CMS is upping the ante on program audits, enforcement, and penalties
Each year, the Centers for Medicare and Medicaid Services (CMS) issues its Part C and Part D Program Audit and Enforcement Report. I liked how CMS did it in years past, where actual plan audit scores as well as average scores by audit area were released. It gave you a great feel for where plans were struggling the most.
Nonetheless, the report continues to be a good tool for Medicare Advantage (MA) and Part D plans (MA-PD or standalone PDP) to review and hone their compliance chops. Here are the major findings from this most recent report and last year’s (link at bottom for 2023 and 2024 reports).
Background
CMS has been expanding the audits it does, using both internal and external expertise. In 2023, a total of 69 MA-PD contracts were audited — 31 of these contracts offered special needs plans (SNPs). CMS also audited 14 PDP contracts, one 1876 Cost plan, and 4 Medicare-Medicaid Plan (MMP) contracts. It was thus able to audit all five of the traditional program audit areas as well as the two MMP areas.
In 2024, CMS significantly expanded the footprint audited. CMS conducted 39 total program audits of 36 parent organizations in 2024: 19 of the audits were routine (i.e., full-scope program audits) and the remaining 20 were focused audits (i.e., limited program areas were audited).
The routine audits covered over 14.9 million Medicare beneficiaries. The routine audits covered:
• 181 MAPD contracts, with 103 of these contracts offering SNPs
• 10 PDP-only contracts
• One 1876 Cost plan
• 12 MMP contracts
The focused audits covered an additional 290 MA or MA-Part D (MA-PD) contracts and nearly 24.3 million Part C beneficiaries.
In total, 2024 program audits covered 494 contracts — 87.6% of the total Medicare Part C population and 68.8% of the total Medicare Parts C and D population.
Findings overview
Note that I am including findings from 2023 audits and 2024 routine audits so you can document trends and emerging issues found.
CMS outlines the five audit protocol areas. I am not covering that here but it is in the report. But I do want to note that 2024 audits represented CMS’s first thorough opportunity to assess compliance with some of the Part C utilization management (UM) requirements finalized for 2024 (In 2023, it did do ad hoc audits on progress toward implementing the 2024 rule.) have been very critical of applying traditional fee-for-service (FFS) coverage criteria to a managed care program. It takes the managed out of managed care. Some plans have seen costs increases, especially with inpatient care and post-acute care. This will undoubtedly increase over time.
Specifically here, CMS assessed whether plans:
• Complied with national coverage determinations (NCDs), local coverage determinations (LCDs), and coverage and benefit conditions included in the traditional program.
• Used internal coverage criteria (ICC) when the plan determined Medicare coverage criteria was not fully established.
• Denied a service based on lack of medical necessity when it previously approved the service through prior authorization.
• Used a physician or other appropriate healthcare professional with expertise in the field of medicine or healthcare that is appropriate for the service at issue when it expects to issue an adverse medical necessity decision.
• Made internal coverage criteria publicly accessible.
• Established a utilization management committee (UMC) to develop and review all utilization management policies and procedures.
Compliance Program Effectiveness (CPE) findings:
CMS has been paying a lot of attention here, especially in the area of delegated oversight. In the past this has been a relatively easy area for plans to comply. But more recently, CMS has seen more issues here. It has been very concerned about a plan’s oversight of delegated sales and marketing entities, such as Third Party Marketing Organizations (TPMOs). Due to complaints, CMS has instituted new oversight requirements for plans as well as sought to overhaul compensation, but the compensation rule was stayed in federal court. Thus, the compensation reform is on hold and CMS will need to up its oversight of plans in this area.
In this area in 2023, CMS found that:
- Compliance issues were not tracked, addressed, or corrected.
- Compliance departments were not aware of internal auditing and monitoring results.
- Turnover within the organization interfered with planned oversight activities.
In this area in 2024, CMS found that:
- Compliance issues continued not to be tracked, addressed, and corrected.
- Internal routine monitoring processes did not detect untimely notifications to enrollees when a delegated entity misinterpreted regulatory requirements.
In 2023, CMS recommended that plans have clear procedures for timely communication of auditing and monitoring results to the compliance department.
In 2024, CMS recommended that plans implement routine monitoring to oversee their delegated entities in order to ensure CMS regulations are being followed. I
would add that too many plans fail to implement best practice oversight of all their delegated vendors. Using a best practice agenda (with all delegated areas covered) and monthly or quarterly meetings would go a long way to achieving better oversight and identifying non-compliant activities. If you don’t ask your delegates if they are compliant in all areas, they will not tell you where the problems lie.
