Medicaid; Revisions to State Medicaid Fraud Control Unit Rules, 64383-64401 [2016-22269]

Agencies

• Centers for Medicare & Medicaid Services
• DEPARTMENT OF HEALTH AND HUMAN SERVICES
• Office of Inspector General

[Federal Register Volume 81, Number 182 (Tuesday, September 20, 2016)]
[Proposed Rules]
[Pages 64383-64401]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2016-22269]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services

42 CFR Part 455

Office of Inspector General

42 CFR Part 1007

RIN 0936-AA07


Medicaid; Revisions to State Medicaid Fraud Control Unit Rules

AGENCIES: Office of Inspector General (OIG) and Centers for Medicare & 
Medicaid Services (CMS), HHS.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: This proposed rule would amend the regulation governing State 
Medicaid Fraud Control Units (MFCUs or Units). The proposed rule would 
incorporate statutory changes affecting the MFCUs as well as policy and 
practice changes that have occurred since the regulation was initially 
issued in 1978. These changes include a codification of OIG's delegated 
authority, MFCU authority, functions, and responsibilities; 
disallowances; and issues related to organization, prosecutorial 
authority, staffing, recertification, and the MFCUs' relationship with 
Medicaid agencies.

DATES: To ensure consideration, comments must be delivered to the 
address provided below by no later than 5 p.m. Eastern Standard Time on 
November 21, 2016.

ADDRESSES: In commenting, please reference file code OIG-406-P. Because 
of staff and resource limitations, we cannot accept comments by 
facsimile (FAX) transmission. However, you may submit comments using 
one of two ways (no duplicates, please):
    1. Electronically. We strongly encourage you to submit your 
comments via the Internet. You may submit electronically through the 
Federal eRulemaking Portal at https://www.regulations.gov. (Attachments 
should be in Microsoft Word, if possible.)
    2. By regular, express, or overnight mail. Because of potential 
delays in our receipt and processing of mail, we encourage respondents 
to submit comments electronically to ensure timely receipt. However, 
you may mail your printed or written submissions to the following 
address:

Patrice Drew, Office of Inspector General, Department of Health and 
Human Services, Attention: OIG-406-P, Cohen Building, 330 Independence 
Avenue SW, Room 5269, Washington, DC 20201.

    Please allow sufficient time for mailed comments to be received 
before the close of the comment period. Comments received after the end 
of the comment period may not be considered.
    Inspection of Public Comments: All comments received before the end 
of the comment period will be posted on https://www.regulations.gov for 
public viewing. Hard copies will also be available for public 
inspection at the Office of Inspector General, Department of Health and 
Human Services, Cohen Building, 330 Independence Avenue SW, Washington, 
DC 20201, Monday through Friday from 10 a.m. to 4 p.m. To schedule an 
appointment to view public comments, phone (202) 619-1368.

FOR FURTHER INFORMATION CONTACT: Susan Burbach, (202) 708-9789 or 
Richard Stern, (202) 205-0572, Office of Inspector General, for 
questions relating to the proposed rule.

SUPPLEMENTARY INFORMATION: 

Executive Summary

A. Need for Regulatory Action

    We propose to amend this regulation for two reasons. First, we want 
to incorporate into the rule the statutory changes that have occurred 
since the 1977 enactment of the Medicare-Medicaid Anti-Fraud and Abuse 
Amendments (Pub. L. 95-142), which amended section 1903(a) of the 
Social Security Act (the Act) to provide for Federal participation in 
the costs attributable to establishing and operating a State Medicaid 
Fraud Control Unit (MFCU or Unit). Second, we want to align the rule 
with practices and policies that have developed and evolved since the 
initial version of the rule was issued in 1978, 43 FR 32078 (July 24, 
1978), codified at 42 CFR part 1007. Because of the extensive nature of 
our proposal, we have republished the entirety of part 1007 and 
incorporated our proposed changes as part of that publication. However, 
for some sections within part 1007, we are not proposing substantive 
changes.

B. Legal Authority

    The legal authority for this regulatory action is found in the Act 
as follows: 1007: SSA Sec. Sec.  1902(a)(61), 1903(a)(6), 1903(b)(3), 
1903(q), and 1102. 455: SSA Sec. Sec.  1902(a)(4), 1903(i)(2), 1909.

C. Summary of Major Provisions

    (1) Statutory Changes. We propose to incorporate statutory changes 
that have occurred since 1977, including (1)

[[Page 64384]]

raising the Federal matching rate for ongoing operating costs from 50 
percent to 75 percent, (2) establishing a Medicaid State plan 
requirement that a State must operate an effective MFCU, (3) 
establishing standards under which Units must be operated, (4) allowing 
MFCUs to seek approval from the relevant Inspector General to 
investigate and prosecute violations of State law related to fraud in 
any aspect of the provision of health care services and activities of 
providers of such services under any Federal health care program, 
including Medicare, as long as the fraud is primarily related to 
Medicaid, and (5) giving MFCUs the option to investigate and prosecute 
patient abuse or neglect in board and care facilities, regardless of 
whether the facilities receive Medicaid payments.
    (2) Office of Inspector General Authority. We propose to amend the 
regulation to codify that the authority for certification and 
recertification of the MFCUs as well as the administration of the grant 
award was transferred from the predecessor agency of CMS (Health Care 
Financing Administration) to OIG on July 27, 1979. 44 FR 47811 (August 
15, 1979).
    (3) Unit Authority. We propose to add definitions to clarify key 
issues related to Unit authority under the grant to conduct fraud 
investigations as well as patient abuse and neglect and 
misappropriation of patient funds investigations. Specifically, we 
propose to add definitions for fraud, abuse of patients, board and care 
facility, health care facility, misappropriation of patient funds, 
neglect of patients, and program abuse. We also propose to modify the 
definition of provider.
    (4) Organizational Requirements. We propose to clarify what it 
means to be considered a single identifiable entity of State 
government.
    (5) Prosecutorial Authority Requirements. We propose to make 
technical amendments to the prosecutorial authority requirement options 
to include the prosecution of patient abuse and neglect and to include 
referrals to other offices with statewide prosecutorial authority, in 
addition to the State Attorney General.
    (6) Agreement with Medicaid agency. We propose that the agreement 
with the Medicaid agency must include establishing regular 
communication, procedures for coordination, including those involving 
payment suspension and acceptance or declination of cases. We also 
propose that the parties review and, if needed, update the agreement no 
less frequently than every 5 years.
    (7) Functions and Responsibilities. In addition to the proposed 
statutory amendments that expand the Units' functions and 
responsibilities, we propose to require that Units submit all 
convictions to OIG for purposes of program exclusion within 30 days of 
sentencing or as soon as practicable if a Unit encounters delays from 
the courts. We propose to further clarify the requirement that a Unit 
make information available to, and coordinate with, OIG investigators 
and attorneys, other Federal investigators, and Federal prosecutors on 
Medicaid fraud information and investigations involving the same 
suspects or allegations.
    (8) Staffing Requirements. We propose to clarify that Units may 
choose to employ professional employees as full- or part-time employees 
so long as they devote their ``exclusive effort'' to MFCU functions. We 
also propose that a Unit must employ a director and that all MFCU 
employees must be under the direction and supervision of the Unit 
director. We propose that MFCU professional employees may also obtain 
outside employment with some restriction and may perform temporary 
assignments that are not a required function of the Unit so long as the 
grant is not charged for those duties. We also propose to clarify that 
Units may employ employees or consultants with specialized knowledge 
and skills, as well as administrative and support staff, on a full- or 
part-time basis. We further propose to clarify that investigation and 
prosecution functions may not be outsourced through consultant 
agreements or other contracts. We propose to require that Units provide 
training for professional employees on Medicaid fraud and patient abuse 
and neglect matters. Finally, we propose to add definitions for full- 
and part-time employee, professional employee, director, and exclusive 
effort.
    (9) Recertification Requirements. We propose to amend the 
regulation to reflect the Unit recertification process. This includes 
describing what is required annually by OIG as part of recertification, 
including submission of a reapplication, including certain requested 
information, as well as a statistical report. We also propose to modify 
the annual report requirements. We also propose to clarify the factors, 
such as performance standards, that OIG considers when recertifying a 
MFCU. We also propose to notify the Unit of approval or denial of 
recertification and to create procedures for reconsideration should OIG 
deny recertification.
    (10) Federal Financial Participation (FFP). We propose to clarify 
that, except for Units with OIG approval to conduct data mining under 
this part, the prohibition of FFP for data mining activities extends 
only to the cost of activities that duplicate surveillance and 
utilization review responsibilities of State Medicaid agencies. We also 
propose to clarify that efforts to increase referrals through program 
outreach activities are eligible for FFP.
    (11) Disallowance Procedures. We propose to amend the regulations 
to set forth procedures for OIG disallowances of FFP and for Unit 
requests for reconsideration and appeal of disallowances.
    (12) CMS Companion Regulation. To ensure that both the MFCU and the 
State Medicaid agency are required to have an agreement with each 
other, we are including amendments to the CMS regulation at 42 CFR 
455.21 of this section to require that the State Medicaid agency have 
an agreement with the MFCU. The regulations at 42 CFR 455.21 are 
enforced by CMS. However, we are including amendments to part 455 here 
to ensure a comprehensive regulatory package that sets forth in one 
location the Department's regulations related to MFCUs.

D. Costs and Benefits

    There are no significant costs associated with the proposed 
regulatory revisions that would impose any mandates on State, local, or 
tribal governments or on the private sector.

I. Background

A. Statutory Changes Since 1977 Implemented by this Rulemaking

    (1) Omnibus Reconciliation Act of 1980 (Pub. L. 96-499). In order 
to provide a continuing incentive for operation of State MFCUs, the 
Omnibus Reconciliation Act (OBRA) of 1980, amended section 1903(a)(6) 
of the Act and raised the Federal matching rate for ongoing operating 
costs (i.e., for all years after the initial 3 years of operations) 
from 50 percent to 75 percent.
    (2) Omnibus Budget Reconciliation Act of 1993 (Pub. L. 103-66). The 
Omnibus Budget Reconciliation Act of 1993 added Sec.  1902(a)(61) to 
the Act, establishing a Medicaid State plan requirement that a State 
must operate an effective MFCU, unless the State demonstrates that 
effective operation of a Unit would not be cost effective and that, in 
the absence of a Unit, beneficiaries will be protected from abuse and 
neglect. The statute further requires that the Units be operated in 
accordance with standards established by the Secretary.
    (3) Ticket to Work and Work Incentives Improvement Act of 1999

[[Page 64385]]

(Pub. L. 106-170). In the Ticket to Work and Work Incentives 
Improvement Act of 1999 (TWWIIA), Congress amended section 1903(q) of 
the Act to extend the authority of MFCUs in two ways. First, the Units 
may now seek approval from the relevant Inspector General (in most 
circumstances the Inspector General of the Department of Health and 
Human Services (HHS) to investigate and prosecute violations of State 
law related to any aspect of fraud in connection with ``the provision 
of health care services and activities of providers of such services 
under any Federal health care program,'' including Medicare, ``if the 
suspected fraud or violation of State law is primarily related to'' 
Medicaid. Second, the law gives Units the option to investigate and 
prosecute patient abuse or neglect in board and care facilities, 
regardless of whether those facilities receive Medicaid payments.

B. Regulatory, Practice, and Policy Changes to the MFCU Program Since 
1978

    The regulation has been amended on two occasions. First, the 
regulation was amended at Sec.  1007.9(e)-(g) to implement payment 
suspension provisions found in the Affordable Care Act (76 FR 5970 
(February 2, 2011)). Second, the regulation was modified at Sec.  
1007.20 to allow FFP for data mining under certain circumstances (78 FR 
29055 (May 17, 2013)). With the exception of these two revisions, the 
regulation has not received a wholesale revision since it was 
originally published in 1978. In the ensuing years, growth of the MFCU 
program to 50 Units (49 States and the District of Columbia) as well as 
changes in MFCU practice, health care, and the workplace have led to 
the need for many amendments to the regulation. Further, in 1994, 
pursuant to section 1902(a)(61) of the Act, OIG, in consultation with 
the MFCUs, developed 12 performance standards to be used in assessing 
the operations of MFCUs. These performance standards have since been 
revised and republished at 77 FR 32645 (June 1, 2012). OIG uses the 
performance standards in annually recertifying each Unit and in 
determining if a Unit is effectively and efficiently carrying out its 
duties and responsibilities.

