Medicaid; Revisions to State Medicaid Fraud Control Unit Rules, 10700-10719 [2019-05362]

Agencies

• Centers for Medicare & Medicaid Services
• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 84, Number 56 (Friday, March 22, 2019)]
[Rules and Regulations]
[Pages 10700-10719]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-05362]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services

42 CFR Part 455

Office of Inspector General

42 CFR Part 1007

RIN 0936-AA07


Medicaid; Revisions to State Medicaid Fraud Control Unit Rules

AGENCIES:  Office of Inspector General (OIG) and Centers for Medicare & 
Medicaid Services (CMS), Department of Health and Human Services (HHS).

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: This final rule amends the regulation governing State Medicaid 
Fraud Control Units (MFCUs or Units). The rule incorporates statutory 
changes affecting the Units as well as policy and practice changes that 
have occurred since the regulation was initially issued in 1978. These 
changes include a recognition of OIG's delegated authority; Unit 
authority, functions, and responsibilities; disallowances; and issues 
related to organization, prosecutorial authority, staffing, 
recertification, and the Units' relationship with Medicaid agencies. 
The rule is designed to assist the MFCUs in understanding their 
authorities and responsibilities under the grant program, clarify the 
flexibilities the MFCUs have to operate their programs, and reduce 
administrative burden, where

[[Page 10701]]

appropriate, by eliminating duplicative and unnecessary reporting 
requirements.

DATES: These regulations are effective on May 21, 2019.

FOR FURTHER INFORMATION CONTACT:  Susan Burbach, (202) 708-9789, or 
Richard Stern, (202) 205-0572, Office of Inspector General.

SUPPLEMENTARY INFORMATION: 

Legal Authority

    The legal authority for this regulatory action is found in the 
Social Security Act (the Act) as follows:
    Part 1007: Sections 1902(a)(61), 1903(a)(6), 1903(b)(3), 1903(q), 
and 1102 of the Act.
    Part 455: Section 1102 of the Act.

Executive Summary

A. Purpose of Regulatory Action

    The mission of the MFCUs, as described in section 1903(q) of the 
Act, is to investigate and prosecute Medicaid provider fraud and 
patient abuse or neglect that occurs in health care facilities or board 
and care facilities. The OIG, on behalf of HHS, has the responsibility 
to administer a grant award to each of the MFCUs and to provide 
oversight for MFCU operations. The purpose of this regulatory action is 
to revise regulations that were initially issued after the inception of 
the MFCU grant program in 1977.
    We are amending this regulation for three specific reasons. First, 
we are incorporating into the rule statutory changes that have occurred 
since the 1977 enactment of the Medicare-Medicaid Anti-Fraud and Abuse 
Amendments (Pub. L. 95-142), which amended section 1903(a) of the Act 
to provide for Federal participation in the costs attributable to 
establishing and operating a MFCU. Second, we are aligning the rule 
with practices and policies that have developed and evolved since the 
initial version of the rule was issued in 1978, 43 FR 32078 (July 24, 
1978), now codified at 42 CFR part 1007. Finally, we are revising the 
regulation to reduce burden on the Units, when doing so does not 
undermine OIG's oversight role or the Units' mission.
    For ease of reading, we have republished the entirety of part 1007 
and incorporated the changes as part of that publication. However, for 
some sections within part 1007, we did not make substantive changes.

B. Summary of Major Provisions

    (1) Statutory Changes. We incorporate statutory changes that have 
occurred since 1977, including (1) extending funding for State MFCUs by 
authorizing a Federal matching rate of 90 percent for the first 3 years 
of operation and a Federal matching rate of 75 percent thereafter, (2) 
establishing a Medicaid State plan requirement that a State must 
operate an effective Unit, (3) requiring the Secretary of Health and 
Human Services to establish standards under which Units must be 
operated, (4) allowing Units to seek approval from the relevant 
Inspector General to investigate and prosecute violations of State law 
related to fraud in any aspect of the provision of health care services 
and activities of providers of such services under any Federal health 
care program, including Medicare, as long as the fraud is primarily 
related to Medicaid, and (5) giving Units the option to investigate and 
prosecute patient abuse or neglect in board and care facilities, 
regardless of whether the facilities receive Medicaid payments. With 
the exception of the establishment of standards, all of these statutory 
changes were self-implementing and have been operational since their 
statutory effective dates. Performance standards for MFCU operations 
were initially published in the Federal Register in 1994 and revised in 
2012.
    (2) Office of Inspector General Authority. The final rule, in 
referring to OIG as the oversight agency for the MFCUs, recognizes that 
the authority for certification and recertification of the Units, as 
well as the administration of a Federal grant award to operate the 
Units, was transferred from the predecessor agency of CMS (the Health 
Care Financing Administration) to OIG on July 27, 1979.
    (3) Definition of Key Terms. The final rule adds definitions of key 
terms that clarify issues related to MFCU authority under the grant. 
All the definitions are consistent with other regulatory definitions 
and with longstanding practice.
    (4) Organizational Requirements. The final rule clarifies, 
consistent with OIG policy and longstanding MFCU practice, what it 
means to be a ``single, identifiable entity of State government'' as 
required under the statute. The regulations specify that a MFCU must 
have a single director to whom all staff report, operate under a budget 
that is separate from that of its parent agency, and generally have 
offices in their own contiguous space.
    (5) Prosecutorial Authority Requirements. The final rule, 
consistent with statutory changes and longstanding practice, makes 
amendments to the prosecutorial authority requirement options to 
include the prosecution of patient or resident abuse and neglect and to 
include formal written procedures for making referrals to the State 
Attorney General or another office with statewide prosecutorial 
authority.
    (6) Agreement with Medicaid Agency. The final rule requires that 
the agreement with the Medicaid agency establish regular communication, 
procedures for coordination, and procedures by which the Unit will 
receive referrals of potential fraud from managed care organizations. 
This revision is consistent with the recent changes to the Medicaid 
managed care regulation in 42 CFR part 438 that require managed care 
organizations to refer potential fraud to the Medicaid agency or to the 
MFCU.
    (7) Duties and Responsibilities. The final rule, consistent with 
published performance standards, requires that Units submit all 
convictions to OIG for purposes of program exclusion within 30 days of 
sentencing or as soon as practicable if a Unit encounters delays from 
the courts. The final rule also clarifies, consistent with existing 
practice, the requirement that a Unit make information available to, 
and coordinate with, OIG investigators and attorneys, or with other 
Federal investigators and prosecutors, on Medicaid fraud and 
investigations or prosecutions involving the same suspects or 
allegations.
    (8) Staffing Requirements. The final rule clarifies that Units may 
choose to employ professional employees as full- or part-time employees 
so long as they devote their ``exclusive effort'' to Unit functions. 
The final rule also establishes that a Unit will employ a director and 
that all Unit employees will be under the direction and supervision of 
the Unit director. The rule establishes that Unit professional 
employees may also obtain outside employment with some restriction and 
may perform temporary assignments that are not a required function of 
the Unit, but may not receive Federal financial participation for those 
assignments. The rule also clarifies that Units may employ employees or 
consultants with specialized knowledge and skills, but that 
investigation and prosecution functions may not be outsourced through 
consultant agreements or other contracts. Finally, the rule requires 
Units to provide training for professional employees on Medicaid fraud 
and patient or resident abuse and neglect matters. These requirements 
all codify and are consistent with current Unit operations and OIG 
policy on Unit staffing.
    (9) Recertification Requirements. The final rule amends the 
regulation to reflect the Unit recertification process.