Formulary Administration (FA) findings:
FA has always been a trouble spot for plans. CMS has been focused on ensuring correct claims system configuration of the formulary and tiers, cost-sharing, transition, and utilization management edits.
In this area in 2023, CMS found:
- Claims were inappropriately rejected at the point of sale.
- Enrollee eligibility files were not updated timely to reflect active coverage.
- Prior authorization edits for new starts were not configured correctly to recognize enrollees with prior claims history of the medication.
In this area in 2024, it appears CMS upped its review and found many technical violations:
- Plans inappropriately limited access to covered drugs on their formulary by applying unapproved edits, incorrectly effectuating authorizations, or improperly processing enrollment and eligibility. Beneficiaries were inappropriately restricted to a single strength or dosage form when plans effectuated the approved medication in their systems. It noted this restricts enrollee access to medications and increases provider burden by requiring the submission of a new coverage request for the same medication. Unintended quantity restrictions or inappropriate application of day supply limits on pre-packaged medications below the plan benefit allowance also prevented enrollees from receiving the necessary prescribed quantity. As well, inadvertent termination of enrollees when updating eligibility files prevented enrollees from accessing necessary medications.
- Plans did not provide temporary Part D transition supply allowances under required rules. Transition-eligible medications or transition supply notices were not provided due to improper coding logic. This restricts enrollee access to medications and prevents enrollees from understanding the steps needed to submit a coverage determination to obtain the medication or switch to an alternate medication. Enrollees with an established history of using a medication for Part D indications also were prevented from receiving transition-eligible medications due to the application of inappropriate medically accepted indication edits. Finally, continuing-enrollee claims history was not migrated in plans’ systems preventing enrollees from receiving transition fills.
In 2023, CMS recommended that plans tailor their monitoring of rejected claims to identify patterns that may be indicative of errors in their systems. This is a wise recommendation. Plans simply do not spend enough time looking at claim reports to find these patterns arising from improper claims configuration.
In 2024, CMS says it does not want to get into the middle of claims configuration and effectuation logic, but notes that plans need to ensure coverage for medication strengths and dosage forms subject to the same formulary criteria. If a medication requires prior authorization, and that prior authorization requirement is the same for all doses of the medication, the plan should not limit the effectuation of the drug to a specific dosage. CMS recommends that plans consider whether effectuation of a drug should be done more broadly in situations where the formulary requirements do not change for different strengths or doses.
Coverage Determinations, Appeals, and Grievances (CDAG) findings:
CMS has always been very active on the CDAG front. In my years of tracking, I would say this is perhaps the audit area that gets the greatest oversight. Auditors tend to go deep into cases, including timeliness, medical necessity criteria, appropriate decision-making, and clear and concise directions on denials. As a plan executive, I or one of my deputies would review such reports each day.
In this area in 2023, CMS found:
- Coverage requests were misclassified and processed only as grievances.
- Staff did not recognize complaints about access to, or cost of, medications as coverage requests.
- Dismissal notice templates were not updated to include the reason for the dismissal, the right to request the plan vacate the dismissal or the right to request redetermination of the dismissal.
Note the reference above to vacating the dismissal. CMS’ new regulations require plans to have a dual strategy to help members receive needed drugs quicker.
In this area in 2024, CMS found:
- Valid requests for coverage were dismissed due to a misinterpretation of CMS guidance.
- Coverage requests were misclassified or inappropriately dismissed resulting in enrollee delays in accessing medications.
- Internal processes for correctly classifying coverage requests were insufficient and/or not followed.
- Requests for coverage were inappropriately processed, causing enrollees to experience delays in receiving necessary medications.
- Electronic prior authorization (ePA) configuration logic processed redetermination (appeal) requests as initial requests when ePA cases were submitted with different National Provider Identifiers (NPIs).
- Clinical reviewers overlooked pertinent clinical information when considering coverage requests resulting in inappropriate decisions.
It is surprising that plans continue to struggle with appropriate recognition and classification of requests. This is easily addressed with training, job aids (which CMS has published) and auditing of workers’ cases for process improvement and retraining.
In 2023, CMS recommended that plans ensure that they are referencing the most current CMS guidance and regulatory requirements when processing coverage requests.
In 2024, CMS recommended that plans ensure they put appropriate safeguards in place to ensure they recognize and process coverage requests; including coverage requests that come in through electronic systems and/or the call center.