I. Provisions of the Proposed Rule

Subpart A--General Provisions and Definitions
    We propose to add a new subpart A of this part entitled ``General 
Provisions and Definitions'' which includes Sec.  1007.1, 
``Definitions,'' and Sec.  1007.3, ``What is the statutory basis and 
organization of this rule?''
1007.1 Definitions
    Current Sec.  1007.1 defines four terms: ``data mining,'' ``employ 
or employee,'' ``provider,'' and ``Unit.'' We propose to modify the 
current definition of ``provider,'' eliminate the definition of 
``employ or employee,'' and add definitions for ``full-time employee,'' 
``part-time employee,'' ``professional employee'' and ``exclusive 
effort.'' We propose to add a definition of the term ``director.'' We 
also propose to add several additional terms to clarify the scope of 
the Units' duties and responsibilities: ``fraud,'' ``abuse of 
patients,'' ``board and care facility,'' ``health care facility,'' 
``misappropriation of patient funds,'' ``neglect of patients,'' and 
``program abuse.''
1. Full-Time Employee, Part-Time Employee, and Exclusive Effort
    Existing regulations at Sec.  1007.19 preclude FFP in expenditures 
for any management function for the Unit, any audit or investigation, 
any professional legal function, or any criminal, civil or 
administrative prosecution that is not performed by a ``full time 
employee of the Unit.'' As a matter of policy and practice, OIG has 
permitted professional employees (attorneys, auditors, and 
investigators) to work on a part-time basis, provided that the part-
time employee work exclusively on MFCU matters while on duty for the 
Unit. Consistent with this policy, we propose to replace the term 
``employ or employee'' with definitions for the terms ``full-time 
employee,'' ``part-time employee,'' and ``exclusive effort'' to help 
clarify the staffing requirements for MFCUs. We also propose to define 
professional employee to mean an investigator, attorney, or auditor.
    In Sec.  1007.1, we propose to define ``full-time employee'' to 
mean an employee of the Unit who has full-time status as defined by the 
State. Similarly, we propose to define ``part-time employee'' to mean 
an employee of the Unit who has part-time status as defined by the 
State. In Sec.  1007.13(d), we propose to require that professional 
employees, whether full time or part time, devote ``exclusive effort'' 
to the work of the Unit, consistent with OIG's longstanding policy. We 
therefore also propose to add a definition of ``exclusive effort'' to 
mean that professional employees devote their efforts exclusively to 
the functions and responsibilities of a Unit, as described in this 
part. As under the current definition of ``employee,'' the proposed 
definition for ``exclusive effort'' requires that duty with the Unit be 
intended to last for at least one year and would include arrangements 
in which an employee is on detail or assignment from another government 
agency, but only if the detail or arrangement is intended to last for 
at least one year. An employee detailed to the Unit from another 
government agency would need to work exclusively for the Unit on MFCU 
matters and would not be able to allocate time to both the home agency 
and the Unit. As discussed more fully in 1007.13 Staffing Requirements, 
OIG believes that ``exclusive effort'' should ensure that professional 
employees do not engage in outside employment that might jeopardize the 
distinct nature and specialized skills of the Unit.
    These proposed definitions are consistent with OIG existing policy 
as found in State Fraud Policy Transmittal 2014-1 (March 14, 2014).
    We also discuss these proposed definitions in section 1007.13 
Staffing.
2. Director
    Under proposed Sec.  1007.13 paragraph (c), we specify that each 
Unit must employ a director who supervises all Unit employees. We 
propose to add the term ``director'' to Sec.  1007.1 to mean an 
employee of the MFCU who supervises the operations of the Unit, either 
directly or through other MFCU managers.
3. Fraud
    We propose to add a definition of fraud at Sec.  1007.1 to clarify 
that the scope of MFCU authority to investigate ``any and all aspects 
of fraud'' encompasses any action for which civil or criminal penalties 
may be imposed under State law. This definition is similar to the 
definition of fraud contained in CMS program integrity regulations at 
42 CFR 455.2, but, consistent with the MFCUs' responsibility for both 
criminal and civil fraud, incorporates the definition of intent that 
applies in a civil case.
    The primary mission for MFCUs has been the investigation and 
prosecution (or referral for prosecution) of criminal violations 
related to the operation of a Medicaid program and of patient abuse and 
neglect in Medicaid-funded facilities and in board and care facilities. 
However, State and Federal health care prosecutors commonly use both 
criminal and civil remedies, and OIG attorneys use administrative 
remedies, to achieve a full resolution of provider fraud cases. The 
Deficit Reduction Act of 2005 (Pub. L. 109-171) added Sec.  1909 to the 
Act to provide a financial incentive for States to enact their own 
false claims acts establishing

[[Page 64386]]

liability to the State for the submission of false or fraudulent claims 
to the State's Medicaid program.
    Further, OIG has issued policy guidance that civil actions, 
including imposition of penalties and damages, are an appropriate 
outcome of investigations by MFCUs, particularly when providers lack 
the specific intent required for prosecution under criminal fraud 
statutes. (State Fraud Policy Transmittal No. 99-01, December 9, 1999). 
Specifically, OIG stated that meritorious civil cases that are declined 
criminally should be tried under State law or referred to the U.S. 
Department of Justice or the U.S. Attorney's Office, as well as the OIG 
Office of Investigations. As discussed in section 1007.11 Functions and 
Responsibilities of the Unit, we propose to require at new Sec.  
1007.11(e)(4) that appropriate referrals of civil actions be made to 
Federal investigators or prosecutors, or OIG attorneys.
4. Program Abuse
    We propose to define the term ``program abuse'' at Sec.  1007.1 to 
make clear that, for purposes of FFP in MFCU expenditures, program 
abuse includes only improper provider practices that fall short of acts 
for which civil or criminal penalties are warranted. Current 
regulations at Sec.  1007.19(e)(1) prohibit FFP in MFCU expenditures 
for investigation of cases involving program abuse or other failures to 
comply with applicable laws and regulations, if these cases do not 
involve ``substantial allegations or other indications of fraud.''
    Congress has expanded the range of Federal civil and administrative 
sanctions available when false and fraudulent provider practices do not 
reach the level of intent required for criminal prosecution. In 
addition, Congress encouraged States to enact their own false claims 
laws. Our policy continues to be that FFP is available to MFCUs for 
investigations involving reasonable indications of either civil or 
criminal fraud. Where an overpayment has been identified in a matter in 
which the MFCU has determined that neither civil nor criminal 
enforcement action is warranted, the MFCU should refer the matter to 
the State Medicaid agency for collection.
5. Abuse or Neglect of Patients
    Section 1903(q)(4) of the Act requires that, to be certified by the 
Secretary, MFCUs must have procedures for reviewing complaints of abuse 
or neglect of patients in health care facilities that receive Medicaid 
payments. In addition, the Act requires that Units have procedures for 
acting on these complaints under the criminal laws of the State or for 
referring the complaints to other State agencies for action. To clarify 
the scope of Units' duties and responsibilities, we propose to amend 
Sec.  1007.1 to add definitions of the terms ``abuse of patients'' and 
``neglect of patients.'' We propose to define the term ``abuse of 
patients'' to mean willful infliction of injury, unreasonable 
confinement, intimidation or punishment with resulting physical or 
financial harm, pain or mental anguish. We propose to define the term 
``neglect of patients'' to mean willful failure to provide goods and 
services necessary to avoid physical harm, mental anguish, or mental 
illness. With regard to each of the terms, we propose to include within 
the definitions a recognition that the scope of what constitutes 
``abuse of patients'' and ``neglect of patients'' includes those acts 
(and, with regard to the crime of neglect, omissions) that may 
constitute a criminal violation under applicable State law.
6. Misappropriation of Patient Funds
    The Department included ``misappropriation of [a] patient's private 
funds'' as part of the scope of MFCUs' investigative authority when it 
issued current Sec.  1007.11(b)(1). In the notice of final rulemaking, 
the Department explained that investigating ``misuse of private funds 
being held for patients by health care facilities'' would be ``a 
natural outgrowth of an investigation of the facility for program fraud 
or patient abuse or neglect'' and would fall under a MFCU's authority 
to investigate any and all aspects of provider fraud. (43 FR 32078, 
32080 (July 24, 1978)).
    We are maintaining this authority in the revised regulation and are 
including a definition of the term ``misappropriation of patient 
funds'' to mean the wrongful taking or use, as defined under applicable 
State law, of funds or property of a patient residing in a health care 
facility or board and care facility.
    We chose not to specify that the patient's funds have to be held in 
the facility, given that misappropriation of a patient's funds may 
include financial fraud regarding a patient's assets that are 
maintained in financial accounts in any location. We also chose not to 
specify that the perpetrator of the misappropriation of patient's funds 
has to be an employee of the facility where the patient resides. 
Because of the many scenarios that exist with respect to 
misappropriation of patient funds, we invite comment on the rule not 
specifying the location of the patient funds or the possible 
perpetrator of the misappropriation.
7. Board and Care Facility
    Congress, in the initial MFCU legislation, required MFCUs to 
investigate patient abuse or neglect only in health care facilities 
receiving Medicaid payments. In 1999, as part of TWWIIA, Congress 
amended section 1903(q)(4) of the Act to give Units the option to 
investigate patient abuse or neglect in non-Medicaid ``board and care'' 
facilities, as defined in the statute.
    We are proposing to amend Sec.  1007.11 to incorporate the 
statutory authority for MFCUs to choose to investigate complaints of 
abuse or neglect in board and care facilities, regardless of the source 
of payment, and to add the statutory definition of ``board and care 
facility'' to the definitions at Sec.  1007.1. Such facilities include 
assisted living facilities in current terminology.
8. Health Care Facility
    We are proposing to add a definition of ``health care facility'' to 
clarify the scope of MFCU-required functions and responsibilities in 
connection with the investigation of complaints of neglect or abuse of 
patients in such facilities, consistent with section 1903(q)(4)(A) of 
the Act and with Medicaid program regulations.
    Specifically, 42 CFR 447.10(b) defines a ``facility'' as ``an 
institution that furnishes health care services to inpatients'' and 42 
CFR 435.1010 defines an ``institution'' as ``an establishment that 
furnishes (in single or multiple facilities) food, shelter, and some 
treatment or services to four or more persons unrelated to the 
proprietor,'' and ``in an institution'' as an individual who is 
admitted to live there and receive treatment or services provided there 
that are appropriate to his requirements.'' Consistent with these 
definitions, we propose to add a definition at Sec.  1007.1 to clarify 
that a ``health care facility'' is ``a provider that receives payments 
under Medicaid and furnishes food, shelter, and some treatment or 
services to four or more persons unrelated to the proprietor in an 
inpatient setting.''
9. Provider
    We propose to modify the definition of provider to include those 
who are required to enroll in a State Medicaid program, such as 
ordering and referring physicians. While we believe the regulation's 
longstanding definition of provider includes managed care and other 
types of providers that operate in the current healthcare environment, 
we

[[Page 64387]]

think that including ordering and referring physicians in the 
definition clarifies that providers who are not furnishing items or 
services for which payment is claimed under Medicaid can be the subject 
of a MFCU investigation and prosecution.
1007.3 Statutory Basis and Scope
    The Secretary delegated to OIG the authority under sections 
1903(a)(6) and (b)(3) to pay the FFP amounts of State expenditures for 
the establishment and operation of a MFCU and, under section 1903(q), 
to determine whether a MFCU meets the statutory requirements to be 
certified as eligible for Federal payments. We propose to revise Sec.  
1007.3 to more comprehensively set forth the statutory basis and 
organization of this rule, and to explicitly reference OIG's authority 
to certify whether a Unit has demonstrated that it is effectively 
carrying out its required functions under this part.
    We also propose to revise Sec.  1007.3 to reflect current law at 
Sec.  1902(a)(61) of the Act requiring a State to provide in its 
Medicaid State plan that it operates a MFCU that ``effectively carries 
out the functions and requirements'' described in Federal law, as 
determined in accordance with standards established by OIG, unless the 
State demonstrates that a Unit would not be cost-effective because of 
minimal Medicaid fraud and that the State adequately protects Medicaid 
patients from abuse and neglect without the existence of a Unit. CMS 
retains the authority to determine a State's compliance with Medicaid 
State Plan requirements in accordance with Sec.  1902 of the Act.
    Congress initially established a matching rate of 90 percent for 12 
quarters to give States an incentive to develop a MFCU. Later, as a 
continuing incentive, Congress provided that after the initial 12 
quarters of 90 percent Federal matching, MFCUs would receive Federal 
matching of 75 percent of the ongoing costs of operating a MFCU.
    Regulations at both Sec.  1007.3 and Sec.  1007.19(a) provide that 
a State will receive Federal reimbursement for 90 percent of the costs 
of establishing and operating a State MFCU. To eliminate redundancy, 
and to reflect the current statute's FFP provisions, we propose to 
remove the statement regarding 90 percent Federal funding at Sec.  
1007.3. We propose to retain the provision at current Sec.  1007.19(a) 
and to amend it to reflect the current statute's limitation of 75 
percent FFP for the operation of a MFCU after the initial 12 quarters.
Subpart B--Requirements for Certification
    We propose to add a new Subpart B ``Requirements for 
Certification,'' containing sections 1007.5 through 1007.17.
1007.5 Single Identifiable Entity Requirement
    Section 1903(q) of the Act defines the term ``State Medicaid fraud 
control unit'' to mean ``a single identifiable entity of the State 
government which the Secretary certifies (and recertifies) as meeting'' 
statutory requirements. This basic requirement is reflected in current 
Sec.  1007.5 and is widely accepted as a prerequisite for establishing 
and operating a Unit. We propose to amend the MFCU regulations to 
define the phrase ``single identifiable entity'' and to clarify that 
Units must satisfy the definition to be certified and recertified.
    We propose that Units have the following characteristics to be 
considered a ``single identifiable entity in State government'' and to 
be eligible for certification and recertification. Units must: (1) Be a 
single organization reporting to the single Unit director; (2) operate 
under its own budget that is separate from that of its parent division 
or agency; and (3) have the headquarters office and any field offices 
each in their own contiguous space.
    We believe that each of these three characteristics is necessary to 
ensure that Unit is able to operate independently of its parent agency 
and to maintain its independent character as a single, identifiable 
entity. We believe that these characteristics are consistent with the 
statement at time of enactment by the Senate Committee on Finance that 
``a separate Statewide investigative entity'' substantially increases 
the rate of prosecutions and convictions (Senate Report 95-453 
(September 26, 1977), page 35). We also believe, on the basis of our 
observation and knowledge of the 50 existing Units, that Units 
generally share these characteristics and operate under the assumption 
that each of the characteristics is required for certification 
purposes. We invite comment on these newly articulated requirements for 
determining whether a Unit would be considered a single identifiable 
entity.
    Specifically, we believe that all Unit employees reporting to a 
single Unit director provides the most efficient management structure 
and helps to ensure that the Unit can act independently of its parent 
agency. Secondly, to ensure that a Unit has the resources to undertake 
its mission, to operate efficiently and effectively, and to continue as 
an ongoing operation, we believe a Unit should operate under its own 
budget that is separate from that of its parent agency.
    Finally, we also believe that having headquarters and any field 
offices each in their own contiguous space leads to the most efficient 
conduct of Unit business by fostering a Unit's multidisciplinary 
approach of investigators, attorneys, auditors, and other employees 
working together on cases and helps ensure that employees devote their 
exclusive effort to MFCU purposes. Further, we believe that allowing 
MFCU employees to work in non-contiguous space alongside other State 
employees would undermine the ability of MFCU management to monitor 
whether MFCU employees are devoted exclusively to the mission of the 
MFCU. Headquarters or field offices would be considered duty stations, 
and telework and other ``out of duty office'' work arrangements are not 
precluded, if permitted under State policies. We believe that all Unit 
offices currently operate in contiguous space, although in certain 
larger Units the contiguous space may, for example, be on separate 
floors of the same building. We believe that such arrangements qualify 
as ``contiguous'' as long as the separation permits the Unit's three 
professional groups to interact effectively in the course of their 
duties. For example, OIG does not believe that an office arrangement 
would be contiguous if all or groups of Unit investigators, or 
attorneys, were located in a different space from the rest of the Unit.
1007.7 Prosecutorial Authority Requirement
    Section 1903(q)(1) of the Act provides for three alternative 
prosecutorial arrangements for a State MFCU, depending on the location 
of criminal prosecuting authority in the State. Current Sec.  1007.7(b) 
states that if there is no State agency with Statewide authority and 
capability for criminal fraud prosecutions, the Unit must establish 
formal procedures that ensure that the Unit refers suspected cases of 
criminal fraud to the appropriate prosecuting authorities. We propose 
that Sec.  1007.7(b) be amended to also include such procedures for 
patient abuse and neglect prosecutions, consistent with the language of 
the statute.
    Section 1007.7(c) requires a formal working relationship with the 
office of the State Attorney General. We propose that Sec.  1007.7(c) 
be amended to reference the office of the State Attorney General ``or 
another office with Statewide prosecutorial authority.'' We also 
propose to amend Sec. Sec.  1007.7(b) and