[[Page 10702]]

This includes describing what OIG requires annually as part of 
recertification, including submission of reapplication materials and 
statistical data. The final rule also eliminates the requirement to 
submit an ``annual report,'' thus reducing burden. The final rule 
clarifies the factors that OIG considers when recertifying a Unit. The 
rule also creates a process for notifying the Unit of approval or 
denial of recertification and procedures for reconsideration should OIG 
deny recertification.
    (10) Federal Financial Participation (FFP). The final rule reflects 
that, except for Units with OIG approval to conduct data mining under 
this part, Units may not receive FFP for data mining activities that 
duplicate surveillance and utilization review responsibilities of State 
Medicaid agencies, but may engage in activities other than data mining 
to identify situations in which fraud may exist, such as efforts to 
increase referrals through program outreach activities.
    (11) Disallowance Procedures. The final rule sets forth procedures 
for OIG disallowances of FFP and for Unit requests for reconsideration 
and appeal of disallowances. These procedures are consistent with, and 
prompted by, a 2008 amendment to the Act, adding section 1116(e), which 
provided States the option to seek reconsideration of a disallowance by 
an agency prior to an appeal to the Departmental Appeals Board. The 
procedures are intended to mirror those that were implemented earlier 
for CMS disallowances to the States, 42 CFR 430.42.
    (12) CMS Companion Regulation. To ensure that both the Unit and the 
Medicaid agency are required to have an agreement with each other, the 
final rule includes amendments to the CMS regulation at 42 CFR 455.21 
to require that the Medicaid agency has an agreement with the Unit. The 
amendments to this section were developed in collaboration with CMS.

C. Costs and Benefits

    There are no significant costs associated with the regulatory 
revisions, and the revisions do not impose any mandates on State, 
local, or Tribal governments or on the private sector that would 
represent significant costs.

I. Background

A. Statutory Changes Since 1977 Implemented by This Rulemaking

    (1) Omnibus Reconciliation Act of 1980 (Pub. L. 96-499). The 
Medicare-Medicaid Anti-Fraud and Abuse Amendments added section 
1903(a)(6) of the Social Security Act (the Act), which authorized a 
Federal matching rate of 90 percent for the establishment and operation 
of State Medicaid Fraud Control Units (MFCUs) for fiscal years 1978 
through 1980. The Omnibus Reconciliation Act of 1980 extended funding 
for State MFCUs by amending section 1903(a)(6) of the Act to authorize 
a Federal matching rate of 90 percent for the first 3 years of 
operation and a Federal matching rate of 75 percent thereafter.
    (2) Omnibus Budget Reconciliation Act of 1993 (Pub. L. 103-66). The 
Omnibus Budget Reconciliation Act of 1993 added section 1902(a)(61) to 
the Act, establishing a Medicaid State plan requirement that a State 
must operate an effective MFCU, unless the State demonstrates that 
effective operation of a Unit would not be cost effective and that, in 
the absence of a Unit, beneficiaries will be protected from abuse and 
neglect. The statute further requires that the Units be operated in 
accordance with standards established by the Secretary of Health and 
Human Services (HHS).
    (3) Ticket to Work and Work Incentives Improvement Act of 1999 
(Pub. L. 106-170). In the Ticket to Work and Work Incentives 
Improvement Act of 1999, Congress amended section 1903(q) of the Act to 
extend the authority of MFCUs in two ways. First, the Units may seek 
approval from the relevant Federal Inspector General (in most 
circumstances the HHS Inspector General) to investigate and prosecute 
violations of State law related to any aspect of fraud in connection 
with ``the provision of health care services and activities of 
providers of such services under any Federal health care program,'' 
including Medicare, ``if the suspected fraud or violation of State law 
is primarily related to'' Medicaid. Second, the law gives Units the 
option to investigate and prosecute patient abuse or neglect in ``board 
and care facilities,'' regardless of whether those facilities receive 
Medicaid payments.

B. Regulatory, Practice, and Policy Changes to the MFCU Program Since 
1978

    Prior to the publication of this final rule, the regulation was 
amended on two occasions. First, the regulation was amended at Sec.  
1007.9(e)-(g) (76 FR 5970 (February 2, 2011)) to implement payment 
suspension provisions found in the Patient Protection and Affordable 
Care Act, Public Law 111-148. Second, the regulation was modified at 
Sec.  1007.20 to allow FFP for data mining under certain circumstances 
(78 FR 29055 (May 17, 2013)). With the exception of these two 
revisions, the regulation had not received a revision since it was 
originally published in 1978. In the ensuing years, growth of the MFCU 
program to 50 Units (49 States and the District of Columbia), as well 
as changes in MFCU practice, health care, and the workplace, have led 
to the need to revise the regulation. Further, in 1994, pursuant to 
section 1902(a)(61) of the Act, the Office of Inspector General (OIG), 
in consultation with the Units, developed 12 performance standards to 
be used in assessing the operations of MFCUs. These performance 
standards have since been revised at 77 FR 32645 (June 1, 2012). OIG 
uses the performance standards to annually recertify each Unit and to 
determine if a Unit is effectively and efficiently carrying out its 
duties and responsibilities. On September 20, 2016, OIG published in 
the Federal Register (81 FR 64383) a Notice of Proposed Rulemaking 
(Proposed Rule), which we are finalizing with publication of this final 
rule.

C. Summary of the 2016 Proposed Rule

    The Proposed Rule set forth proposed amendments to the State 
Medicaid Fraud Control Unit regulations. With respect to definitions, 
we proposed to modify the current definition of ``provider,'' eliminate 
the definition of ``employ or employee,'' and add definitions for 
``full-time employee,'' ``part-time employee,'' ``professional 
employee,'' ``exclusive effort,'' ``director,'' ``fraud,'' ``abuse of 
patients,'' ``board and care facility,'' ``health care facility,'' 
``misappropriation of patient funds,'' ``neglect of patients,'' and 
``program abuse.''
    With respect to requirements for certification, we proposed to 
define the phrase ``single, identifiable entity,'' specifically, that a 
Unit must (1) be a single organization reporting to the single Unit 
director; (2) operate under its own budget that is separate from that 
of its parent division or agency; and (3) have the headquarters office 
and any field offices each in their own contiguous space. We also 
proposed to clarify that Units must satisfy the definition to be 
certified and recertified.
    With respect to prosecutorial authority requirements, we proposed 
that the regulation be amended to include the establishment of formal 
procedures for referring cases of patient abuse and neglect to the 
appropriate prosecuting authority when there is no State agency with 
statewide authority and capability for patient abuse prosecutions. We 
proposed that the regulation be amended to reference the office of the 
State Attorney General ``or