Organization Determinations, Appeals, and Grievances (ODAG)/Medicare Medicaid Plan – Service Authorization Requests, Appeals, and Grievances (MMP-SARAG) findings:
I have found that while pharmacy turnaround times were faster and audit standards greater, plans always seemed to struggle more with the ODAG area. Historically, audit scores in this area were worse than CDAG. Part of the issue could be the sheer volume of requests. Further, medical drugs now must be processed much more quickly, and timeframes now match Part D CDAG.
In 2023, the same trend seems to hold. In this area in 2023, CMS found:
- Requests were not processed timely.
- Challenges with implementing new systems resulted in processing delays.
- Plans experienced increased workloads and staffing shortages.
- Established procedures were not fully understood and/or followed.
- Requests were inappropriately dismissed.
- Outreach for necessary clinical information was not conducted prior to dismissing requests.
- Misrouted requests were dismissed rather than sent to the appropriate department.
- Notifications were incorrect or incomplete.
- Dismissal notification templates did not contain the enrollee’s right to request the plan vacate its dismissal.
- Non-contracted providers received remittance advices that did not include a direct link to the waiver of liability form.
- Reasons for denial were not specific to requested services.
In this area in 2024, CMS found:
- Decision notifications were incorrect or incomplete which prevented enrollees and/or providers from appropriately advocating for services. Dismissal notification templates did not contain enrollees’ right to request the plan vacate its dismissal. When cases were partially denied, notifications did not clearly specify what services, items or drugs were approved/denied.
- Requests for coverage were inappropriately delayed. Internal processes used to review coverage requests were insufficient to ensure enrollees were notified of decisions timely. Reviewers overlooked pertinent clinical information when processing coverage requests that indicated services should be approved. Coverage denials were inadvertently issued due to a system logic error.
In 2023, CMS recommended that plans’ oversight processes should focus on both content and timeliness of notifications, including specific criteria applied to reach medical necessity determinations.
In 2024, CMS recommended that plans ensure an enrollee’s medical history (for example, diagnoses, conditions, functional status,), physician recommendations, and clinical notes are considered prior to issuing an adverse medical necessity decision.
Special Needs Plans Care Coordination (SNP-CC)/Medicare-Medicaid Plan Care Coordination (MMP-CC) findings:
CMS has been busy honing its regulatory approach for SNP Model of Care (MOC) and requirements and oversight have become far more rigorous. We can expect SNP-CC audit protocols to become stricter over time as CMS seeks to further integrate Medicare and Medicaid and as SNP growth explodes. SNP enrollment has now reached over 20% of all MA members.
Because the SNP protocols are newer, audit results have been the most negative in recent years (the highest scores). CMS has always put a premium on timely execution of health risk assessments and care plans as well as the ongoing update of such plans when a member’s status or risk changes. CMS also wants to understand what SNP plans are doing to proactively improve outcomes and health when issues are identified. It is also important to remember that a plan is graded not only on the SNP regulations but also on how a plan complies with its filed Model of Care.
In this area in 2023, CMS found:
- Individualized care plans (ICPs) were inconsistent with plans’ approved models of care or were not updated timely.
- ICPs were not comprehensive or did not account for changes in health risk assessments (HRAs), the health status, or care transitions of enrollees.
- Communication around care coordination was ineffective across care settings during transitions.
In this area in 2024, CMS found:
- ICPs did not address all the results from enrollee HRAs or include measurable outcomes. Results from the HRA were not carried over to the ICP as a starting point for prioritizing care and goal development. Plans relied on a risk stratification system that categorizes enrollees according to their health status, rather than using the individualized results of the HRAs, to determine which conditions should be included in the ICP. This limits the conditions incorporated into the ICP and prevents enrollees from determining which conditions they want to pursue as part of their care plan.
In 2023, CMS recommended that plans’ communication include all members of the Interdisciplinary Care Team to help support effective care management.
In 2024, CMS recommended that comprehensive ICPs include identifying goals and objectives, including measurable outcomes, considering all results from the HRAs, while focused on conditions an enrollee chooses to pursue.
Focused audits on 2024 UM rule findings
Again, CMS appears to be going slow here and allowing plans time to acclimate to the new rule. CMS says that plans are:
- Working to implement the new requirements
- Generally adhered to coverage criteria in applicable National Coverage Determinations (NDCs) and Local Coverage Determinations (LCDs)
- Applied ICC to ensure consistent decision making for medically necessary services
- Conducted appropriate oversight of adverse decisions by appropriate physicians
- Established UMCs in an effort to meet CMS requirements.