[[Page 64388]]

1007.7(c) to clarify that the formal procedures be written. Finally, we 
propose to make a minor wording change to emphasize the requirement 
that a Unit be organized according to one of three prosecutorial 
arrangements and to change the name of Sec.  1007.7 to ``What are the 
prosecutorial authority requirements for a Unit?'' to more accurately 
describe its contents.
1007.9 Relationship to, and Agreement with, the Medicaid Agency
    Current Sec.  1007.9(d) requires that the MFCU enter into an 
agreement with the Medicaid agency to ensure the Unit has access to 
fraud case referrals and case information. Companion regulations 
governing fraud control activities of the Medicaid agency impose 
obligations on the Medicaid agency to identify, investigate, and refer 
suspected fraud cases, but do not explicitly require an agreement with 
the Unit. CMS enforces the regulations at 42 CFR part 455 (See 
September 30, 1986 final rule (51 FR 34787)). Given the importance of 
the working relationship between the MFCU and Medicaid agency, in this 
joint proposed rule, OIG and CMS propose to add additional guidance at 
Sec.  1007.9, and through the addition of a new Sec.  455.21(c), to 
clarify that both the Medicaid agency and the MFCU must enter into a 
written agreement, such as a memorandum of understanding (MOU).
    We also propose to add to both Sec.  1007.9(d)(3) and to the new 
Sec.  455.21(c) that the MOU include the following required elements. 
First, we propose that the MOU must include an agreement to establish a 
practice of regular communication or meetings between the MFCU and the 
Medicaid agency to discuss such matters as case updates, new complaints 
and possible referrals, documentation and data requests, policy 
changes, fraud trends, and joint activities. Second, we propose that 
the MOU must establish procedures for how the MFCU and the Medicaid 
agency will coordinate their efforts as they carry out their respective 
responsibilities. Third, we propose that the MOU must establish 
procedures related to payment suspension and notification of acceptance 
or declination of cases, as found at Sec. Sec.  1007.9(e) through 
1007.9(h). Finally, we propose that the MOU must be reviewed and, if 
needed, updated by both the MFCU and the Medicaid agency at least every 
5 years to ensure that it reflects current law and practice.
    We also propose a minor amendment at Sec.  1007.9(f) which requires 
that any request by the Unit to the Medicaid agency to delay 
notification to the provider of a payment suspension under Sec.  455.23 
must be made in writing. We propose to add the word ``promptly'' to 
that provision. In order to avoid the risk of jeopardizing a MFCU 
investigation, we think it is important for Units to provide prompt 
written notice to a Medicaid agency if a provider is the subject of an 
investigation. Further, we also propose a similar amendment to Sec.  
1007.9(g) which requires the Unit to notify the Medicaid agency in 
writing as to whether the Unit accepts or declines a case referred by 
the Medicaid agency. We propose that the Unit should make this decision 
in a timely manner and promptly inform the Medicaid agency of its 
decision. Again, prompt notification by the MFCU allows the Medicaid 
agency to uphold a payment suspension, or in the case of a declination, 
re-establish payments to the provider. Additionally, if a referral is 
declined by the Unit, the Medicaid agency may pursue administrative 
actions against the provider in a timely manner.
    We propose an amendment at Sec.  1007.9(h) to require the MFCU to 
provide certification to the Medicaid agency, upon request on a 
quarterly basis, that any matter accepted on the basis of a referral 
continues to be under investigation and thus warranting continuation of 
payment suspension. Under Sec.  455.23(d)(3)(ii), the Medicaid agency 
must request this certification from the MFCU, but the regulations do 
not require the MFCU to comply with this request. Placing this 
responsibility on the MFCU is consistent with the temporary nature of 
the payment suspension process.
1007.11 Functions and Responsibilities of the Unit
    MFCU regulations, in describing the duties and responsibilities of 
a Unit for patient abuse or neglect, provide in paragraph 
1007.11(b)(1): ``The unit will also review complaints alleging abuse or 
neglect of patients in health care facilities receiving payments under 
the State Medicaid plan and may review complaints of the 
misappropriation of patient's private funds in such facilities.'' In 
implementing a Unit's statutory responsibility for patient abuse or 
neglect, the Department thus expanded responsibility for abuse or 
neglect to the financial crime of ``misappropriation of [a] patient's 
private funds,'' but made such cases optional (``may review complaints. 
. . .''). Cases involving private funds have become a substantial part 
of MFCU caseloads, reflecting the significance of financial abuse in 
crimes against seniors and other facility residents.
    In our proposed definition in paragraph 1007.1 of ``abuse of 
patients,'' we have included ``financial harm'' as one element. 
Consistent with this definition and with the recognized importance of 
financial abuse as a type of patient abuse or neglect, we propose to 
revise the regulation at 1007.11(b)(1) to require the Unit to review 
complaints involving misappropriation of funds. We believe that making 
the review of such complaints mandatory is consistent with the broad 
statutory responsibility for patient abuse or neglect.
    The TWWIIA amended section 1903(q) of the Act to allow MFCUs to 
receive FFP for the investigation and prosecution of Medicare or other 
Federal health care cases that are primarily related to Medicaid, with 
the approval of the Inspector General of the relevant Federal agency 
(most typically, the Inspector General for HHS). We propose to revise 
Sec.  1007.11 to specify that the MFCU must obtain written permission 
from the relevant Federal Inspector General to investigate cases of 
provider fraud in health care programs other than Medicaid. OIG issued 
guidance for seeking approval for this extended investigative authority 
from HHS-OIG in State Fraud Policy Transmittal No. 2000-1 (September 7, 
2000). In order for OIG to effectively monitor these approvals, we 
propose to codify at Sec.  1007.17(a)(1)(i) the requirement from the 
policy transmittal that Units report annually to OIG of any approvals 
for extended investigative authority from any Federal Inspector 
General.
    TWWIIA also gave MFCUs the option to review complaints of patient 
abuse or neglect in non-Medicaid board and care facilities, as defined 
in the statute, and to have procedures for acting on such complaints. 
For the regulation, we interpret the law's requirement to have 
``procedures for acting on such complaints'' to mean that Units can 
investigate cases arising from those complaints. Consistent with our 
proposal to permit investigation of misappropriation of patient funds 
in health care facilities, we also propose to permit such 
investigations in board and care facilities.
    At new Sec.  1007.11(a)(3), we propose that applicable State laws 
pertaining to Medicaid fraud include criminal statutes as well as civil 
false claims statutes or other civil authorities. Further, at new Sec.  
1007.11(e)(4), we propose that if no State civil fraud statute exists, 
MFCUs should make appropriate referrals of meritorious civil

[[Page 64389]]

cases to Federal investigators or prosecutors, such as the U.S. 
Department of Justice or the U.S Attorney's Office, as well as to the 
HHS-OIG Office of Investigations and Office of Counsel to the Inspector 
General. OIG believes that assessing civil penalties and damages is an 
appropriate law enforcement tool when providers lack the specific 
intent required for criminal conviction but satisfy the applicable 
civil standard of liability. This proposal is consistent with State 
Fraud Policy Transmittal No. 99-01 (December 9, 1999) which encouraged 
MFCUs to pursue potential civil remedies when no potential criminal 
remedy exists. Additionally, as discussed in Section B, we propose to 
add a definition of ``fraud'' that clarifies MFCU authority to 
investigate and prosecute both criminal and civil fraud.
    At Sec.  1007.11(c), we propose to clarify that when a Unit 
discovers that overpayments have been made to a provider or facility, 
the Unit must either recover the overpayment as part of its resolution 
of a fraud case or refer the matter to the proper State agency for 
collection.
    At Sec.  1007.11(e)(1) and (2), we propose to retain the current 
requirement that a Unit make available to Federal investigators and 
prosecutors and OIG attorneys all information in its possession 
concerning Medicaid fraud and that the Unit coordinate with such 
officials any Federal and State investigations or prosecutions 
involving the same suspects or allegations. The Federal and State 
governments share responsibility for the investigation and prosecution 
of Medicaid provider fraud, and Federal agencies may need to coordinate 
an action in a particular State with other Federal law enforcement 
efforts.
    We also propose to expand paragraph (e) in three other ways to 
further ensure the effective collaboration between the Units, OIG 
investigators and attorneys, other Federal investigators and 
prosecutors.
    First, we propose in paragraph (e)(3) to specify that a MFCU 
establish a practice of regular meetings or communication with OIG 
investigators and Federal prosecutors. In States in which OIG does not 
have the resources to maintain a regular presence, such communication 
could be by telephone or video conference. Given OIG's coordinating 
role on Federal health care fraud cases, we believe that regular 
contact with OIG investigators is critical in each of the States. For 
Federal prosecutors, the Unit should establish a schedule of meetings 
or regular communication with one or more of the U.S. Attorneys' 
Offices with jurisdiction in the State. In most jurisdictions, it is 
standard practice for the U.S. Attorney to operate a health care fraud 
task force, and regular communication can be achieved through regular 
participation by the Unit on the health care fraud task forces.
    We believe that requiring regular meetings or communication with 
OIG investigators and with Federal prosecutors will strengthen 
relationships, enhance the effectiveness of fraud investigations and 
prosecutions, and ultimately improve the integrity of the Medicaid 
program. We believe that such communication is routine in most of the 
Units, but we also know through our onsite reviews that there are Units 
with a lack of communication with OIG investigators and Federal 
prosecutors.
    Second, we propose to specify in paragraph (e)(4) that Units make 
appropriate referrals to OIG investigators and attorneys, other Federal 
investigators, and Federal prosecutors. It is not unusual for Units to 
investigate cases of Medicaid fraud that involve Medicare or other 
Federal programs, and such cases should be referred to OIG 
investigators, unless the MFCU receives authority under Sec.  
1007.11(a)(2) to investigate the Medicare or other program fraud 
itself. Many such referred cases will be investigated jointly by the 
MFCU and the Federal Government, and the investigation will benefit 
from the combined skills and resources of both offices. Also, health 
care fraud cases often involve both criminal fraud as well as the 
possibility of a civil recovery through application of a civil false 
claims act. As a matter of policy, we have for many years requested 
MFCUs to refer such civil cases to Federal investigators or prosecutors 
for possible application of the Federal civil false claims act. Many 
States have the ability to pursue civil actions either through State 
civil false claims acts or other State authority, but other States may 
lack the ability to prosecute such cases. Also, in many States, there 
may be a lack of investigative resources to pursue such cases even if 
the State has the authority to do so.
    Finally, we further propose in paragraph (e)(5) that Units develop 
written procedures for those items addressed in paragraphs 
(1)through(4). We believe that most Units comply with each of these 
steps as a routine part of their process, but we also believe that it 
is important to formalize them as part of the Unit's written procedures 
because of the critical importance of case coordination. This will also 
permit OIG, in its oversight of the Units, to verify that coordination 
procedures are in place. Our proposal does not specify what the 
procedures should be, but would allow the MFCU and its Federal partners 
to tailor procedures to most effectively meet the needs in their State. 
An example of an established procedure for paragraph (e)(3) would be 
the sharing between the Unit and OIG's Office of Investigations weekly 
or monthly reports describing newly opened cases as well as a schedule 
of monthly or quarterly meetings.
    We propose to revise Sec.  1007.11(f) to require a Unit to provide 
adequate safeguards to protect sensitive information and data under the 
Unit's control. Under the current regulation at Sec.  1007.11(f), MFCUs 
have been required to safeguard privacy rights and to prevent the 
misuse of information under their control. In the past, this 
requirement largely referred to paper case files and other case-related 
materials, such as evidence. Many MFCUs now maintain case information 
in an electronic format and do not rely exclusively on paper case 
files. Because Unit electronic record and data systems may contain 
personally identifiable and other sensitive information, Units need to 
protect that information with a robust data security program. Such a 
program should guard against unauthorized access or release of case 
information as well as unauthorized intrusions from external sources.
    Finally, consistent with the MFCU mission to prosecute Medicaid 
provider fraud and patient abuse or neglect, we propose to amend the 
regulations at new Sec.  1007.11(g) to require that a Unit transmit to 
OIG, for purposes of excluding convicted individuals and entities from 
participation in Federal health care programs under section 1128 of the 
Act, pertinent documentation on all convictions obtained by the Unit, 
including those cases investigated jointly with another law enforcement 
agency, as well as those prosecuted by another agency at the local, 
State, or Federal level. This requirement would be consistent with the 
longstanding published performance standard for MFCUs that such 
referrals be made. By referring convicted individuals or entities to 
OIG for exclusion, MFCUs help to ensure that such individuals and 
entities do not have the opportunity to defraud Medicaid and other 
Federal health programs or to commit patient abuse or neglect. 
Historically, referrals by MFCUs have constituted a significant part of 
the exclusions imposed each year by OIG.
    We propose that such information be provided within 30 days of 
sentencing