[[Page 10703]]

another office with statewide prosecutorial authority'' and to clarify 
that the formal procedures should be written procedures.
    With respect to the Unit's relationship to and its agreement with 
the Medicaid agency, in the joint Proposed Rule, OIG and the Centers 
for Medicare & Medicaid Services (CMS) proposed to add additional 
guidance to the MFCU rule and the CMS rule to clarify that both the 
Medicaid agency and the Unit must enter into a written agreement, such 
as a memorandum of understanding. We also proposed to add to both rules 
that the written agreement include certain required elements. Finally, 
we proposed an amendment to require, consistent with changes to the law 
and regulation governing the referral of credible allegations of fraud, 
that the Unit provide certification to the Medicaid agency, upon 
request on a quarterly basis, that any matter accepted on the basis of 
a referral continues to be under investigation and thus warrants 
continuation of payment suspension.
    With respect to functions and responsibilities of a Unit, we 
proposed to require the Unit to review complaints involving 
misappropriation of funds, as we believed that making the review of 
such complaints mandatory, rather than optional, is consistent with the 
broad statutory responsibility for patient abuse or neglect. Consistent 
with the statute, we also proposed to revise the regulation to specify 
that the MFCU must obtain written permission from the relevant Federal 
Inspector General to investigate cases of provider fraud in health care 
programs other than Medicaid and that the Units report annually to OIG 
on any approvals for extended investigative authority from any Federal 
Inspector General. To be consistent with the statute, we also proposed 
to permit investigations of patient abuse or neglect in board and care 
facilities. We proposed that applicable State laws pertaining to 
Medicaid fraud include criminal statutes as well as civil false claims 
statutes or other civil authorities. We further proposed that if no 
State civil fraud statute exists, Units should make appropriate 
referrals of meritorious civil cases to Federal investigators or 
prosecutors, such as the U.S. Department of Justice (DOJ) or the U.S. 
Attorney's Office, as well as to the OIG Office of Investigations and 
Office of Counsel to the Inspector General. We proposed to clarify that 
when a Unit discovers that overpayments have been made to a provider or 
facility, the Unit must either recover the overpayment as part of its 
resolution of a fraud case or refer the matter to the proper State 
agency for collection.
    With respect to coordination with Federal partners, we proposed to 
retain the current requirement that a Unit make available to Federal 
investigators and prosecutors and OIG attorneys all information in its 
possession concerning Medicaid fraud and that the Unit coordinate with 
such officials any Federal and State investigations or prosecutions 
involving the same suspects or allegations. However, we also proposed 
to expand the requirement to further ensure effective collaboration 
between the Units and OIG investigators and attorneys, or other Federal 
investigators and Federal prosecutors by (1) establishing a practice of 
regular meetings or communication; (2) making appropriate referrals to 
OIG investigators and attorneys, other Federal investigators, and 
Federal prosecutors; and (3) developing written procedures for those 
coordinating actions.
    We proposed to require a Unit to provide adequate safeguards to 
protect sensitive information and data under the Unit's control, 
updating a requirement that had largely referred to paper case files 
and other case-related materials, such as evidence.
    We proposed to amend the regulations to require that a Unit 
transmit to OIG, for purposes of excluding convicted individuals and 
entities from participation in Federal health care programs under 
section 1128 of the Act, pertinent documentation on all convictions 
obtained by the Unit, including those cases investigated jointly with 
another law enforcement agency, as well as those prosecuted by another 
agency at the local, State, or Federal level. We proposed that such 
information be provided within 30 days of sentencing or, if Units are 
unable to obtain pertinent information from the sentencing court within 
30 days, as soon as reasonably practicable.
    With respect to staffing requirements, we proposed to revise the 
regulations to clarify that Unit professional employees do not need to 
be ``full time'' to receive FFP, but to retain the longstanding policy 
and practice that FFP is permitted only for Unit professional employees 
who are devoted ``exclusively'' to the MFCU mission except for limited 
circumstances that are specifically described in the regulation. We 
also proposed that, to be eligible for FFP, professional employees may 
not be employed by other State agencies during nonduty hours and that 
professional employees may obtain employment outside of State 
government, if State law allows it, but only if the outside employment 
presents no conflict of interest to Unit activities. We proposed to 
permit Unit professional employees to engage in temporary assignments 
that are not within the functions and responsibilities of a Unit only 
if such assignments are truly limited in duration. Such assignments 
would not be funded by the Federal MFCU grant. We proposed to add a 
requirement that the Unit must employ a director who supervises all 
Unit employees, either directly or through subordinate Unit managers.
    We also proposed to clarify that a Unit may not receive FFP when it 
relies on individuals not employed directly by the Unit for the 
investigation or prosecution of cases, including individuals retained 
through consultant agreements or other contractual arrangements, but 
that Units may receive FFP for the employment, or retention through 
consultant agreements or other arrangements, of individuals with 
particular knowledge, skills, and/or expertise that a Unit believes 
will support the Unit in the investigation or prosecution of cases. We 
also proposed to add a requirement that, consistent with MFCU 
performance standards, a Unit must provide training for its 
professional employees for the purpose of establishing and maintaining 
proficiency in the investigation and prosecution of Medicaid fraud and 
patient abuse and neglect. We proposed to clarify that a Unit may hire 
administrative and support staff on a part-time basis. Finally, we 
proposed minor clarifications to the qualifications of attorneys, 
auditors, and the senior investigator.
    With respect to certification, we proposed to clarify that initial 
certification will be based on the information and documentation 
specified in the initial application and to eliminate the requirement 
that an initial application include a projection of caseload.
    With respect to recertification, we proposed to revise regulations 
to reflect the recertification process that has evolved since the 
program began. Specifically, we proposed that the regulation would (1) 
describe the information that must be provided to OIG on an annual 
basis, including the recertification application and statistical data; 
(2) describe other information considered for recertification; (3) 
clarify the basis for recertification by OIG; (4) create a procedure in 
which OIG notifies the Unit whether the reapplication is approved or 
denied by the Unit's recertification date; (5) clarify that an approved 
reapplication may be subject

[[Page 10704]]

to special conditions; and (6) establish basic procedures for 
reconsideration of an OIG denial of recertification. We also proposed 
modifications to the annual report.
    With respect to FFP rates and eligible costs, we proposed to modify 
the regulation to reflect that, under law, FFP is available at the rate 
of 90 percent during the first 12 quarters of a Unit's operation and at 
75 percent thereafter, beginning with the 13th quarter of a Unit's 
operation. We also proposed to clarify that each quarter of 
reimbursement at the 90 percent matching rate is counted in determining 
when the 13th quarter begins and that quarters of Unit operation do not 
have to be consecutive to accumulate for purposes of determining when 
the 90 percent matching period has ended. Additionally, we proposed to 
clarify in regulation that a Unit may receive FFP for its efforts to 
increase referrals through program outreach activities. We also 
proposed to clarify the prohibition on the ability of Units to receive 
FFP to ``identify situations in which a question of fraud may exist'' 
by clarifying the ability of Units to engage in activities, other than 
data mining, to identify potential civil or criminal fraud in the 
Medicaid program.
    In addition, we proposed to clarify that the longstanding FFP 
prohibition for beneficiary fraud (unless the suspected fraud involves 
conspiracy with a provider) is narrowly focused on cases involving the 
establishment of eligibility for Medicaid, such as the suspected 
fraudulent statement of assets and income. On the other hand, 
consistent with OIG policy, the proposed revision would permit FFP for 
the investigation or prosecution of cases in which a beneficiary is 
alleged to have submitted, or caused the submission of, a fraudulent 
claim to the program for particular items or services that are 
unrelated to the beneficiary's status as a beneficiary. One scenario in 
which such cases may arise involves Medicaid personal care services 
``self-directed'' programs, where the beneficiary may submit claims and 
receive payment from Medicaid, may be responsible for hiring his or her 
own caregivers, and may be required to monitor the activities of 
caregivers.
    With respect to disallowance procedures, we proposed to amend the 
regulation to establish procedures for taking formal disallowances of 
FFP, for Units to request reconsideration of disallowances, and to 
appeal to the HHS Departmental Appeals Board.
    Finally, we proposed to update the listing of other applicable HHS 
regulations that were amended after the MFCU regulations were initially 
promulgated.