I hear that CMS is slowly scrutinizing how plans have adhered to the new rule given the short timeframe it was actually in force. No doubt, the scrutiny will increase in future audit years especially as it relates to application of the two-midnight policy for inpatient admissions and post-acute care reviews.
Other recommendations/findings
CMS includes a section on suggestions for a successful audit.
In 2023, CMS imposed 15 civil monetary penalties (CMPS) totaling about $450,000 for either program audits or financial audits. The areas fined include:
- Inappropriate cost sharing for Part C services/Part D medications
- Inappropriate denials/delays of Part D medications/Part C services
- Misclassification of Part D coverage requests
- Non-Contract Provider Denial Notice Appeal Rights
- Inappropriate Dismissals
- Inappropriate Part D Premium
In 2024, CMS imposed 14 CMPs totaling over $2.9 million for either program audits or financial audits. One fine to Centene for a financial audit was $2 million, but CMPs sill increased dramatically from 2023 to 2024.
The areas fined in 2024 include:
- Inappropriate cost sharing for Part C services and Part D drugs
- Inappropriate denials or delays of Part D drugs
- Misclassification of drug coverage requests
In terms of claims payment and appropriate processing of claims, CMS recommends the following:
- It is important for plans to ensure that Part D claims are processed using the correct beneficiary enrollment and eligibility information. It notes that there are incorrect member loads or delays from the plan system of record to the pharmacy benefits manager (PBM). Inappropriately denied claims must be addressed after eligibility is corrected. The same is true for reprocessing cost-sharing for Low Income Subsidy (LIS) errors or updates.
- It is important that plans have effective oversight over their Part C claims processing system. They should conduct routine monitoring, perform system updates, and test system configurations to ensure claims are processed in accordance with each plan benefit design.
Final insights
As for the regular program audit areas, much of what occurred in 2024 matched 2023. Plans report that the level of scrutiny is increasing dramatically. Auditors have become extremely diligent in diving deep into each case end to end and examining the decision-making and criteria used for both medical and retail drugs cases. As well, a major focus and concern was the appropriateness of correspondence back to the member and provider to ensure any denial was clearly spelled out and what the next steps would be to obtain the service or drug.
Additional trends included (I am repeating some findings given their importance):
FA: A focus on correct claims configuration and UM edits to ensure correct member cost-sharing per its usual approach. I cannot emphasize enough CMS’ focus here as well as within financial audits. A long-running finding has been that MA plans do not configure and test their PBM claims’ correctly, leading to denial of formulary drugs, unapproved utilization management edits, and wrong cost-sharing. In addition, the newest trend is CMS focusing in on eligibility updates to the PBM system. It is finding delays in updating information, which leads to incorrectly processed drug requests. There should be no lag (or no more than a very short lag of a few hours) between eligibility flow from CMS to the plan and the plan to the PBM.
CDAG: The continuing deep dive into all aspects of the pharmacy request, from timeliness to decision-making to appropriate communication. In addition, plans still struggle with correct classification of simple inquiries, coverage requests, appeals, and grievances. Remember that you may have to classify a request as both a grievance and as a coverage request/appeal. In addition, you must check whether a request has previously been processed, which would make a new one an appeal. Most important, clinicians must review all clinical information and apply each person’s circumstances in case decision-making.
ODAG: Similarly, there was an end-to-end focus on the case and attention to appropriate decision-making and communication. Some key focuses here: (1) adequate outreach to providers for additional information; (2) clear and concise denial language and appeals rights in correspondence; (3) correct classification as with CDAG; and (4) clinician review of pertinent clinical information.
SNP-CC: Continued focus on assessments, care plans, and interventions. CMS continues to demand new ways to identify risks and intervene timely in care for every member in a SNP. CMS is moving beyond HRAs’ compliance to examining whether ICPs address all known problems identified for the member. Comprehensiveness of the ICP is key.
Financial Audits: As noted above, CMS is going deep into ensuring no beneficiary harm from the standpoint of what is charged a member in cost-sharing. A constant auditing of the configuration of the PBM and medical claims system is key along with ongoing eligibility updates to each.
Reports:
2023: https://www.cms.gov/files/document/2023-program-audit-enforcement-report.pdf
2024: https://www.cms.gov/files/document/2024-audit-and-enforcement-report.pdf
#cms #medicareadvantage #partd #pdp #regulations #audits
— Marc S. Ryan