[[Page 64390]]

or, if MFCUs are unable to obtain pertinent information from the 
sentencing court within 30 days, as soon as reasonably practicable. We 
propose this ``reasonableness'' provision because we are aware that 
courts may on occasion not provide pertinent documents to MFCUs in a 
timely manner. In assessing whether such additional time is reasonable, 
OIG will assess the steps the MFCU has taken to obtain the court 
documents in a timely manner.
    Finally, at Sec.  1007.11(a) through (c), in describing the 
activities for which a Unit is responsible, we propose to revise 
references to ``the State [Medicaid] plan'' to instead refer to 
``Medicaid,'' and to refer to a ``provider'' (defined in section Sec.  
1007.1 in relationship to Medicaid), rather than ``provider of medical 
assistance under the State Medicaid plan.'' This reflects the reality 
that many States operate under State plan waiver programs and that 
provider activities in waiver programs were not intended to be excluded 
from a Unit's responsibility. This is consistent with the statute's 
broad description of a Unit's function as extending to ``any and all 
aspects of fraud in connection with . . . any aspect of the provision 
of medical assistance. . . .'' Section 1903(q)(3) of the Act, 42 U.S.C. 
1396b(q)(3).
1007.13 Staffing Requirements
Full-Time and Part-Time Employees and Exclusive Effort
    Current regulations at Sec.  1007.19(e)(4) prohibit FFP for ``any 
management function for the Unit, any audit or investigation, any 
professional legal function, or any criminal, civil or administrative 
prosecution of suspected providers that is not performed by a full-time 
employee of the Unit.'' (Emphasis added.) Similarly, the current 
definitions at Sec.  1007.1 define ``employ'' or ``employee'' to mean 
``full-time duty intended to last at least a year.'' In recognition of 
changes to the modern workplace, OIG has taken a flexible approach with 
respect to the employment of professional employees who may wish to 
have part-time schedules. OIG has thus also interpreted the ``full-
time'' rule to permit FFP for professional employees who are employed 
on a part-time basis, as long as their professional activities are 
devoted ``exclusively'' to MFCU purposes.
    We therefore propose to revise the regulations to clarify that MFCU 
professional employees do not need to be ``full time'' to receive FFP, 
but to retain the longstanding policy and practice that FFP is 
permitted only for MFCU professional employees who are devoted 
``exclusively'' to the MFCU mission except for limited circumstances 
that are specifically described in the regulation. Therefore, we 
propose to add definitions in 1007.1 of ``part-time employee,'' ``full-
time employee,'' ``professional employee,'' and ``exclusive effort.''
    We thus propose to add a new Sec.  1007.13(d) that describes the 
requirements for professional employees to receive FFP. Paragraph 
(d)(1) would require that, for professional employees to be eligible 
for FFP, they must devote their ``exclusive effort'' to the work of the 
Unit. This proposal is also reflected in Sec.  1007.19(e)(4), which 
would prohibit FFP for ``the performance of any audit or investigation, 
any professional legal function, or any criminal, civil or 
administrative prosecution of suspected providers by a person other 
than an employee who devotes exclusive effort to the Unit's work.''
    New Sec.  1007.13(d) would also describe, in paragraphs (d)(2) and 
(d)(3), two circumstances in which professional employees may perform 
limited non-MFCU activities: Outside employment during non-duty hours 
and temporary non-MFCU assignments. These proposals, discussed 
separately, are consistent with longstanding MFCU practice and OIG 
policy as expressed in State Fraud Policy Transmittal No. 2014-1 (June 
3, 2014).
    As also stated in the preamble to the regulations regarding the 
prohibition of FFP for other than a professional ``full time 
employee,'' we believe that ``exclusive effort'' by professional 
employees is necessary because the employment of temporary staff, or 
the occasional pursuit of isolated cases by different investigators and 
prosecutors, will undermine a Unit's ability to create an effective 
team with specialized knowledge of health care fraud and patient abuse 
or neglect. 43 FR 32078 (July 24, 1978). We also believe that the 
character of a MFCU as a ``single identifiable entity,'' and the 
development of specialized expertise in Medicaid fraud and patient 
abuse or neglect, would be frustrated by the employment of professional 
employees whose responsibilities are split between the MFCU and another 
agency. We believe that the long-standing policy and practice of MFCUs 
employing professional employees devoted exclusively to the MFCU 
mission has been key to the success of MFCUs.
    One limitation on the use of part-time professional employees is 
the certification requirement found at Sec.  1007.13(a), retained in 
this rulemaking, that MFCUs ``will employ sufficient professional, 
administrative, and support staff to carry out its duties and 
responsibilities in an effective and efficient manner.'' For example, 
Unit management may want to consider whether employing key staff, such 
as the director or chief investigator, on a part-time basis would 
undermine the Unit's effectiveness and efficiency.
Outside Employment
    We further propose, in Sec.  1007.13(d)(2), to reflect the 
restrictions contained in our current policy regarding outside 
employment of professional employees during non-duty hours. 
Specifically, in subsection (d)(2), we propose that, to be eligible for 
FFP, professional employees may not be employed by other State agencies 
during non-duty hours. As stated previously, we believe it is important 
to maintain the separate nature of the MFCU because of the potential 
compromise between the MFCU mission and other missions of the State.
    We do not have the same concerns about employment outside of State 
government. As part of paragraph (d)(2), we also propose that 
professional employees may obtain employment outside of State 
government, if State law allows it, but only if the outside employment 
presents no conflict of interest to Unit activities. A common example 
of such employment would be a MFCU auditor working as a tax accountant 
during his or her off-hours. The Unit should follow its State's process 
to ensure that any proposed outside employment is in accordance with 
applicable professional standards and State ethics rules or policies. 
In the absence of a State process, the MFCU should develop its own 
process to avoid conflicts of interest between a professional 
employee's outside employment and the work of the MFCU.
Temporary Non-MFCU Assignments
    In proposed Sec.  1007.13(d)(3), we reflect the current policy and 
practice regarding temporary, non-MFCU assignments. Paragraph (d)(3) 
would permit MFCU professional employees to engage in temporary 
assignments that are not within the functions and responsibilities of a 
MFCU only if such assignments are truly limited in duration. As with 
other non-MFCU activities, such assignments would not be funded by the 
Federal MFCU grant. For example, MFCU professional employees have been 
deployed to assist in maintaining order during natural disasters and 
other Statewide emergencies.

[[Page 64391]]

    We expect that such situations will be unusual and infrequent, so 
MFCU directors should assess each on a case-by-case basis and may 
consult with OIG in determining whether the assignments are 
appropriate. Before directing staff to take a temporary assignment, a 
Unit should determine whether the assignment has a limited and defined 
duration and whether the assignment would pose any conflict with MFCU 
operations. The Unit may also want to consider whether the skills and 
expertise of the employees(s) are necessary for the assignment. If a 
MFCU permits temporary non-MFCU assignments, the Unit must document all 
hours spent on the assignment and ensure that the hours are excluded 
from the MFCU's financial status reports for purposes of receiving FFP.
Direction and Supervision of the Unit
    We propose to add a requirement at Sec.  1007.13(c) that the Unit 
must employ a director who supervises all Unit employees. Regulations 
do not specify that a MFCU must have a director, although all MFCUs for 
many years have operated with a director. We have found that having a 
director to whom all Unit employees ultimately report is critical to 
the successful management and operation of a MFCU. We also propose to 
define ``director.'' We further note that in some small Units, the 
director is the Unit's only attorney and can be considered the one 
required attorney under Sec.  1007.13(b).
    Proposed Sec.  1007.13(d)(4) would further require that 
professional employees must be under the direction and supervision of 
the MFCU director (or, in larger Units, a subordinate Unit manager). 
This requirement has been a part of OIG's longstanding interpretation 
of the full-time rule and the statutory definition of a Unit as a 
``single, identifiable entity.'' Allowing attorneys or investigators to 
report to supervisory officials outside the Unit would both undermine 
the ability of the Unit director to effectively manage the Unit and 
would interfere with the ability of MFCU professional employees to 
collaborate as a team.
Use of Consultants and Other Contracts
    Consistent with the proposal to require exclusive effort by 
professional employees to receive FFP, we also propose to clarify, in 
Sec.  1007.13(g)(2), that the Unit may not receive FFP when it relies 
on individuals not employed directly by the MFCU for the investigation 
or prosecution of cases, including through consultant agreements or 
other contractual arrangements. As with the exclusive effort rule, we 
believe that the contracting out of investigative or legal functions 
would undermine the character of MFCUs as single, identifiable 
entities. This proposal is consistent with a longstanding practice of 
not allowing the contracting out of the investigation or prosecution of 
cases. We note that this proposal does not affect those MFCUs contained 
in state entities that lack the authority to prosecute fraud or patient 
abuse or neglect. Such MFCUs rely on non-MFCU prosecutors in other 
government agencies, who are not paid on the grant, to bring MFCU cases 
to trial.
    However, we also propose to clarify at Sec.  1007.13(g)(1) that 
Units may receive FFP for the employment of, or have available through 
consultant agreements or other arrangements, individuals with 
particular knowledge, skills, and/or expertise that a Unit believes 
will support the Unit in the investigation or prosecution of cases. For 
example, Units may have consultant agreements with expert witnesses or 
other forensics experts or may employ nurses to support investigations 
and prosecutions.
MFCU Employee Training
    Regulations do not address training of MFCU professional employees. 
Because of the importance of training for MFCU professionals, we 
propose to add a requirement at Sec.  1007.13(h) that a Unit must 
provide training for its professional employees for the purpose of 
establishing and maintaining proficiency in the investigation and 
prosecution of Medicaid fraud and patient abuse and neglect. This 
requirement is consistent with MFCU performance standards, which state 
that a Unit ``conduct training that aids in the mission of the Unit.''
Other Staffing Issues
    We propose to clarify several staffing issues by this regulation, 
including requiring a director; allowing part-time administrative and 
support staff; and clarifying the qualifications of attorneys, 
auditors, and the senior investigator.
    We clarify at Sec.  1007.13(e) that a Unit may hire administrative 
and support staff on a part-time basis. Part-time administrative and 
support staff, unlike professional employees in the new Sec.  
1007.13(d)(2), may hold another part-time State job or allocate their 
time between two offices within the Office of the Attorney General, for 
example. In those instances, we will continue to require that all 
claims for Federal reimbursement for part-time support staff be 
supported with proper documentation of hours worked.
    We also propose minor clarifications at Sec.  1007.13(b) of the 
qualifications of attorneys, auditors, and the senior investigator. For 
attorneys, we propose that they must be capable of prosecuting health 
care fraud or criminal cases. For auditors, we propose a minor change, 
that an auditor be capable of reviewing financial records, rather than 
the current language, that an auditor is ``capable of supervising the 
review of financial records.'' We also propose to expand requirements 
to include that an auditor be capable of advising or assisting in the 
investigation of patient abuse and neglect. For the senior 
investigator, we propose to eliminate the prerequisite of ``substantial 
experience in commercial or financial investigations,'' and propose 
instead only that the senior investigator be capable of supervising and 
directing the investigative activities of the Unit. Further, consistent 
with 1007.13(a), requiring that a Unit hire sufficient staff to carry 
out its duties and responsibilities effectively and efficiently, we 
propose the requirement that Units hire one ``or more investigators.''
1007.15 Certification
    We propose at Sec.  1007.15(b) to clarify that initial 
certification will be based on the information and documentation 
specified at Sec.  1007.15(a). To receive Federal reimbursement, a MFCU 
must be certified and annually recertified by OIG, consistent with 
section 1903(a)(6) of the Act. For initial certification, a Unit must 
meet the basic requirements established in section 1903(q) as 
implemented in this part. Basic certification requirements include 
organization, location, relationships with the Medicaid agency, Unit 
duties and responsibilities, and staffing. We also propose to eliminate 
the requirement at Sec.  1007.15(a)(6) that an initial application 
include a projection of caseload. We believe that it is unrealistic for 
State or territory preparing an initial application to provide any 
meaningful caseload projection.
1007.17 Recertification
    A MFCU must be recertified annually by OIG to receive Federal 
reimbursement for a portion of its costs. Forty-nine States and the 
District of Columbia have established and operate a Unit. We propose to 
revise regulations to reflect the recertification process that has 
evolved since the program began. The proposed regulation at Sec.  
1007.17 would: (1) Describe the information that must be provided to 
OIG, including the recertification reapplication and statistical 
reporting; (2) describe other