II. Summary of Public Comments and OIG Responses

A. General

    We received responsive comments from 10 distinct commenters, 
including trade associations (such as the national association that 
represents the MFCUs), individual Units, a health plan, and a State 
medical society. Some of the commenters provided comments on multiple 
topics. Commenters generally supported our proposals, but many of them 
recommended certain changes and requested certain clarifications. We 
have divided the public comment summaries and our responses into 
sections pertaining to the part of the regulation to which they apply.

B. Definition of Fraud and Other Criminal Conduct

    Comment: One commenter expressed concern that OIG, in its Proposed 
Rule, both adopted State law definitions for types of criminal conduct, 
including ``abuse of patients,'' ``fraud,'' ``misappropriation of 
patient funds,'' and ``neglect of patients,'' and provided examples of 
the essential elements of the crime. The commenter stated that the 
definitions are ``overly expansive and inappropriate'' and that 
``[e]ach MFCU must be able to defer to its state law definitions and 
not be expected to comply with overarching federal definitions.'' The 
commenter recommended that OIG delete all of the proposed language in 
each of the definitions following the reference to State law.
    Response: We proposed to define ``fraud'' as any act that 
constitutes criminal fraud under applicable State law including the 
deception, concealment of material fact, or misrepresentation made by a 
person intentionally, in deliberate ignorance of the truth or in 
reckless disregard of the truth.
    It was not our intent to require States to comply with an 
overarching definition, and this is the reason we defer to the 
definitions contained in State law. The purpose in describing the 
elements of the crime was to provide guidance on those elements that 
are typically contained in State law.
    Therefore, as specified in Sec.  1007.1 of our regulations, we are 
finalizing the definition of fraud by retaining the first sentence of 
the proposed definition of fraud as contained in the Proposed Rule but 
have revised the language in the second sentence to clarify that the 
crime ``may'' include the noted elements. We have also made a technical 
change in eliminating the phrase ``by a person'' since the crime could 
be committed by an organization as well. We have made similar revisions 
to the other definitions that rely on State law definitions: ``abuse of 
patients or residents'' and ``neglect of patients or residents.''

C. Definition of Abuse of Patients

    Comment: Concerning the proposed definition of ``abuse of 
patients,'' one commenter raised three concerns regarding the 
definition. First, the commenter observed that the reference to abuse 
of a ``patient'' is too narrow, since Unit authority may extend to 
residents of facilities who are not considered ``patients'' under State 
law. The commenter recommended that the definition be expanded to 
include ``patient and/or resident of a care facility'' and that, 
whenever the term ``patient'' is used throughout the regulation, the 
word ``resident'' be added as well. Secondly, the commenter believed 
that the term ``willful'' is problematic for States that define 
``abuse'' as conduct that is not willful, such as reckless conduct. 
Finally, the commenter observed the wide variation in what constitutes 
abuse under State law and recommended that we eliminate the examples 
entirely in the definition.
    Response: We agree with the comments regarding the definition of 
abuse. Under section 1903(q)(4) of the Act--as implemented by Sec.  
1007.11(b)(2) of this rulemaking--the Units may receive FFP for abuse 
or neglect cases arising in ``board and care facilities.'' Expanding 
the definition to include abuse of ``residents,'' in addition to 
``patients,'' is consistent with the statutory definition of ``board 
and care facility'' in section 1903(q)(4)(B) of the Act. Adding the 
reference to ``residents'' is also consistent with the Units' 
longstanding lack of statutory authority to receive FFP for the 
investigation and prosecution of cases of patient abuse or neglect that 
occur in the home or other nonfacility settings.
    We have also revised the definition to eliminate reference to 
``willful'' conduct and to provide examples of what constitutes abuse.
    We have made a similar revision to include both patients and 
residents in the definition of ``neglect of patients'' to Sec.  
1007.11(b) as well, which describes a Unit's responsibilities regarding 
abuse or neglect.

D. Definition of Data Mining

    Comment: One commenter expressed a concern that the proposed 
definition at Sec.  1007.1 of ``data mining'' did not

[[Page 10705]]

consider the analysis of data that might occur during the course of an 
investigation, rather than as part of activities designed to identify 
new potential cases. For example, the commenter stated that in the 
course of investigations, it is often necessary to conduct a ``peer 
comparison'' between or among providers and present that information to 
a jury or other fact finder for the purpose of demonstrating what is 
usual and customary. The commenter stated that the activities related 
to such analysis should be considered as eligible for FFP without 
receiving a waiver from OIG to conduct data mining.
    Response: We agree with the commenter that the use of data analysis 
in an ongoing case should not be subject to the prohibition on FFP for 
data mining and that Units need not receive a data mining waiver to 
conduct such activities.
    We believe, however, that the existing regulatory definition 
permits such case-related activities by describing those activities 
that require a data mining waiver from OIG to be limited to:

. . . the practice of electronically sorting Medicaid or other 
relevant data, including, but not limited to, the use of statistical 
models and intelligent technologies, to uncover patterns and 
relationships within that data to identify aberrant utilization, 
billing, or other practices that are potentially fraudulent.

    By limiting the activities needing a waiver to those which involve 
the ``sorting [of] Medicaid or other relevant data,'' we believe that 
the existing definition excludes the type of case-related activities 
referred to by the commenter. This position is consistent with the 2013 
preamble to the rulemaking establishing the data mining waiver 
authority. In a response to a comment, we stated:

    We agree that the intent of the regulation is not to limit other 
types of Medicaid data analysis being conducted in the normal course 
of an investigation. Units may analyze relevant Medicaid data as 
part of the evidence-gathering process while investigating a 
particular possible fraud. In some instances, this data analysis 
conducted as part of a particular investigation might allow the Unit 
to identify other potential targets, which would result in opening 
new fraud cases. Such data analysis is an accepted part of a MFCU's 
investigative function and does not implicate the prohibition 
contained in Sec.  1007.19(e)(2).

78 FR 29055, 29057 (May 17, 2013).

E. Definition of Director

    Comment: One commenter agreed that the proposed definition of 
``director'' is beneficial but suggested that the role of the director 
would be clarified, and the working relationship between the Unit and 
OIG improved, by amending the definition to also state that the 
director ``serves as the chief liaison with OIG for all Unit-related 
activities.''
    Response: We agree with the commenter about the importance of 
maintaining effective working relationships between the Units and OIG. 
However, while the director plays the role of liaison with OIG in most 
Units, we decline to modify the definition to require this, as other 
Units may choose to designate another individual or individuals to play 
that role. Also, even if the director plays the role of primary 
liaison, some Units may choose to designate another individual to be 
the liaison to OIG for particular Unit activities, such as 
investigation-related activities.

