends that plans ensure that they are referencing the most current CMS guidance and regulatory requirements when processing coverage requests.
Organization Determinations, Appeals, and Grievances (ODAG)/Medicare Medicaid Plan – Service Authorization Requests, Appeals, and Grievances (MMP-SARAG):
I have found that while pharmacy turnaround times were faster and audit standards greater, plans always seemed to struggle more with the ODAG area. Historically, audit scores in this area were worse than CDAG. Part of the issue could be the sheer volume of requests. Further, medical drugs now must be processed much more quickly and timeframes now match Part D CDAG.
In 2023, the same trend seems to hold. In this area in 2023, CMS found:
- Requests were not processed timely.
- Challenges with implementing new systems resulted in processing delays.
- Plans experienced increased workloads and staffing shortages.
- Established procedures were not fully understood and/or followed.
- Requests were inappropriately dismissed.
- Outreach for necessary clinical information was not conducted prior to dismissing requests.
- Misrouted requests were dismissed rather than sent to the appropriate department.
- Notifications were incorrect or incomplete.
- Dismissal notification templates did not contain the enrollee’s right to request the plan vacate its dismissal.
- Non-contracted providers received remittance advices that did not include a direct link to the waiver of liability form.
- Reasons for denial were not specific to requested services.
CMS recommends that plans’ oversight processes should focus on both content and timeliness of notifications, including specific criteria applied to reach medical necessity determinations.
Special Needs Plans Care Coordination (SNPCC)/Medicare-Medicaid Plan Care Coordination (MMPCC):
CMS has been busy honing its regulatory approach for SNP Model of Care )MOC) and requirements and oversight have become far more rigorous. We can expect SNP MOC audit protocols to become stricter over time as CMS seeks to further integrate Medicare and Medicaid and as SNP growth explodes. SNP enrollment has now reached over 20% of all MA members.
Because the SNP protocols are newer, audit results have been the most negative in recent years (the highest scores). CMS has always put a premium on timely execution of health risk assessments and care plans as well as the ongoing update of such plans when a member’s status or risk changes. CMS also wants to understand what SNP plans are doing to proactively improve outcomes and health when issues are identified. It is also important to remember that a plan is graded not only on the SNP regulations but also how a plan complies with its filed Model of Care.
In this area in 2023, CMS found:
- Individualized care plans (ICPs) were inconsistent with plans’ approved models of care or were not updated timely.
- ICPs were not comprehensive or did not account for changes in health risk assessments, the health status, or care transitions of enrollees.
- Communication around care coordination was ineffective across care settings during transitions.
CMS recommends that plans’ communication include all members of the Interdisciplinary Care Team to help support effective care management.
Other recommendations/findings
CMS includes a section on suggestions for a successful audit.
CMS imposed 15 civil monetary penalties (CMS) for either program audits or financial audits. The areas fined include:
- Inappropriate cost sharing for Part C services/Part D medications
- Inappropriate denials/delays of Part D medications/Part C services
- Misclassification of Part D coverage requests
- Non-Contract Provider Denial Notice Appeal Rights
- Inappropriate Dismissals
- Inappropriate Part D Premium
In terms of claims payment and appropriate processing of claims, CMS recommends the following:
- It is important for sponsors to ensure that Part D claims are processed using the correct beneficiary enrollment and eligibility information. It notes that there are incorrect member loads or delays from the plan system of record to the phamacy benefits manager (PBM).
- It is important that plans have effective oversight over its Part C claims processing system. They should conduct routine monitoring, perform system updates, and test system configurations to ensure claims are processed in accordance with each plan benefit design.
2024 audit insights
CMS’ regular program audits were supplemented with ad hoc audits concerning the 2024 rule requiring major changes to how MA plans perform prior authorization (PA) and utilization management (UM). In addition to adding the ad hoc audits for those under regular program audit, some plans were also noticed for just an ad hoc audit.
In general, the new rule requires plans to use the traditional Medicare fee-for-service (FFS) program coverage criteria (National Coverage Determinations (NCD) and Local Coverage Determinations (LCD)) instead of their own evidenced-based criteria.
In terms of the ad hoc audits and portions of program audits devoted to the 2024 rule, CMS did not seem to have its bearings yet on how to oversee the rule. There was much confusion. Auditors were ensuring policies related to the new rule are in place, including continuity of care; processes to follow the FFS criteria vs. the plan’s own criteria; validation that plan criteria is evidenced-based per the rule; the presence of a UM committee and policies to review and update UM policies; the availability of the criteria to the public; and the use of physicians with appropriate qualifications for PA reviews. A tracer approach was used to validate all this.
During the ad hoc audits, CMS had a physician review of a sample of denied prior authorizations for the period of the audit. From what I have heard, inpatient authorizations were not heavily reviewed for the new “two-midnight” standard. CMS may not have been ready to challenge plans on this yet. Post-acute care standards will also be looked at in the future. The two-midnight inpatient and post-acure areas represent the biggest changes for plans.
As for the regular program audit areas, much of what occurred in 2024 matched 2023, with one catch – plans report that the level of scrutiny increased dramatically. In part due to the new 2024 rule, auditors were extremely diligent in diving deep into each case end to end and examining the decision-making and criteria used for both medical and retail drugs cases. As well, a major focus and concern was the appropriateness of correspondence back to the member and provider to ensure any denial was clearly spelled out and what the next steps would be to obtain the service or drug.
Additional trends included (I am repeating some findings given their importance):
CPE: A focus on appropriate delegated oversight continued. CMS asked how plans were overseeing their delegates and how they were intervening to ensure compliance. It also raised issues with internal deficiencies in oversight.
FA: A focus on correct claims configuration and UM edits to ensure correct member cost-sharing per its usual approach. I cannot emphasize enough CMS’ focus here as well as within financial audits. A long-running finding has been that MA plans do not configure and test their PBM claims’ correctly, leading to denial of formulary drugs, unapproved utilization management edits, and wrong cost-sharing. In addition, the newest trend is CMS focusing in on eligibility updates to the PBM system. It is finding delays in updating information, which leads to incorrectly processed drug requests. There should be no lag (or no more than a very short lag of a few hours) between eligibility flow from CMS to the plan and the plan to the PBM.
CDAG: The continuing deep dive into all aspects of the pharmacy request, from timeliness to decision-making to appropriate communication. In addition, plans still struggle with correct classification of simple inquiries, coverage requests, appeals, and grievances. Remember that you may have to classify an request as both a grievance and as a coverage request/appeal. In addition, you must check whether a request has previously been processed, which would make a new one an appeal.
ODAG: Similarly, there was an end-to-end focus on the case and attention to appropriate decision-making and communication. Some key focuses here: (1) adequate outreach to provders for additional information; (2) clear and concise denial language and appeals rights in correspondence; and (3) correct classification as with CDAG.
SNP MOC: Continued focus on assessments, care plans, and interventions. CMS continues to demand new ways to identify risks and intervene timely in care for every member in a SNP. See my blog Thursday for details on some of the key new requirements from CMS on SNPs.
Financial Audits: As noted above, CMS is going deep into ensuring no beneficiary harm from the standpoint of what is charged a member in cost-sharing. A constant auditing of the configuration of the PBM and medical claims system is key along with ongoing eligibility updates to each.
Report: https://www.cms.gov/files/document/2023-program-audit-enforcement-report.pdf
#cms #medicareadvantage #partd #pdp #regulations #audits
— Marc S. Ryan