[[Page 64392]]

information considered for recertification; (3) clarify the basis for 
recertification by OIG; (4) create a procedure in which OIG notifies 
the Unit whether the reapplication is approved or denied by the Unit's 
recertification date; (5) clarify that an approved reapplication may be 
subject to special conditions; and (6) establish basic procedures for 
reconsideration of an OIG denial of recertification.
Requirements for Recertification
    Section 1903(q)(7) of the Act requires a Unit to submit to the 
Secretary an application and ``annual report containing such 
information as the Secretary determines, by regulations, to be 
necessary to determine whether the entity meets the other requirements 
of this paragraph.'' Current regulations at Sec.  1007.17 describe the 
content of the ``annual report,'' including certain statistical data 
and budget information, a narrative evaluating performance, any 
specific problems that have arisen over the year, and other matters 
that have impaired the Unit's effectiveness.
    We propose to revise Sec.  1007.17(a) to describe the information 
that Units must submit annually to OIG to fulfill the statutory mandate 
that Units provide ``annual reports'' to the Secretary. Under our 
proposal, Units may choose to no longer submit a document labeled 
``annual report,'' so long as the items described in the proposed 
regulation are submitted to OIG on an annual basis in the timeframes 
established for each Unit as part of its annual reapplication. Such 
information includes statistical and other information provided to OIG 
in an electronic format. We describe below the items that must be 
submitted by each MFCU over the course of the year that satisfy the 
requirement for an annual report.
    Narrative and approved data mining activities. First, as part of 
the reapplication, at the new Sec.  1007.17(a)(1), we would continue to 
require the narrative from current Sec.  1007.17(h) that evaluates the 
Unit's performance, describes any specific problems it has had in 
connection with the procedures and agreements under this part, and 
discusses other matters that have impaired its effectiveness. The 
narrative should also include any extended investigative approvals, 
pursuant to proposed Sec.  1007.11(a)(2). Second, for Units that have 
received OIG approval to conduct data mining under Sec.  1007.20, we 
would also continue to require that they submit information on their 
data mining activities.
    Information Request. At the new Sec.  1007.17(a)(1)(iii), we 
propose an annual requirement that Units provide information to OIG 
addressing their compliance with this part and adherence to MFCU 
performance standards. This proposed provision would align the 
regulation with current practice in which the Units, as part of their 
reapplication, provide information requested by OIG for that year. We 
have also included in the proposed regulation a requirement that Units 
advise OIG of significant changes since the prior year's 
recertification. This would replace a provision contained in Sec.  
1007.15(c)(1), requiring the Unit to advise the Secretary of any 
significant changes in the information and documentation submitted with 
the initial MFCU application. However, we think it is more appropriate 
for a Unit to advise OIG of significant changes that occurred during 
the prior year, rather than since its initial application, which for 
some Units could be 30 years or more. The information requested by OIG 
prompts a Unit to answer questions about all aspects of its operations, 
which should lead to responses that describe any significant changes.
    Statistical report. Under the new Sec.  1007.17(a)(2), we propose 
to amend the regulations to include the requirement that MFCUs submit 
an annual statistical report by November 30 of each year for the prior 
Federal fiscal year (FFY), containing the required data elements 
developed by OIG in collaboration with the MFCUs. Units submit to OIG 
statistical reports that include information on staffing, 
investigations, criminal prosecutions and civil actions, and other case 
outcomes. The statistical reports would be used, along with other 
information, to evaluate MFCUs for recertification. The statistical 
data provided by the Units would also enable OIG to assess performance 
and identify trends for all MFCUs.
    We propose that the requirement for a separate annual statistical 
report replace the statistics that are required as part of the current 
annual report at Sec.  1007.17(a) through (e). This would eliminate 
duplication of reported statistics and provide a standard timeframe 
(the FFY) for reporting rather than the current annual report 
requirement, which is tied to the recertification period of each Unit 
and is often a different year period than the FFY. Further, the current 
regulation requires the Unit to submit projected performance statistics 
for the upcoming recertification period. We no longer require this 
level of detail because of the difficulty of providing projected 
statistics. Finally, the current regulation requires a Unit to submit 
its costs incurred for the recertification period. Because a Unit 
submits an official Federal financial form (SF-425) reporting its costs 
to OIG for the FFY, we do not need an unofficial accounting of costs 
for the recertification period which, as noted, is often different from 
the FFY.
    We also propose at the new Sec.  1007.17(b) to include other 
information not submitted by the MFCU, but which, when appropriate, is 
reviewed for recertification. This would include information obtained 
during periodic onsite reviews and other information OIG deems 
necessary or warranted. It may also include obtaining feedback from 
stakeholders, such as the Medicaid program integrity director and the 
OIG special agent-in-charge, on their working relationships and 
business processes with the MFCU.
Basis for Recertification
    Section 1007.15(d) describes items that OIG considers when 
recertifying a MFCU, including the information on the MFCU's 
reapplication, the annual report, the effective use of resources in 
investigating and prosecuting fraud, and ``other reviews or 
information'' deemed necessary or warranted. We propose to describe at 
the new Sec.  1007.17(c) OIG's basis for recertifying a MFCU, including 
specifying the ``other reviews or information'' OIG deems necessary or 
warranted. To determine whether a Unit has demonstrated that it 
effectively carries out the functions and responsibilities of this part 
for purposes of recertification, OIG examines a Unit's compliance with 
this part and other applicable Federal regulations as well as with OIG 
policy transmittals. OIG consults with MFCU stakeholders. OIG also uses 
the statutory performance standards that Units must satisfy under Sec.  
1902(a)(61) of the Act as a guideline in evaluating whether a Unit is 
effectively and efficiently carrying out its duties and 
responsibilities.
    Further, as described in Sec.  1007.11, in addition to the 
responsibility of having a Statewide program for investigating and 
prosecuting (or referring for prosecution) Medicaid fraud, MFCUs are 
also responsible for reviewing complaints alleging abuse or neglect of 
patients in health care facilities receiving payments under the State 
Medicaid plan and either investigating the complaints or referring them 
to the appropriate authority, which we interpret to mean that Units can 
investigate and prosecute cases arising from those complaints. At Sec.  
1007.17(c)(5), we propose to also include effective performance of the 
latter responsibility as an additional

[[Page 64393]]

consideration in OIG's recertification review. OIG is aware that Units 
apportion their resources between the two responsibilities in different 
ways but believes that Units should not neglect one type of case.
Recertification Notification and Denial of Recertification
    Section 1007.15(d)(l) provides that a Unit will be notified 
promptly whether its reapplication has been approved. We propose to 
modify the notice procedure at proposed Sec.  1007.17(d) to state that 
OIG will provide notice of approval or denial of recertification by the 
Unit's recertification date. We also propose that the recertification 
approval may be subject to special conditions or restrictions, as 
provided in 45 CFR 75.207, and may require corrective action. Further, 
if an application for recertification is denied, we propose in the new 
Sec.  1007.17(e) that a Unit may request reconsideration of a denial by 
providing written information addressing the findings on which the 
denial was based. Within 30 days of receipt of the request for 
reconsideration, OIG provides a final decision, and its basis, in 
writing to the Unit and notifies CMS if the Unit does not meet the 
requirements for recertification. Under section 1903(a)(6), the Federal 
Government may not provide FFP in costs incurred by a Unit that is not 
certified by OIG as meeting the requirements for operating a Unit as 
found at section 1903(q).
Subpart C--Federal Financial Participation
1007.19 FFP Rate and Eligible Costs
    In the initial legislation establishing MFCUs, Congress provided 
that Federal funds would reimburse States for 90 percent of their MFCU 
costs for 12 quarters in order to encourage the development of State 
MFCUs. In 1980, Congress amended section 1903(a)(6) to provide a 
continuing incentive by authorizing ongoing Federal reimbursement at 75 
percent of a MFCU's allowable costs after the first 12 quarters of 
operation.
    We propose to modify Sec.  1007.19(a) to reflect that, under law, 
FFP is available at the rate of 90 percent during the first 12 quarters 
of a Unit's operation and at 75 percent thereafter, beginning with the 
13th quarter of a Unit's operation. We also propose other modifications 
to clarify that each quarter of reimbursement at the 90 percent 
matching rate is counted in determining when the 13th quarter begins. 
Quarters of MFCU operation do not have to be consecutive to accumulate 
for purposes of determining when the 90 percent matching period has 
ended.
    We also propose to amend Sec.  1007.19(d) to clarify in regulation 
that a Unit may receive FFP for its efforts to increase referrals 
through program outreach activities. These are activities that most 
Units currently undertake as a part of their responsibilities under the 
grant but are not addressed in the program regulations in part 1007. 
Permissible program outreach activities by the Units may include 
efforts to educate Medicaid providers, law enforcement entities, and 
the public about Medicaid fraud, patient abuse or neglect, and MFCU 
authority and jurisdiction. Program outreach activities may also 
include the dissemination of outreach and educational materials 
specifically designed to increase awareness of the MFCU mission that 
could lead to referrals to the Unit. These outreach materials must be 
of a de minimus cost and be useful and practical.
    We propose to amend Sec.  1007.19(e)(2) to clarify the prohibition 
on the ability of Units to receive FFP to ``identify situations in 
which a question of fraud may exist.'' Specifically, the provision 
prohibits FFP ``for expenditures attributable to: [. . .], except as 
provided under Sec.  1007.20 [allowing Units to seek OIG approval to 
conduct data mining], efforts to identify situations in which a 
question of fraud may exist, including the screening of claims and 
analysis of patterns and practice that involve data mining as defined 
in Sec.  1007.1.'' We are proposing to replace ``including the 
screening of claims . . .'' with ``by the screening of claims . . .'' 
to clarify the ability of Units to engage in activities, other than 
data mining, to identify potential civil or criminal fraud in the 
Medicaid program.
    We believe that this revision to the Unit's permissible activities 
is supported by the following: MFCUs have the ability to work with a 
variety of State agencies and private referral sources to identify 
possible fraud and to undertake sophisticated detection activities, 
such as undercover operations. None of these activities interferes with 
the program integrity activities of the State Medicaid agency, which we 
believe was the initial intended purpose of the prohibition. Our 
proposal would remove from the Medicaid agency the sole burden of 
identifying potential fraud and would allow MFCUs to be less dependent 
on referrals from Medicaid agencies.
1007.21 Disallowance Procedures
    We propose to amend the regulation in the new Sec.  1007.21 to 
establish procedures for taking formal disallowances of FFP, for Units 
to request reconsideration of disallowances and to appeal to the HHS 
Departmental Appeals Board. The proposal is similar to CMS's 
requirements for the appeal of disallowances by State Medicaid agencies 
found at 42 CFR 430.42.
Subpart D--Other Provisions
1007.23 Other Applicable HHS Regulations
    We propose to update the listing, contained in Sec.  1007.21, of 
other applicable HHS regulations that were amended after the current 
MFCU regulations were promulgated. Specifically, we have updated the 
reference to the Department's award administration regulations now 
contained in 45 CFR part 75. 45 CFR part 75 establishes the HHS 
specific regulations for the Office of Management and Budget (OMB) 
interim final rule of the Uniform Guidance (UG) at 2 CFR part 200, 
published on December 26, 2014. We are also updating references to 
regulations governing HHS Departmental Appeals Board procedures and HHS 
nondiscrimination policies.

III. Regulatory Impact Statement

    We have examined the impact of this rule, as required by Executive 
Order 12866 on Regulatory Planning and Review (September 30, 1993), 
Executive Order 13563 on Improving Regulation and Regulatory Review 
(January 18, 2011), the Regulatory Flexibility Act (RFA) (September 19, 
1980, Pub. L. 96-354), section 1102(b) of the Social Security Act, 
section 202 of the Unfunded Mandates Reform Act of 1995 (March 22, 
1995; Pub. L. 104-4), Executive Order 13132 on Federalism (August 4, 
1999) and the Congressional Review Act (5 U.S.C. 804(2)).
    Executive Orders 12866 and 13563 direct agencies to assess all 
costs and benefits of available regulatory alternatives and, if 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety effects, distributive impacts, and equity). A 
regulatory impact analysis (RIA) must be prepared for major rules with 
economically significant effects ($100 million or more in any 1 year). 
This rule does not reach the economic threshold, and thus is not 
considered a major rule. Since the proposed

[[Page 64394]]

regulation would only implement current practice and policy, we believe 
the economic impact to be negligible.
    The RFA requires agencies to analyze options for regulatory relief 
of small entities. For purposes of the RFA, small entities include 
small businesses, nonprofit organizations, and small governmental 
jurisdictions. Most hospitals and most other providers and suppliers 
are small entities, either by nonprofit status or by having revenues of 
$7.5 million to $38.5 million in any 1 year. Individuals and States are 
not included in the definition of a small entity. We are not preparing 
an analysis for the RFA because we have determined, and the Secretary 
certifies, that this final rule will not have a significant economic 
impact on a substantial number of small entities.
    In addition, section 1102(b) of the Act requires us to prepare a 
regulatory impact analysis if a rule may have a significant impact on 
the operations of a substantial number of small rural hospitals. This 
analysis must conform to the provisions of section 604 of the RFA. For 
purposes of section 1102(b) of the Act, we define a small rural 
hospital as a hospital that is outside of a Metropolitan Statistical 
Area for Medicare payment regulations and has fewer than 100 beds. We 
are not preparing an analysis for section 1102(b) of the Act because we 
have determined, and the Secretary certifies, that this final rule will 
not have a significant impact on the operations of a substantial number 
of small rural hospitals.
    Section 202 of the Unfunded Mandates Reform Act of 1995 also 
requires that agencies assess anticipated costs and benefits before 
issuing any rule whose mandates require spending in any 1 year of $100 
million in 1995 dollars, updated annually for inflation. In 2015, that 
threshold is approximately $144 million. This rule will have no 
consequential effect on State, local, or tribal governments or on the 
private sector.
    Executive Order 13132 establishes certain principles and criteria 
that an agency must follow when it implements a regulation or other 
policy that has Federalism implications, defined in the Order to mean 
that the regulation or policy has substantial direct effects on the 
States, on the relationship between the national government and the 
States, or on the distribution of power and responsibilities among the 
various levels of government. The Order also requires a level of 
consultation with State or local officials when an agency formulates 
and implements a regulation that has Federalism implications, that 
imposes substantial direct compliance costs on State and local 
governments, and that is not required by statute.
    We do not believe that this proposed regulation has Federal 
implications as it would not have a substantial direct effect on the 
States or on the relationship or distribution of power and 
responsibilities among levels of government. We also do not believe 
that the proposed regulation would impose substantial direct compliance 
costs on States. Rather, the regulation would reflect certain statutory 
changes governing operation of the MFCUs that have already been 
implemented and would codify policy and practice involving the 
organization and operation of the Units. We believe that the content of 
the regulation is consistent with the partnership between the Federal 
and State governments that has been established for the financing and 
administration of the larger Medicaid program. We further believe that 
any costs related to compliance with the proposed regulation are 
minimal and not substantial.
    However, to the extent that that the proposed regulation is seen as 
having Federal implications, the proposed regulation is consistent with 
the principles and criteria established in the Order. The proposed 
regulation would strictly adhere to constitutional principles and would 
be deferential to the States with respect to the policymaking and 
administration of State operations related to the investigation and 
prosecution of Medicaid provider fraud and patient abuse or neglect. 
With regard to consultation, the policies contained in the proposed 
regulation were developed in consultation and collaboration with the 
States.
    In accordance with the provisions of Executive Order 12866, this 
regulation was reviewed by OMB.