F. Definition of Health Care Facility

    Comment: One commenter objected to the definition of ``health care 
facility,'' for purposes of the Units' investigations of patient abuse 
or neglect, as a provider that ``furnishes . . . services to four or 
more persons unrelated to the proprietor.'' The commenter suggested 
that the definition be revised to include providers who furnish 
services to two or more persons. The commenter acknowledged that 
facilities with fewer than four residents could be investigated under 
the ``board and care'' authority, but that the authority for board and 
care cases is optional, and the authority to investigate patient abuse 
or neglect at a health care facility is mandatory.
    Response: We do not believe it is appropriate to establish our own 
definition of health care facility for purposes of the MFCU program. 
The definition of health care facility was adopted from the CMS 
definition, contained in 42 CFR 447.10(b), of a ``facility'' as ``an 
institution that furnishes health care services to inpatients'' and 42 
CFR 435.1010, which defines an ``institution'' as ``an establishment 
that furnishes (in single or multiple facilities) food, shelter, and 
some treatment or services to four or more persons unrelated to the 
proprietor . . . .''
    We therefore decline to revise the definition of health care 
facility.

G. Definition of Program Abuse

    Comment: One commenter expressed concern that the proposed 
definition of ``program abuse'' at Sec.  1007.1, in providing examples 
such as an ``unnecessary cost to Medicaid'' and ``reimbursement for 
services that are not medically necessary,'' blurs the line between 
administrative misconduct on the one hand and criminal conduct on the 
other.
    Response: We agree with the commenter that the examples cited do 
not clearly illustrate the distinction between administrative and 
criminal misconduct. In revising the definition, we are not including 
the examples. We also simplified the definition, as suggested by the 
commenter, and revised the definition to refer to civil or criminal 
fraud under ``State law,'' rather than ``Federal and State law,'' since 
the Units' statutory function extends only to ``violations of all 
applicable State laws . . . .''

H. Definition of Provider

    Comment: One commenter stated that the proposed definition of 
``provider'' insufficiently addresses the wide range of providers whose 
actions fall within the scope of the Units' authority. The commenter 
suggested that, along with several other definitions contained in the 
Proposed Rule, the definition be expanded to incorporate definitions of 
``provider'' that would be accepted under a State's laws.
    The commenter also suggested that the definition be expanded to 
include ``prescribing'' physicians, in addition to ``ordering'' or 
``referring'' physicians, since State law may authorize the ability to 
prescribe as distinct from ordering or referring.
    Response: We agree that the definition for ``provider'' should be 
expanded to reflect varying definitions under State law for health care 
providers, as well as to clarify that it applies to ``prescribing 
physicians'' as one example of a provider. We are therefore expanding 
the definition of provider to include ``any individual or entity that 
may operate as a health care provider under applicable State law'' as 
well as ``an individual or entity that is required to enroll in a State 
Medicaid program, such as an ordering, prescribing, or referring 
physician.''
    Comment: Two commenters expressed concern that the definition of 
provider be expanded to specifically reference providers who provide 
items or services in a managed care setting, as well as managed care 
companies themselves, which do not provide items or services directly 
but instead provide management services for other providers. The 
commenters suggested that the definition of provider refer specifically 
to managed care plans as well as individuals or entities that provide 
items or services in a managed care network and who subcontract with 
those plans.

[[Page 10706]]

    Response: With respect to providers operating in a managed care 
network, we agree and have clarified in the definition that a provider 
includes individuals and entities that are part of a managed care 
network. We had intended in the Proposed Rule that such providers were 
included as ``an individual or entity that furnishes items or services 
for which payment is claimed under Medicaid,'' but have added the 
specific reference to managed care organizations (MCOs) and other 
contracting entities because of the increasing role of managed care 
networks in providing Medicaid items and services.
    With respect to MCOs themselves, we decline to expand the 
definition to specifically mention MCOs as a type of provider. While 
MCOs play an integral and growing role in most State Medicaid programs, 
they do not appear to be universally regarded as a type of 
``provider.'' However, MCOs may play varying roles depending on the 
terms of their contract with the State. To the extent that an MCO's 
actions (or those of other entities or persons) are implicated in the 
potentially fraudulent submission of claims by or on behalf of a 
Medicaid provider, they may be the subject of a MFCU investigation or 
prosecution, regardless of their own status as a provider.
    Comment: One commenter objected that the regulation would expand 
the definition of provider to include ordering and referring 
physicians, arguing that this is not appropriate, since such physicians 
do not participate in the program, may render services free of charge, 
and have little or no reason or opportunity to game the system. 
Therefore, the commenter expressed the view that these physicians 
should not be subject to the administrative requirements of the 
program.
    Response: The definition of provider describes those individuals or 
entities who may be subject to an investigation, but does not expand 
the current authority of the Units. The MFCU mission is the 
``investigation and prosecution of violations of all applicable State 
laws regarding any and all aspects of fraud in connection with . . . 
any aspect of the provision of medical assistance and the activities of 
providers of such assistance . . . .'' To the extent that an ordering 
or referring physician violates State law regarding Medicaid fraud, the 
Units currently have the authority to include ordering or referring 
physicians as the subject of an investigation or prosecution.
    MFCU investigative authority is not limited to participating 
providers or to individuals who may have an obvious financial incentive 
to defraud the program. Fraud is an intent-based crime, so an 
investigation or ultimate prosecution would reveal whether an ordering 
or referring physician had the requisite intent to commit fraud. By 
excluding ordering or referring physicians from the definition of 
provider, Units might be unable to hold responsible under State law 
those individuals responsible for a fraudulent claim to the program.
    We therefore do not believe that the comment warrants a change to 
the definition of ``provider.''

I. Single Identifiable Entity Requirements

    Comment: Two commenters expressed concerns with the proposed 
requirement at Sec.  1007.5(b)(3) that all Units ``[h]ave the 
headquarters office and any field offices each in their own contiguous 
space.''
    One commenter stated that, while this arrangement is a best 
practice for Unit operations, ``some Units may need special exceptions 
based on the history of their respective Units and unique difficulties 
recruiting employees.'' The commenter suggested that OIG grant an 
exception to existing Units with other arrangements on either a 
temporary or permanent basis.
    Another commenter requested that the proposed rule be rewritten to 
allow flexibility in the physical location of Unit employees while 
still requiring effective, multidisciplinary collaboration. The 
commenter requested that the wording of Sec.  1007.5(b)(3) be revised 
to require that Unit offices be in their own contiguous space, ``or 
otherwise ensure that all employees have a work location arrangement 
that allows for real-time collaboration with the other professional 
disciplines within the Unit, that non-Unit personnel have no 
unauthorized access to Unit files, and that Unit personnel exert 100 
percent of their efforts on Unit business.'' Alternatively, the 
commenter requested, similar to the request of the other commenter on 
this topic, that existing Units with noncontiguous space arrangements 
be granted an exception when the arrangement allows for effective 
collaboration.
    Response: Our purpose in proposing a requirement regarding physical 
office space was to ensure that Units exist as a ``single, identifiable 
entity'' and to reflect our observation that Units generally exist in 
contiguous space that is separate from the other parts of the Office of 
Attorney General or other parent organization. As stated in the 
Proposed Rule, we believe that having Unit offices in a single space 
contributes to the team concept of the Units and helps to ensure that 
employees are devoted exclusively to the mission of the Unit.
    We recognize, however, that there can be extenuating circumstances 
for locating staff in noncontiguous space when there are advantages for 
Unit operations in such an arrangement. Therefore, as suggested by both 
commenters, we have provided Units with the opportunity to demonstrate 
to OIG that certain employees warrant a different arrangement. OIG will 
review arrangements and approve or disapprove of exceptions to the 
contiguous space requirement based on a demonstration by the Unit that 
circumstances warrant a different arrangement for certain employees. We 
have not provided a ``grandfathering'' process, but we are prepared to 
review any existing arrangements that do not comport with a single 
space requirement.
    Therefore, we have revised the requirement in Sec.  1007.5 to 
specify that the headquarters office and any field offices must have 
their own contiguous space unless the Unit demonstrates to OIG that 
circumstances warrant a different arrangement for certain employees.
    In considering exceptions to the space requirement, OIG would 
consider favorably the following situations as examples of when 
employees could be located in noncontiguous space:
     Employees working at home on a temporary or long-term 
basis.
     Employees sharing space with OIG or other agencies that 
provide advantages to the Unit's collaboration with those agencies.
     Employees assigned to small offices, including field 
offices, where space is limited and the only available office space is 
not contiguous.

J. Relationship With Medicaid Agency

    Comment: One commenter suggested several clarifications, not 
contained in the sections of the Proposed Rule proposed to be modified 
by OIG. Specifically, the commenter requested that we clarify the 
current regulation at Sec.  1007.9(b).
    The commenter expressed that the language of the paragraph should 
be revised to clarify that (1) the phrase ``Medicaid agency'' is 
intended to refer to the agency in the same State in which the Unit 
exists, (2) the proscription on the Medicaid agency to not ``review or 
overrule the referral of a suspected criminal violation'' be expanded 
to refer to ``decisions'' of the Unit in addition to referrals, and (3) 
the Medicaid agency's and the Unit's respective roles be clear

[[Page 10707]]

and distinct, particularly with regard to decisions as to ``which law 
enforcement or prosecutorial authority is best for a given matter.''
    Response: We generally agree with the substance of the commenter's 
concerns but decline to make the suggested revisions.
    First, in the Proposed Rule OIG did not propose to modify the 
paragraph of the regulation relating to the role of the Medicaid agency 
in reviewing the activities of the Unit, so the comment is beyond the 
scope of the Proposed Rule.
    Secondly, in referring to the ``Medicaid agency'' throughout the 
regulation, OIG is referring to the Medicaid agency for the same State 
in which the Unit exists, not that of another State. We do not believe 
that text of the regulation needs to be modified to clarify this.
    With respect to whether the proscription on interference by the 
Medicaid agency should refer to ``decisions'' of the Unit in addition 
to ``activities,'' we agree that the Medicaid agency does not have the 
authority to interfere with decisions pertaining to the investigation 
or prosecution of a Unit's cases. On the other hand, we note that there 
may be administrative actions in which both the Unit and Medicaid 
agency are both involved. For example, a Unit as part of a criminal or 
civil case may make a decision or recommendation regarding an 
administrative remedy or action. Such decisions may in fact be subject 
to some type of review by the Medicaid agency. As another example, for 
those Units with authority to conduct data mining under Sec.  1007.20, 
the decision of whether to develop a data mining algorithm is subject 
to review and input by the Medicaid agency.
    We therefore decline to expand the proscription on interference by 
the Medicaid agency to include all ``decisions'' by the Unit.
    Finally, with regard to the respective roles of the Medicaid agency 
and the Unit, we agree that law enforcement decisions pertaining to the 
appropriate investigative and prosecutorial authority for a particular 
case are the province of the Unit, not the Medicaid agency. We believe 
this separation of roles is widely understood in the MFCU and State 
agency community and is how OIG interprets the existing language of 
Sec.  1007.9(b).

K. Role of Managed Care Organizations (MCOs) in the Agreement With the 
Medicaid Agency

    Comment: Several commenters observed the important role of MCOs in 
those States that provide Medicaid services in a managed care setting 
and suggested that the section of the regulation addressing the 
relationship of the MFCU to the Medicaid agency, 42 CFR 1007.9, be 
expanded to describe the role of MCOs. One commenter observed that 
activities to combat Medicaid fraud, waste, and abuse would be more 
effective if Units collaborated with MCOs on a routine basis to share 
information. Another commenter, noting the important role of MCOs, 
suggested that the proposed regulation's provision regarding regular 
communication between the Unit and the Medicaid agency be expanded to 
include managed care plans. The commenter specifically requested that 
MCO Special Investigation Units (SIUs) be permitted to attend the 
meetings between the Unit and the Medicaid agency, since SIUs can 
contribute valuable information to the meetings.
    Response: We agree about the critical role of MCOs in those States 
that have chosen to provide Medicaid services in this manner. We also 
believe it is a best practice that the Unit or State program integrity 
officials collaborate with the MCO SIUs and that SIU officials attend 
regular meetings on referral issues. However, we are also mindful that 
States should have the discretion to define the relationship with MCOs 
within the confines of existing law and regulation. States should have 
the ability to choose the manner in which the Unit and Medicaid program 
integrity unit communicate with the MCOs.
    Comment: Another commenter requested more narrowly regarding Sec.  
1007.9 that the written agreement between the Unit and the Medicaid 
agency include a provision regarding how the Unit will receive 
referrals of potential fraud from MCOs either directly or through the 
Medicaid agency.
    Response: Medicaid regulations pertaining to MCOs, 42 CFR 
438.608(a)(7), require that MCOs, under the terms of their contracts 
with the Medicaid agency, refer any case of potential fraud, waste, or 
abuse to the Medicaid agency's program integrity unit or any potential 
fraud directly to the Unit. Also, under 42 CFR 455.21, the Medicaid 
agency must refer all cases of suspected provider fraud to the Unit.
    Consistent with these requirements, we agree that the inclusion of 
a provision in the written agreement between the Unit and the Medicaid 
agency regarding referrals from MCOs would be consistent with other 
requirements and would be an appropriate addition to the MFCU 
regulations and the CMS companion regulation. We have thus modified the 
rules to include such a provision.

L. Payment Suspension

    Comment: One commenter requested that, to effectuate MCO 
involvement in the payment suspension process, payment suspension 
information be communicated to MCOs in a timely manner. The commenter 
also requested that clarification of MCO responsibilities with respect 
to payment suspension be included in this final rule.
    Response: These suggestions are outside the scope of this 
rulemaking. State Medicaid agencies, not the Units, suspend payments.

M. Civil Authorities

    Comment: One commenter stated that Sec.  1007.11(a)(3), in defining 
applicable State laws to include both criminal statutes ``as well as 
civil false claims statutes or other civil authorities,'' seems 
misplaced, affecting the flow of the description of the fraud-focused 
mission of the Units. The commenter recommended instead that the 
regulation, in describing the broad function of the Units in paragraph 
(a), be expanded to state ``[t]he Unit must conduct a statewide program 
for investigating and prosecuting (or referring for prosecution) 
violations of all applicable State laws, including criminal statutes as 
well as civil false claims statutes or other civil authorities . . . 
.''
    Response: We agree and have modified the rule.