IV. Paperwork Reduction Act

    Under the Paperwork Reduction Act (PRA) of 1995, before a 
collection-of-information requirement is submitted to OMB for review 
and approval, we are required to provide a 60-day notice in the Federal 
Register and solicit public comment. We propose to revise the scope of 
our annual collection of information as part of this NPRM to revise the 
MFCU oversight regulations contained in 42 CFR part 1007. The 
collection would contain certain mandatory information required 
annually as outlined at proposed 42 CFR 1007.17 which includes a 
reapplication of a brief narrative, data mining outcomes, and an 
information request as well as an annual statistical report. All of 
these items would replace the ``Annual Report'' required at current 
Sec.  1007.17. Specifically, the proposed reapplication contains 
several elements. First, it would include a brief narrative that 
evaluates the Unit's performance, describes any specific problems it 
has had, and discusses any other matters that have impaired its 
effectiveness. This narrative could be in any format, as determined by 
each MFCU.
    Second, those MFCUs approved by OIG to conduct data mining under 42 
CFR 1007.20 are required by the current regulation to submit the costs 
expended by the MFCU on data mining activities, the amount of staff 
time devoted to data mining activities, the number of cases generated 
from those activities, the outcome and status of those cases, and any 
other relevant indicia of return on investment from data mining 
activities. The reporting format for data mining activities is 
determined by each reporting MFCU.
    Third, the proposed reapplication would also include an information 
request concerning compliance with the statute, regulations, and policy 
transmittals as well as adherence to the MFCU performance standards. 
The information request would be in a standard question and answer 
format and has always been a part of the reapplication.
    Fourth, and separate from the reapplication, we propose that MFCUs 
provide a Federal fiscal year (FFY) annual statistical report 
containing data points found at proposed 42 CFR 1007.17(b). This is 
consistent with the MFCU performance standard that a Unit have a case 
management system that (1) allows efficient access to case information 
and other performance data from initiation to resolution and (2) allows 
for reporting of case information. Units maintain case management 
systems on an ongoing basis and would upload the proposed data to a 
secure web portal through a Federal service provider, OMB MAX by 
November 30 of each year. This annual statistical report would replace 
the statistical information that we propose to no longer require in an 
``Annual Report,'' as at 42 CFR 1007.17(a) through (e), although some 
of the data points are the same or similar to the statistics proposed 
in the annual statistical report. The proposed new data points would be 
an enhancement to our current information and would, on a FFY basis, 
more completely and accurately describe Unit staffing, caseload, 
criminal and civil case outcomes, collections, and referrals.
    We estimate that the burden for these proposed collections would be 
similar to the burden approved under OMB approval No. 0990-0162. First, 
the

[[Page 64395]]

currently approved burden estimate for the ``Annual Report'' is 88 
hours per respondent. Because the burden previously assigned to the 
``Annual Report'' would shift to the separate annual statistical report 
provided at the end of the FFY, we have re-estimated that preparing the 
brief narrative would take 3 hours per respondent. Based on reports 
from MFCU officials, providing information on data mining activities, 
if required, would require 1 hour of additional burden, as is currently 
approved. We have then shifted most of the balance of the current 
``Annual Report'' burden (80 hours) to the proposed annual statistical 
report. We believe that most of the burden for preparing the annual 
statistical report consists of the ongoing updating of the Unit's case 
management system and not for the uploading of the actual report, so we 
believe the estimate is accurate. Second, the recertification 
reapplication information request has not changed from current practice 
and is approved under OMB No. 0990-0162. However, based on reports from 
MFCU officials, we have increased the reapplication information request 
burden estimate by 4 hours per respondent to 9 hours. Thus, we estimate 
that after shifting the burden between collections, the total burden 
would be the same as currently approved.
    Based on our knowledge of MFCU staff hourly rates and which MFCU 
staff person would prepare each collection, we estimate a MFCU official 
would spend approximately 29 hours at an estimated $38 per hour 
preparing the reapplication and annual statistical report. We estimate 
that a MFCU support staff person would spend approximately 64 hours of 
effort at an estimated hourly rate of $16 per hour to develop draft 
products, fulfill data entry activities, complete all required 
administrative functions, and confer with the MFCU supervising 
official, all of which are necessary to finalize the collection for 
submission to OIG. Based on these estimated hours and staff wage rates, 
the weighted average wage rate is $22.85 per hour. Thus, identical to 
the estimate that was approved under OMB No. 0990-0162, our best 
estimate is that about 93 burden hours would be expended by each of the 
50 MFCUs.
    OIG would use the information collected to determine the MFCUs' 
compliance with Federal requirements and eligibility for continued 
Federal financial participation (FFP) under the Federal MFCU grant 
program, as part of the annual recertification process for each MFCU. 
The collection would also allow OIG to assess performance and trends in 
Medicaid fraud and patient abuse and neglect across all MFCUs.
    In order to evaluate fairly whether this information collection 
should be approved by OMB, section 3506(c)(2)(A) of the PRA requires 
that we solicit comment on the following issues:
     The need for the information collection and its usefulness 
in carrying out the proper functions of our agency;
     The accuracy of our estimate of the information collection 
burden;
     The quality, utility, and clarity of the information to be 
collected; and
     Recommendations to minimize the information collection 
burden on the affected public, including automated collection 
techniques.
    Under the PRA, the time, effort, and financial resources necessary 
to meet the information collection requirements referenced in this 
section are to be considered. We explicitly seek, and will consider, 
public comment on our assumptions as they relate to the PRA 
requirements summarized in this section. Comments on these information 
collection activities should be sent to the following address within 60 
days following the Federal Register publication of this proposed rule: 
OIG Desk Officer, Office of Management and Budget, Room 10235, New 
Executive Office Building, 725 17th Street NW., Washington, DC 20053.
* * * * *

List of Subjects

42 CFR Part 455--Program integrity: Medicaid.

    Fraud, Grant programs-health, Health facilities, Health 
professions, Investigations, Medicaid, Reporting and recordkeeping 
requirement.

42 CFR Part 1007--State Medicaid fraud control units.

    Administrative practice and procedure, Fraud, Grant programs-
health, Medicaid, Reporting and recordkeeping requirements.

    For the reasons set forth in the preamble, the Centers for Medicare 
& Medicaid Services (CMS) and the Office of Inspector General (OIG) 
respectively, propose to amend 42 CFR part 455 and 1007 as follows:

CHAPTER IV--CENTERS FOR MEDICARE & MEDICAID SERVICES, DEPARTMENT OF 
HEALTH AND HUMAN SERVICES

0
1. The Authority citation for part 455 continues to read as follows:

    Authority:  Sec. 1102 of the Social Security Act (42 U.S.C. 
1302).

0
2. Section 455.21 is amended by adding paragraph (c) to read as 
follows:


Sec.  455.21  Cooperation with State Medicaid fraud control units.

* * * * *
    (c) The agency must enter into a written agreement with the unit 
under which--
    (1) The agency will agree to comply with all requirements of Sec.  
455.21(a);
    (2) The unit will agree to comply with the requirements of 42 CFR 
1007.11(c); and
    (3) The agency and the unit will agree to--
    (i) Establish a practice of regular meetings or communication 
between the two entities;
    (ii) Establish a set of procedures for how they will cooperate and 
coordinate their efforts; and
    (iii) Establish procedures for 42 CFR 1007.9(e) through 1007.9(h).
    (iv) Review and, as necessary, update the agreement no less 
frequently than every 5 years to ensure that the agreement reflects 
current law and practice.

CHAPTER V--OFFICE OF INSPECTOR GENERAL-HEALTH CARE, DEPARTMENT OF 
HEALTH AND HUMAN SERVICES

0
3. Part 1007 is revised to read as follows:

PART 1007--STATE MEDICAID FRAUD CONTROL UNITS

Subpart-A--General Provisions and Definitions
1007.1 Definitions.
1007.3 What is the statutory basis for and organization of this 
rule?
Subpart-B--Requirements for Certification
1007.5 What are the single identifiable entity requirements for a 
Unit?
1007.7 What are the prosecutorial authority requirements for a Unit?


Sec.  1007.9  What is the relationship to the Medicaid agency, and what 
should be included in the agreement with the agency?

1007.11 What are the functions and responsibilities of a Unit?
1007.13 What are the staffing requirements of a Unit?
1007.15 How does a State apply to establish a Unit and how is a Unit 
initially certified?
1007.17 How is a Unit recertified annually?
Subpart-C--Federal Financial Participation
1007.19 What is the Federal financial participation (FFP) rate and 
what costs are eligible for FFP?
1007.20 Under what circumstances is data mining permissible?
1007.21 What is the procedure for disallowance of claims for FFP?
Subpart-D--Other Provisions
1007.23 What other HHS regulations apply to a Unit?

     Authority:  42 U.S.C. 1302, 1396a(a)(61), 1396b(a)(6), 
1396b(b)(3) and 1396b(q).

[[Page 64396]]

Subpart-A--General Provisions and Definitions


Sec.  1007.1  Definitions.

    As used in this part, unless otherwise indicated by the context:
    Abuse of patients means any act that constitutes abuse of a patient 
under applicable criminal State law, including the willful infliction 
of injury, unreasonable confinement, intimidation, or punishment with 
resulting physical or financial harm, pain or mental anguish.
    Board and care facility means a residential setting that receives 
payment (regardless of whether such payment is made under Title XIX of 
the Social Security Act) from or on behalf of two or more unrelated 
adults who reside in such facility, and for whom one or both of the 
following is provided:
    (1) Nursing care services provided by, or under the supervision of, 
a registered nurse, licensed practical nurse, or licensed nursing 
assistant. (2) A substantial amount of personal care services that 
assist residents with the activities of daily living, including 
personal hygiene, dressing, bathing, eating, toileting, ambulation, 
transfer, positioning, self-medication, body care, travel to medical 
services, essential shopping, meal preparation, laundry, and housework.
    Data mining means the practice of electronically sorting Medicaid 
or other relevant data, including, but not limited to, the use of 
statistical models and intelligent technologies, to uncover patterns 
and relationships within that data to identify aberrant utilization, 
billing, or other practices that are potentially fraudulent.
    Director means a professional employee of the Unit who supervises 
all Unit employees, either directly or through other MFCU managers.
    Exclusive effort means that professional Unit employees, except as 
otherwise permitted in Sec.  1007.13, dedicate their efforts 
``exclusively'' to the functions and responsibilities of a Unit as 
described in this part. Exclusive effort requires that duty with the 
Unit be intended to last for at least 1 year and includes an 
arrangement in which an employee is on detail or assignment from 
another government agency, but only if the detail or arrangement is 
intended to last for at least 1 year.
    Fraud means any act that constitutes criminal or civil fraud under 
applicable State law. It includes a deception, concealment of a 
material fact, or misrepresentation made by a person intentionally, in 
deliberate ignorance of the truth, or in reckless disregard of the 
truth.
    Full-time employee means an employee of the Unit who has full-time 
status as defined by the State.
    Health care facility means a provider that receives payments under 
Medicaid and furnishes food, shelter, and some treatment or services to 
four or more persons unrelated to the proprietor in an inpatient 
setting.
    Misappropriation of patient funds means the wrongful taking or use, 
as defined under applicable State law, of funds or property of a 
patient residing in a health care facility or board and care facility.
    Neglect of patients means any act that constitutes abuse of a 
patient under applicable criminal State law, including the willful 
failure to provide goods and services necessary to avoid physical harm, 
mental anguish, or mental illness.
    Part-time employee means an employee of the Unit who has part-time 
status as defined by the State.
    Professional employee means an investigator, attorney, or auditor.
    Program abuse means provider practices that fall short of acts 
which constitute civil or criminal fraud under applicable Federal and 
State law, including those that are inconsistent with sound fiscal, 
business, or medical practices. Program abuse may result in an 
unnecessary cost to the Medicaid program, inappropriate charges to 
beneficiaries or in reimbursement for services that are not medically 
necessary.
    Provider means an individual or entity that furnishes items or 
services for which payment is claimed under Medicaid, or an individual 
or entity that is required to enroll in a State Medicaid program, such 
as an ordering or referring physician.
    Unit means the State Medicaid Fraud Control Unit.


Sec.  1007.3  What is the statutory basis for and organization of this 
rule?

    (a) Statutory basis. This part codifies sections 1903(a)(6) and 
1903(b)(3) of the Social Security Act (the Act), which establish the 
amounts and conditions of Federal matching payments for expenditures 
incurred in establishing and operating a State MFCU. This part also 
implements section 1903(q) of the Act, which establishes the basic 
requirements and standards that Units must meet to demonstrate that 
they are effectively carrying out the functions of the State MFCU in 
order to be certified by OIG as eligible for FFP under title XIX. 
Section 1902(a)(61) of the Act requires a State to provide in its 
Medicaid State plan that it operates a MFCU that effectively carries 
out the functions and requirements described in this part, as 
determined in accordance with standards established by OIG, unless the 
State demonstrates that a Unit would not be cost-effective because of 
minimal Medicaid fraud in the covered services under the plan and that 
beneficiaries under the plan will be protected from abuse and neglect 
in connection with the provision of medical assistance under the plan 
without the existence of such a Unit. CMS retains the authority to 
determine a State's compliance with Medicaid State plan requirements in 
accordance with Section 1902(a) of the Act.
    (b) Organization of the rule. Subpart A of this part defines terms 
used in this part and sets forth the statutory basis and organization 
of this part. Subpart B specifies the certification requirements that a 
Unit must meet to be eligible for FFP, including requirements for 
applying and reapplying for certification. Subpart C specifies FFP 
rates, costs eligible and not eligible for FFP, and FFP disallowance 
procedures. Subpart D specifies other HHS regulations applicable to the 
MFCU grants.

Subpart B--Requirements for Certification


Sec.  1007.5  What are the single identifiable entity requirements for 
a Unit?

    (a) A Unit must be a single identifiable entity of the State 
government.
    (b) To be considered a single identifiable entity of the State 
government the Unit must:
    (1) Be a single organization reporting to the Unit director;
    (2) Operate under a budget that is separate from that of its parent 
agency; and
    (3) Have the headquarters office and any field offices each in 
their own contiguous space.