N. Misappropriation of Patient or Resident Funds

    Comment: A commenter expressed concern about language in the 
Proposed Rule that would make mandatory the review of complaints of 
``misappropriation of a patient's funds . . .'' when that review is 
currently optional for the Units. The commenter noted that the current 
regulation at Sec.  1007.11(b)(1) states that the ``Unit will also 
review complaints alleging abuse or neglect of patients in health care 
facilities . . .,'' but the Unit ``may review complaints of the 
misappropriation of patient's private funds in such facilities.'' In 
the Proposed Rule, those two clauses are combined and would require in 
paragraph (b)(2) that the Unit ``must also review complaints alleging 
abuse or neglect of patients, including complaints of the 
misappropriation of a patient's funds, in health care facilities 
receiving payments under Medicaid.'' The commenter expressed concern 
that making financial cases mandatory ``may

[[Page 10708]]

stretch already scare resources within the Units.''
    Response: We have accepted the comment and have retained language 
in the final rule to the effect that Units ``may'' review complaints of 
misappropriation of a patient's or resident's private funds. In 
addition to the concern about workload, we believe this language is 
consistent with the changes we are making to the definition of abuse of 
patients or residents, where we have recognized the existence of 
differing State legal definitions of what constitutes abuse.
    Although we have retained the option for financial misappropriation 
cases, we continue to believe that financial misappropriation is a 
significant issue and that Units should continue to devote resources to 
such cases. Financial misappropriation may arise when family members or 
others are granted power of attorney for a patient or resident and 
abuse the patient's or resident's trust by diverting funds to their own 
or another's benefit. Financial misappropriation may arise in 
conjunction with physical abuse or may occur in isolation.

O. MFCU Authority in Board and Care Facilities

    Comment: Several commenters expressed policy concerns about the 
expansion of MFCU authority in board and care facilities, which 
typically do not participate in State Medicaid programs or receive 
Medicaid funding.
    Response: The authority to investigate patient abuse or neglect in 
non-Medicaid board and care facilities is a feature of the Ticket to 
Work and Work Incentives Improvement Act of 1999. The addition to the 
MFCU regulations merely codifies that statutory requirement. The policy 
concerns raised by the commenters are therefore outside the scope of 
this rulemaking.

P. Duties and Responsibilities of Units

    Comment: In the Proposed Rule, we proposed at Sec.  1007.11(a), 
(b)(1), (b)(3), (b)(4), (c), and (d) to replace the word ``will'' with 
``must'' to highlight the mandatory nature of the responsibilities of a 
Unit. A commenter expressed reservations about this change and 
requested that we retain the term ``will'' in the paragraphs. The 
commenter stated that the word ``will'' would make the responsibilities 
of the Unit sufficiently clear. The commenter also expressed that the 
term ``will'' would provide the appropriate discretion for a Unit in 
determining whether to accept a referral, thus promoting the Unit's 
efficient use of resources.
    Response: We have retained the term ``will'' in Sec.  1007.11 and, 
for consistency, in other parts of the regulation, including Sec.  
1007.13, for staffing requirements. We did not intend to propose a 
revision to the mandatory nature of a Unit's responsibilities and agree 
that retaining the term ``will'' would avoid confusion in this regard.
    Comment: One commenter noted that proposed Sec.  1007.11(c) 
addresses the responsibilities of the Units to recover overpayments or 
refer the overpayment recovery to an appropriate ``State'' agency. The 
commenter noted that there are governmental programs in various States 
which process and expend Medicaid dollars at the local level (county or 
city). For instance, some States operate single- or multi-county 
special needs programs or mental health programs. If an overpayment is 
identified in one of these county-administered programs, for example, 
the responsibility for the recovery may more appropriately rest with 
county officials rather than State officials. The commenter suggested 
that the last clause in Sec.  1007.11(c) should include ``or refer the 
matter to an appropriate agency for collection'' [emphasis added].
    Response: We agree with the suggestion and have modified the 
regulation text.
    Comment: One commenter expressed a technical concern with a 
longstanding provision in the regulations at Sec.  1007.11(d) that 
requires Units, for cases that are tried by non-Unit prosecutors, to 
provide the prosecutors with ``the fullest opportunity to participate 
in the investigation from its inception.'' The commenter, while not 
disputing the importance of cooperating with non-Unit prosecutors, 
suggested that this section, as written, is not consistent with patient 
confidentiality obligations as required by performance standards. The 
commenter suggested that Units, consistent with those obligations, must 
have the discretion to determine what cases will be investigated and 
when to notify the prosecuting authority to control the flow of 
confidential information outside of the Unit. Therefore, the commenter 
suggested that the original regulation language of Sec.  1007.11(d) be 
rewritten to eliminate the language about participation in the 
investigations from their inception: Specifically, the commenter stated 
that the language should specify that where a prosecuting authority 
other than the Unit is to assume responsibility for the prosecution of 
a case investigated by the Unit, the Unit will ensure that those 
responsible for the prosecutorial decision and the preparation of the 
case for trial are provided all necessary assistance.
    Response: While we generally agree with the commenter's position 
that the Units must have the discretion to determine what cases will be 
investigated and when to notify an outside prosecuting authority, we 
cannot make the requested change, as we did not propose to modify this 
provision. We also do not believe the suggested change is necessary to 
address the commenter's concern. While the current provision permits 
non-Unit prosecutors the fullest opportunity to participate in the 
MFCU's investigation, it is the Unit's responsibility to determine if 
that participation is appropriate or would interfere with the effective 
investigation of a case. We thus believe that the current provision 
affords the Unit discretion in determining when to involve prosecutors, 
as long as there is full cooperation.

Q. Coordination With Federal Authorities

    Comment: One commenter expressed concern with a provision of the 
Proposed Rule that requires a Unit to disclose case information to 
Federal investigators and attorneys not involved with a particular 
case. Proposed Sec.  1007.11(e)(1), similar to the existing requirement 
contained in paragraph (e), states that the Unit, if requested, will 
make available to OIG investigators and attorneys, other Federal 
investigators, and prosecutors all information in the Unit's possession 
concerning investigations or prosecutions conducted by the Unit.
    Existing paragraph (e) reads the same, except that it does not 
clarify that information be provided ``if requested.''
    The commenter agreed that case information should be shared with 
Federal investigators and attorneys working jointly on a case, but 
expressed concern about broadly requiring the Unit to disclose case 
information to Federal officials who have no involvement in the case. 
The commenter noted that case information could include confidential 
grand jury or other information with legal restrictions on its 
disclosure. Therefore, the commenter suggested that proposed Sec.  
1007.11(e)(1) should be revised to state that the Unit, if requested, 
will make available to OIG investigators and attorneys, or other 
Federal investigators and prosecutors, on the case, all information in 
the Unit's possession concerning investigations or prosecutions 
conducted by the Unit.