Sec.  1007.7  What are the prosecutorial authority requirements of a 
Unit?

    A Unit must be organized according to one of the following three 
options related to a Unit's prosecutorial authority:
    (a) The Unit is in the office of the State Attorney General or 
another department of State government that has Statewide authority to 
prosecute individuals for violations of criminal laws with respect to 
fraud in the provision or administration of medical assistance under a 
State plan implementing title XIX of the Act;
    (b) If there is no State agency with Statewide authority and 
capability for criminal fraud or patient abuse and neglect 
prosecutions, the Unit has

[[Page 64397]]

established formal written procedures ensuring that the Unit refers 
suspected cases of criminal fraud in the State Medicaid program or of 
patient abuse and neglect to the appropriate prosecuting authority or 
authorities, and provides assistance and coordination to such authority 
or authorities in the prosecution of such cases; or
    (c) The Unit has a formal working relationship with the office of 
the State Attorney General, or another office with Statewide 
prosecutorial authority, and has formal written procedures for 
referring to the Attorney General or other office suspected criminal 
violations and for effective coordination of the activities of both 
entities relating to the detection, investigation and prosecution of 
those violations relating to the State Medicaid program. Under this 
working relationship, the office of the State Attorney General, or 
other office, must agree to assume responsibility for prosecuting 
alleged criminal violations referred to it by the Unit. However, if the 
Attorney General finds that another prosecuting authority has the 
demonstrated capacity, experience and willingness to prosecute an 
alleged violation, he or she may refer a case to that prosecuting 
authority, so long as the Attorney General's Office maintains oversight 
responsibility for the prosecution and for coordination between the 
Unit and the prosecuting authority.


Sec.  1007.9  What is the relationship to the Medicaid agency, and what 
should be included in the agreement with the agency?

    (a) The Unit must be separate and distinct from the Medicaid 
agency.
    (b) No official of the Medicaid agency will have authority to 
review the activities of the Unit or to review or overrule the referral 
of a suspected criminal violation to an appropriate prosecuting 
authority.
    (c) The Unit will not receive funds paid under this part either 
from or through the Medicaid agency.
    (d) The Unit must enter into a written agreement with the Medicaid 
agency under which:
    (1) The Medicaid agency will agree to comply with all requirements 
of Sec.  455.21(a) of this title;
    (2) The Unit will agree to comply with the requirements of Sec.  
1007.11(c) of this title; and
    (3) The Medicaid agency and the Unit will agree to:
    (i) Establish a practice of regular meetings or communication 
between the two entities;
    (ii) Establish procedures for how they will coordinate their 
efforts; and
    (iii) Establish procedures for Sec. Sec.  1007.9(e) through 
1007.9(h).
    (iv) Review and, if needed, update the agreement no less frequently 
than every 5 years to ensure that the agreement reflects current law 
and practice.
    (e)(1) The Unit may refer any provider with respect to which there 
is pending an investigation of a credible allegation of fraud under the 
Medicaid program to the Medicaid agency for payment suspension in whole 
or part under Sec.  455.23 of this title.
    (2) Referrals may be brief, but must be in writing and include 
sufficient information to allow the Medicaid agency to identify the 
provider and to explain the credible allegations forming the grounds 
for the payment suspension.
    (f) Any request by the Unit to the Medicaid agency to delay 
notification to the provider of a payment suspension under Sec.  455.23 
of this title must be made promptly in writing.
    (g) The Unit should reach a decision on whether to accept a case 
referred by the Medicaid agency in a timely fashion. When the Unit 
accepts or declines a case referred by the Medicaid agency, the Unit 
promptly notifies the Medicaid agency in writing of the acceptance or 
declination of the case.
    (h) Upon request from the Medicaid agency on a quarterly basis 
under Sec.  455.23(d)(3)(ii), the Unit will certify that any matter 
accepted on the basis of a referral continues to be under investigation 
thus warranting continuation of the payment suspension.


Sec.  1007.11  What are the functions and responsibilities of a Unit?

    (a) The Unit must conduct a Statewide program for investigating and 
prosecuting (or referring for prosecution) violations of all applicable 
State laws pertaining to the following:
    (1) Fraud in the administration of the Medicaid program, the 
provision of medical assistance, or the activities of providers.
    (2) Fraud in any aspect of the provision of health care services 
and activities of providers of such services under any Federal health 
care program (as defined in section 1128B(f)(1)of the Act), if the Unit 
obtains the written approval of the Inspector General of the relevant 
agency and the suspected fraud or violation of law in such case or 
investigation is primarily related to the State Medicaid program.
    (3) Such State laws include criminal statutes as well as civil 
false claims statutes or other civil authorities.
    (b)(1) The Unit must also review complaints alleging abuse or 
neglect of patients, including complaints of the misappropriation of a 
patient's funds, in health care facilities receiving payments under 
Medicaid.
    (2) At the option of the Unit, it may review complaints of abuse or 
neglect of patients, including misappropriation of patient funds, 
residing in board and care facilities, regardless of whether payment to 
such facilities is made under Medicaid.
    (3) If the initial review of the complaint indicates substantial 
potential for criminal prosecution, the Unit must investigate the 
complaint or refer it to an appropriate criminal investigative or 
prosecutorial authority.
    (4) If the initial review does not indicate a substantial potential 
for criminal prosecution, the Unit must, if appropriate, refer the 
complaint to the proper Federal, State, or local agency.
    (c) If the Unit, in carrying out its duties and responsibilities 
under paragraphs (a) and (b) of this section, discovers that 
overpayments have been made to a health care facility or other 
provider, the Unit must either recover such overpayment as part of its 
resolution of a fraud case or refer the matter to the proper State 
agency for collection.
    (d) Where a prosecuting authority other than the Unit is to assume 
responsibility for the prosecution of a case investigated by the Unit, 
the Unit must ensure that those responsible for the prosecutorial 
decision and the preparation of the case for trial have the fullest 
possible opportunity to participate in the investigation from its 
inception and must provide all necessary assistance to the prosecuting 
authority throughout all resulting prosecutions.
    (e)(1) The Unit, if requested, will make available to OIG 
investigators and attorneys, other Federal investigators, and 
prosecutors, all information in the Unit's possession concerning 
investigations or prosecutions conducted by the Unit.
    (2) The Unit will coordinate with OIG investigators and attorneys, 
other Federal investigators, and prosecutors on any Unit cases 
involving the same suspects or allegations.
    (3) The Unit will establish a practice of regular Unit meetings or 
communication with OIG investigators and Federal prosecutors.
    (4) When the Unit lacks the authority or resources to pursue a 
case, including for allegations of Medicare fraud and for civil false 
claims actions in a State without a civil false claims act or other 
State authority, the Unit will make appropriate referrals to OIG 
investigators and attorneys or other Federal investigators or 
prosecutors.

[[Page 64398]]

    (5) The Unit will establish written procedures for items described 
in paragraphs (e)(1) through (4) of this section.
    (f) The Unit will guard the privacy rights of all beneficiaries and 
other individuals whose data is under the Unit's control and will 
provide adequate safeguards to protect sensitive information and data 
under the Unit's control.
    (g)(1) The Unit will transmit to OIG pertinent information on all 
convictions, including charging documents, plea agreements, and 
sentencing orders, for purposes of program exclusion under section 1128 
of the Act.
    (2) Convictions include those obtained either by Unit prosecutors 
or non-Unit prosecutors in any case investigated by the Unit.
    (3) Such information will be transmitted to OIG within 30 days of 
sentencing, or as soon as practicable if the Unit encounters delays in 
receiving the necessary information from the sentencing court.


Sec.  1007.13  What are the staffing requirements of a Unit?

    (a) The Unit will employ sufficient professional, administrative, 
and support staff to carry out its duties and responsibilities in an 
effective and efficient manner.
    (b) The Unit must employ individuals from each of the following 
categories of professional employees, whose exclusive effort, as 
defined in Sec.  1007.1, is devoted to the work of the Unit:
    (1) One or more attorneys capable of prosecuting health care fraud 
or criminal cases and capable of giving informed advice on applicable 
law and procedures and providing effective prosecution or liaison with 
other prosecutors;
    (2) One or more experienced auditors capable of reviewing financial 
records and advising or assisting in the investigation of alleged fraud 
and patient abuse and neglect; and
    (3) One or more investigators, including a senior investigator who 
is capable of supervising and directing the investigative activities of 
the Unit.
    (c) The Unit must employ a director, as defined in Sec.  1007.1, 
who supervises all Unit employees.
    (d) Professional employees:
    (1) Must devote their exclusive effort to the work of the Unit, as 
defined in Sec.  1007.1 and except as provided in paragraphs(d)(2) and 
(d)(3) of this section;
    (2) May be employed outside the Unit during non-duty hours, only if 
the employee is not:
    (i) Employed with a State agency (other than the Unit itself) or 
its contractors; or
    (ii) Employed with an entity whose mission poses a conflict of 
interest with Unit function and duties;
    (3) May perform non-MFCU assignments for the State government only 
to the extent that such duties are limited in duration; and
    (4) Must be under the direction and supervision of the Unit 
director.
    (e) The Unit may employ administrative and support staff, such as 
paralegals, information technology personnel, interns, and secretaries, 
who may be full-time or part-time employees and must report to the 
director or other Unit supervisor.
    (f) The Unit will employ, or have available to it, individuals who 
are knowledgeable about the provision of medical assistance under title 
XIX and about the operations of health care providers.
    (g)(1) The Unit may employ, or have available through consultant 
agreements or other contractual arrangements, individuals who have 
forensic or other specialized skills that support the investigation and 
prosecution of cases.
    (2) The Unit may not, through consultant agreements or other 
contractual arrangements, rely on individuals not employed directly by 
the Unit for the investigation or prosecution of cases.
    (h) The Unit must provide training for its professional employees 
for the purpose of establishing and maintaining proficiency in Medicaid 
fraud and patient abuse and neglect matters.


Sec.  1007.15  How does a State apply to establish a Unit, and how is a 
Unit initially certified?

    (a) Initial application. In order to demonstrate that it meets the 
requirements for certification, the State or territory must submit to 
OIG, an application approved by the Governor or chief executive, 
containing the following:
    (1) A description of the applicant's organization, structure, and 
location within State government, and a statement of whether it seeks 
certification under Sec.  1007.7 (a), (b), or (c);
    (2) A statement from the State Attorney General that the applicant 
has authority to carry out the functions and responsibilities set forth 
in Subpart B. If the applicant seeks certification under Sec.  
1007.7(b), the statement must also specify either that--
    (i) There is no State agency with the authority to exercise 
Statewide prosecuting authority for the violations with which the Unit 
is concerned, or
    (ii) Although the State Attorney General may have common law 
authority for Statewide criminal prosecutions, he or she has not 
exercised that authority;
    (3) A copy of whatever memorandum of agreement, regulation, or 
other document sets forth the formal procedures required under Sec.  
1007.7(b), or the formal working relationship and procedures required 
under Sec.  1007.7(c);
    (4) A copy of the agreement with the Medicaid agency required under 
Sec.  1007.9 and Sec.  455.21(c);
    (5) A statement of the procedures to be followed in carrying out 
the functions and responsibilities of this part;
    (6) A proposed budget for the 12-month period for which 
certification is sought; and
    (7) Current and projected staffing, including the names, education, 
and experience of all senior professional employees already employed 
and job descriptions, with minimum qualifications, for all professional 
positions.
    (b) Basis for, and notification of certification.
    (1) OIG will make a determination as to whether the initial 
application under paragraph (a) meets the requirements of Sec. Sec.  
1007.5 through 1007.13 and whether a Unit will be effective in using 
its resources in investigating Medicaid fraud and patient abuse and 
neglect.
    (2) OIG will certify a Unit only if OIG specifically approves the 
applicant's formal written procedures under Sec.  1007.7 (b) or (c), if 
either of those provisions is applicable.
    (3) If the application is not approved, the applicant may submit a 
revised application at any time.
    (4) OIG will certify a Unit that meets the requirements of this 
Subpart B for 12 months.


Sec.  1007.17  How is a Unit recertified annually?

    (a) Information required annually for recertification. To continue 
receiving payments under this part, a Unit must submit to OIG:
    (1) Reapplication for recertification. Reapplication is due at 
least 60 days prior to the expiration of the 12-month certification 
period. A reapplication must include:
    (i) A brief narrative that evaluates the Unit's performance, 
describes any specific problems it has had in connection with the 
procedures and agreements required under this part, and discusses any 
other matters that have impaired its effectiveness. The narrative 
should include any extended investigative authority approvals obtained 
pursuant to Sec.  1007.11(a)(2).

[[Page 64399]]

    (ii) For those MFCUs approved to conduct data mining under Sec.  
1007.20, all costs expended by the MFCU attributed to data mining 
activities; the amount of staff time devoted to data mining activities; 
the number of cases generated from those activities; the outcome and 
status of those cases, including the expected and actual monetary 
recoveries (both Federal and non-Federal share); and any other relevant 
indicia of return on investment from such activities.
    (iii) Information requested by OIG to assess compliance with this 
part and adherence to MFCU performance standards, including any 
significant changes in the information or documentation provided to OIG 
in the previous reporting period.
    (2) Statistical Reporting. By November 30 of each year, the Unit 
will submit statistical reporting for the Federal fiscal year that 
ended on the prior September 30 containing the following statistics--
    (i) Unit staffing. The number of Unit employees, categorized by 
attorneys, investigators, auditors, and other employees on board; and 
total number of approved Unit positions;
    (ii) Caseload. The number of open, new, and closed cases 
categorized by type of case; the number of open criminal and civil 
cases categorized by type of provider;
    (iii) Criminal case outcomes. The number of criminal convictions 
and indictments categorized by type of case and by type of provider; 
the number of acquittals, dismissals, referrals for prosecution, 
sentences, and other non-monetary penalties categorized by type of 
case; the amount of total ordered criminal recoveries categorized by 
type of provider; the amount of ordered Medicaid restitution, fines 
ordered, investigative costs ordered, and other monetary payment 
ordered categorized by type of case
    (iv) Civil case outcomes. The number of civil settlements and 
judgments and recoveries categorized by type of provider; the number of 
global (coordinated among a group of States) civil settlements and 
successful judgments; the amount of global civil recoveries to the 
Medicaid program; and the amount of other global civil monetary 
recoveries; the number of other civil cases opened, filed, or referred 
for filing; the number of other civil case settlements and successful 
judgments; the amount of other civil case recoveries to the Medicaid 
program; the amount of other monetary recoveries; and the number of 
other civil cases declined or closed without successful settlement or 
judgment;
    (v) Collections. The monies actually collected on criminal and 
civil cases categorized by type of case; and
    (vi) Referrals. The number of referrals received categorized by 
source of referral and type of case; the number of cases opened 
categorized by source of referral and type of case; and the number of 
referrals made to other agencies categorized by type of case.
    (b) Other information reviewed for recertification. In addition to 
reviewing information required at Sec.  1007.17(a), OIG will review, as 
appropriate, the following information when considering recertification 
of a Unit:
    (1) Information obtained through onsite reviews; and
    (2) Other information OIG deems necessary or warranted.
    (c) Basis for recertification. In reviewing the information 
described at sections Sec.  1007.17(a) and (b), OIG will evaluate 
whether the Unit has demonstrated that it effectively carries out the 
functions and requirements described in section 1903(q) of the Act as 
implemented by this Part. In making that determination, OIG will take 
into consideration the following factors:
    (1) Unit's compliance with this part and other Federal regulations, 
including those specified in Sec.  1007.23;
    (2) Unit's compliance with OIG policy transmittals;
    (3) Unit's adherence to MFCU performance standards as published in 
the Federal Register;
    (4) Unit's effectiveness in using its resources in investigating 
cases of possible fraud in the administration of the Medicaid program, 
the provision of medical assistance, or the activities of providers of 
medical assistance under the State Medicaid plan, and in prosecuting 
cases or cooperating with the prosecuting authorities; and
    (5) Unit's effectiveness in using its resources in reviewing and 
investigating, referring for investigation or prosecution, or for 
criminally prosecuting complaints alleging abuse or neglect of patients 
in health care facilities receiving payments under the State Medicaid 
plan and, at the Unit's option, in board and care facilities.
    (d) Notification. OIG will notify the Unit by the Unit's 
recertification date of approval or denial of the recertification 
reapplication.
    (1) Approval subject to conditions. OIG may impose special 
conditions or restrictions and may require corrective action, as 
provided in 45 CFR 75.207, before approving a reapplication for 
recertification.
    (2) If the reapplication is denied, OIG will provide a written 
explanation of the findings on which the denial was based.
    (e) Reconsideration of denial of recertification.
    (1) A Unit may request that OIG reconsider a decision to deny 
recertification by providing written information contesting the 
findings on which the denial was based.
    (2) Within 30 days of receipt of the request for reconsideration, 
OIG will provide a final decision in writing, explaining its basis for 
approving or denying the reconsideration of recertification.

Subpart C--Federal Financial Participation


Sec.  1007.19  What is the FFP rate and what costs are eligible for 
FFP?

    (a) Rate of FFP. (1) Subject to the limitation of this section, the 
Secretary must reimburse each State by an amount equal to 90 percent of 
the allowable costs incurred by a certified Unit during the first 12 
quarters of operation that are attributable to carrying out its 
functions and responsibilities under this part.
    (2) Beginning with the 13th quarter of operation, the Secretary 
must reimburse 75 percent of costs incurred by a certified Unit. Each 
quarter of operation must be counted in determining when the Unit has 
accumulated 12 quarters of operation and is, therefore, no longer 
eligible for a 90 percent matching rate. Quarters of operation do not 
have to be consecutive to accumulate.
    (b) Retroactive certification. OIG may grant certification 
retroactive to the date on which the Unit first met all the 
requirements of the statute and of this part. For any quarter with 
respect to which the Unit is certified, the Secretary will provide 
reimbursement for the entire quarter.
    (c) Total amount of FFP. FFP for any quarter must not exceed the 
higher of $125,000 or one-quarter of 1 percent of the sums expended by 
the Federal, State, and local governments during the previous quarter 
in carrying out the State Medicaid program.
    (d) Costs eligible for FFP. (1) FFP is allowable under this part 
for the expenditures attributable to the establishment and operation of 
the Unit, including the cost of training personnel employed by the Unit 
and efforts to increase referrals to the Unit through program outreach. 
Reimbursement is allowable only for costs attributable to the specific 
responsibilities and functions set forth in this part and if the Unit 
has been certified and recertified by OIG.
    (2) Establishment costs are limited to clearly identifiable costs 
of personnel that meet the requirements of Sec.  1007.13 of this part.

[[Page 64400]]

    (e) Costs not eligible for FFP. FFP is not allowable under this 
part for expenditures attributable to--
    (1) The investigation of cases involving program abuse or other 
failures to comply with applicable laws and regulations, if these cases 
do not involve substantial allegations or other indications of fraud, 
as described in Sec.  1007.11(a) of this part;
    (2) Routine verification with beneficiaries of whether services 
billed by providers were actually received, or, except as provided in 
Sec.  1007.20, efforts to identify situations in which a question of 
fraud may exist by the screening of claims and analysis of patterns and 
practice that involve data mining as defined in Sec.  1007.1.
    (3) The routine notification of providers that fraudulent claims 
may be punished under Federal or State law;
    (4) The performance of any audit or investigation, any professional 
legal function, or any criminal, civil or administrative prosecution of 
suspected providers by a person who does not meet the professional 
employee requirements in Sec.  1007.13(d);
    (5) The investigation or prosecution of cases involving a 
beneficiary's eligibility for benefits, unless the suspected fraud also 
involves conspiracy with a provider;
    (6) Any payment, direct or indirect, from the Unit to the Medicaid 
agency, other than payments for the salaries of employees on detail to 
the Unit; or
    (7) Temporary duties performed by professional employees that are 
not required functions and responsibilities of the Unit, as described 
at Sec.  1007.13(d)(3).


Sec.  1007.20  Under what circumstances is data mining permissible?

    (a) Notwithstanding Sec.  1007.19(e)(2), a MFCU may engage in data 
mining as defined in this part and receive FFP only under the following 
conditions:
    (1) The MFCU identifies the methods of coordination between the 
MFCU and Medicaid agency, the individuals serving as primary points of 
contact for data mining, as well as the contact information, title, and 
office of such individuals;
    (2) MFCU employees engaged in data mining receive specialized 
training in data mining techniques;
    (3) The MFCU describes how it will comply with paragraphs(a)(1) and 
(2) of this section as part of the agreement required by Sec.  
1007.9(d); and
    (4) OIG, in consultation with CMS, approves in advance the 
provisions of the agreement as defined in paragraph (a)(3)of this 
section.
    (i) OIG will act on a request from a MFCU for review and approval 
of the agreement within 90 days after receipt of a written request, or 
the request shall be considered approved if OIG fails to respond within 
90 days after receipt of the written request.
    (ii) If OIG requests additional information in writing, the 90-day 
period for OIG action on the request begins on the day OIG receives the 
information from the MFCU.
    (iii) The approval is for 3 years.
    (iv) A MFCU may request renewal of its data mining approval for 
additional 3-year periods by submitting a written request for renewal 
to OIG, along with an updated agreement with the Medicaid agency.


Sec.  1007.21  What is the procedure for disallowance of claims for 
FFP?

    (a) Notice of disallowance. When OIG determines that a Unit's claim 
or portion of a claim for FFP is not allowable, OIG shall send to the 
Unit notification that meets the requirements listed at 42 CFR 
430.42(a).
    (b) Reconsideration of disallowance. (1) The Principal Deputy 
Inspector General will reconsider MFCU disallowance determinations made 
by OIG.
    (2) To request a reconsideration from the Principal Deputy 
Inspector General, the Unit must follow the requirements in 42 CFR 
430.42(b)(2) and submit all required information to the Principal 
Deputy Inspector General. Copies should be sent via registered or 
certified mail to the Principal Deputy Inspector General.
    (3) The Unit may request to retain FFP during the reconsideration 
of the disallowance under section 1116(e) of the Act, in accordance 
with 42 CFR 433.38.
    (4) The Unit is not required to request reconsideration before 
seeking review from the Departmental Appeals Board.
    (5) The Unit may also seek reconsideration, and following the 
reconsideration decision, request a review from the Departmental 
Appeals Board.
    (6) If the Unit elects reconsideration, the reconsideration process 
must be completed or withdrawn before requesting review by the 
Departmental Appeals Board.
    (c) Procedures for reconsideration of a disallowance. (1) Within 60 
days after receipt of the disallowance letter, the Unit shall, in 
accordance with (b)(2) of this section, submit in writing to the 
Principal Deputy Inspector General any relevant evidence, 
documentation, or explanation.
    (2) After consideration of the policies and factual matters 
pertinent to the issues in question, the Principal Deputy Inspector 
General shall, within 60 days from the date of receipt of the request 
for reconsideration, issue a written decision or a request for 
additional information as described in paragraph (c)(3) of this 
section.
    (3) At the Principal Deputy Inspector General's option, OIG may 
request from the Unit any additional information or documents necessary 
to make a decision. The request for additional information must be sent 
via registered or certified mail to establish the date the request was 
sent by OIG and received by the Unit.
    (4) Within 30 days after receipt of the request for additional 
information, the Unit must submit to the Principal Deputy Inspector 
General all requested documents and materials.
    (i) If the Principal Deputy Inspector General finds that the 
materials are not in readily reviewable form or that additional 
information is needed, he or she shall notify the Unit via registered 
or certified mail that it has 15 business days from the date of receipt 
of the notice to submit the readily reviewable or additional materials.
    (ii) If the Unit does not provide the necessary materials within 15 
business days from the date of receipt of such notice, the Principal 
Deputy Inspector General shall affirm the disallowance in a final 
reconsideration decision issued within 15 days from the due date of 
additional information from the Unit.
    (5) If additional documentation is provided in readily reviewable 
form under paragraph (c)(4) of this section, the Principal Deputy 
Inspector General shall issue a written decision, within 60 days from 
the due date of such information.
    (6) The final written decision shall constitute final OIG 
administrative action on the reconsideration and shall be (within 15 
business days of the decision) mailed to the Unit via registered or 
certified mail to establish the date the reconsideration decision was 
received by the Unit.
    (7) If the Principal Deputy Inspector General does not issue a 
decision within 60 days from the date of receipt of the request for 
reconsideration or the date of receipt of the requested additional 
information, the disallowance shall be deemed to be affirmed.
    (8) No section of this regulation shall be interpreted as waiving 
OIG's right to assert any provision or exemption under the Freedom of 
Information Act.
    (d) Withdrawal of a request for reconsideration of a disallowance. 
(1) A Unit may withdraw the request for reconsideration at any time 
before the notice of the reconsideration decision is received by the 
Unit without affecting

[[Page 64401]]

its right to submit a notice of appeal to the Departmental Appeals 
Board. The request for withdrawal must be in writing and sent to the 
Principal Deputy Inspector General via registered or certified mail.
    (2) Within 60 days after OIG's receipt of a Unit's withdrawal 
request, a Unit may, in accordance with (f)(2) of this section, submit 
a notice of appeal to the Departmental Appeals Board.
    (e) Implementation of decisions for reconsideration of a 
disallowance. (1) After undertaking a reconsideration, the Principal 
Deputy Inspector General may affirm, reverse, or revise the 
disallowance and shall issue a final written reconsideration decision 
to the Unit in accordance with 42 CFR 430.42(c)(5) and (c)(3) of this 
section.
    (2) If the reconsideration decision requires an adjustment of FFP, 
either upward or downward, a subsequent grant action will be made in 
the amount of such increase or decrease.
    (3) Within 60 days after receipt of a reconsideration decision from 
OIG, a Unit may, in accordance with paragraph (f) of this section, 
submit a notice of appeal to the Departmental Appeals Board.
    (f) Appeal of disallowance. (1) The Departmental Appeals Board 
reviews disallowances of FFP under title XIX, including disallowances 
issued by OIG to the Units.
    (2) A Unit that wishes to appeal a disallowance to the Departmental 
Appeals Board must follow the requirements in 42 CFR 430.42(f)(2).
    (3) The appeals procedures are those set forth in 45 CFR part 16 
for Medicaid and for many other programs, including the MFCUs, 
administered by the Department.
    (4) The Departmental Appeals Board may affirm the disallowance, 
reverse the disallowance, modify the disallowance, or remand the 
disallowance to OIG for further consideration.
    (5) The Departmental Appeals Board will issue a final written 
decision to the Unit consistent with 45 CFR part 16.
    (6) If the appeal decision requires an adjustment of FFP, either 
upward or downward, a subsequent grant action will be made in the 
amount of increase or decrease.

Subpart-D--Other Provisions


Sec.  1007.23  What other HHS regulations apply to a Unit?

    The following regulations from 45 CFR subtitle A apply to grants 
under this part:
    Part 16--Procedures of the Departmental Grant Appeals Board;
    Part 75--Uniform Administrative Requirements, Cost Principles, and 
Audit Requirements for HHS Awards;
    Part 80--Nondiscrimination under Programs Receiving Federal 
Assistance through HHS, Effectuation of title VI of the Civil Rights 
Act of 1964;
    Part 81--Practice and Procedure for Hearings under 45 CFR part 80;
    Part 84--Nondiscrimination on the Basis of Handicap in Programs and 
Activities Receiving Federal Financial Assistance;
    Part 91--Nondiscrimination on the Basis of Age in Programs or 
Activities Receiving Federal Financial Assistance from HHS.

    Dated: June 16, 2016.
Daniel R. Levinson,
Inspector General.
    Approved: June 23, 2016.
Sylvia M. Burwell,
Secretary.

    Editor's Note: This document was received for publication by the 
Office of Federal Register on September 12, 2016.

[FR Doc. 2016-22269 Filed 9-19-16; 8:45 am]
 BILLING CODE 4152-01-P