[[Page 10709]]

    Response: We do not agree that a revision is necessary to the 
longstanding requirement contained in Sec.  1007.11(e) that Unit 
information be shared with Federal investigators and attorneys. We 
agree there could be State grand jury and other information that, 
because of criminal law restrictions on the use of the information, may 
not be disclosed to Federal investigators and attorneys who are not 
involved with a case. However, the Unit, OIG, and DOJ have 
contemporaneous jurisdiction for all allegations of Medicaid provider 
fraud. While unusual, we believe there could be situations in which OIG 
or DOJ personnel would have a legitimate need to seek information about 
an ongoing investigation or prosecution.
    Comment: At proposed Sec.  1007.11(e)(1) and (2), Units are 
required to make all information pertaining to Medicaid fraud available 
to Federal investigators, prosecutors, and OIG attorneys, and 
subsequently the Unit must coordinate with such officials on any 
Federal and State investigations or prosecutions involving the same 
suspects or allegations. One commenter noted that MCOs are very likely 
to possess information to assist in fraud detection and requested that 
Units be required to make information available to MCOs during fraud 
investigations. The commenter also requested that MCOs be included in 
the coordination of investigations and prosecutions by asking 
prosecutors to include MCO encounter information, and not only State 
fee-for-service claims, in investigated and/or charged conduct. In 
addition, the commenter asked for clarification as to the disposition 
of MCO funds recovered as a result of investigations, civil suits, and 
prosecutions.
    Response: We decline these suggestions. We have observed that MCOs 
in many States are successfully included in the sharing of information 
about ongoing and potential fraud cases and believe that this 
participation by MCOs is a best practice. However, MCOs are private, 
nongovernmental entities, and States should have the ability to 
restrict the sharing of information with them. The suggestions about 
including MCO encounter information in prosecutions and the disposition 
of MCO recoveries are beyond the scope of this regulation.
    Comment: One commenter noted that proposed Sec.  1007.11(e)(2) does 
not clearly state what it means to ``coordinate with'' Federal 
investigators, Federal attorneys, and Federal prosecutors. The 
commenter noted that coordination can include deconfliction of case 
lists and joint investigative activities, including avoiding 
duplication of efforts in joint cases.
    Response: We agree with this comment and believe that the commenter 
has described appropriate examples of coordination--deconfliction of 
case lists and joint investigative activities. We decline to further 
revise Sec.  1007.11(e) beyond the expectation that the Unit establish 
a practice of regular meetings or communication with OIG investigators 
and Federal prosecutors. Our intention is for Units to have flexibility 
to coordinate in a manner that is appropriate for that State, as 
coordination may look different depending on variables such as the type 
of case, size of the State, or the presence or absence of Federal 
partners in the State.
    Comment: Another commenter noted ambiguity in the language of 
proposed Sec.  1007.11(e)(2) where we proposed that the Unit will 
coordinate with OIG investigators and attorneys, other Federal 
investigators, and prosecutors on any Unit cases involving the same 
suspects or allegations.
    Specifically, the commenter was unclear as to which ``prosecutors'' 
are the focus of this provision. The commenter also believed that OIG 
should be permitted latitude to manage at its discretion those 
circumstances in which OIG's resources are limited and other Federal 
agencies are summoned to assist or supplement assistance as 
appropriate. To address these comments, the commenter recommended that 
Sec.  1007.11(e)(2) be revised to state that the Unit will coordinate 
with OIG investigators and OIG attorneys, as OIG and the Unit deem 
appropriate, joint activities involving other Federal investigators and 
Federal prosecutors on Unit cases and Federal cases that involve the 
same suspects, providers, or allegations.
    Response: We agree that the proposed provision does not make clear 
to which prosecutors the provision refers. We intended to specify 
``Federal'' prosecutors and have modified the regulation text at 
paragraph (e)(2) as well as paragraph (e)(1) to remove the ambiguity. 
We also added wording to paragraph (e)(2) to improve clarity. However, 
we did not modify the text in paragraph (e)(2) to include the 
commenter's suggested language regarding ``as OIG and the Unit deem 
appropriate'' because we believe that considering the appropriateness 
of involvement in a case would be part of coordinating. We are also 
reluctant to limit coordination to ``joint activities'' involving the 
same suspects or allegations because we believe Units need to 
coordinate with their Federal counterparts even on cases not being 
worked jointly. Thus, we are modifying paragraph (e)(2) to state that 
the Unit will coordinate with OIG investigators and attorneys, or with 
other Federal investigators and prosecutors, on any Unit cases 
involving the same suspects or allegations that are also under 
investigation or prosecution by OIG or other Federal investigators or 
prosecutors [emphasis added].
    Comment: Proposed Sec.  1007.11(e)(3) specifies that a Unit 
establish a practice of regular meetings or communication with OIG 
investigators and Federal prosecutors. One commenter recommended that 
the SIUs of MCOs be permitted to attend these meetings, or that similar 
meetings be held with the SIUs of MCOs. The commenter also requested 
that at Sec.  1007.11, paragraphs (a) through (c), MCOs also be 
included under references to ``Medicaid'' for which the Unit is 
responsible.
    Response: We believe that attendance by MCOs at meetings may be a 
best practice, but we decline to identify in regulation those 
participants required at particular meetings. As noted previously, MCOs 
are private, nongovernmental entities, and States should have the 
ability to restrict the sharing of information with them.
    Comment: One commenter noted that proposed Sec.  1007.11(e)(5) 
requires the Unit to ``establish written procedures'' but leaves 
unclear the level of detail or depth of such written procedures. The 
commenter expressed concern about this paragraph posing a potential 
burden. To permit greater discretion, the commenter recommended 
revising the regulation to require Units to establish ``policy'' rather 
than written procedures.
    Response: We agree with the suggestion that Units establish 
``policy'' rather than the more prescriptive ``written procedures.'' We 
have revised the paragraph accordingly. This revision will reduce 
burden on Units and enhance Unit flexibility.
    Comment: One commenter expressed support for proposed Sec.  
1007.11(g)(3) for the accommodation granted in allowing Units to 
transmit the requested information ``as soon as practicable'' due to 
the specified delays. However, the commenter observed that Units have 
encountered delays that are not due directly to the ``[receipt of] . . 
. information'' from the ``sentencing court,'' but that remained beyond 
the Unit's control or capacity. For example, long queues at court 
clerks' offices, sometimes in locations far away from the Unit, can 
compromise a Unit's ability to communicate effectively and timely with 
court staff, which can

[[Page 10710]]

further delay the Unit's efforts to finalize sentencing-related 
dispositions. As such, the commenter requested that the term ``court'' 
replace the term ``sentencing court'' so that the paragraph states that 
such information will be transmitted to OIG within 30 days of 
sentencing, or as soon as practicable if the Unit encounters delays, 
such as in receiving the necessary information from the court [emphasis 
added].
    Response: OIG agrees that Units could encounter delays that are 
more broadly described as ``court delays'' rather than the more 
specific delays in receiving information from the ``sentencing court'' 
and accepts the commenter's suggestion. However, we do not intend for 
delays ``in receiving the necessary information from the court'' to be 
an example of a possible delay, but to be the only acceptable reason 
that transmitting information to OIG should be delayed. Therefore, we 
are replacing the term ``sentencing court'' with ``court,'' but we are 
not including the phrase ``such as'' as part of the paragraph.

R. Staffing Requirements

    Comment: One commenter suggested that, in addition to modifying the 
attorney role in Sec.  1007.13(b)(1) to more specifically convey the 
prosecution and advisory role of Unit attorneys, OIG should revise the 
description of the investigator role as well. Specifically, the 
commenter suggested that we clarify that investigators should be 
capable of conducting investigations of Medicaid fraud and patient 
abuse and neglect matters.
    Response: We agree with the comment and have modified the final 
regulatory language.
    Comment: One commenter expressed concern that the proposed minor 
change at Sec.  1007.13(b)(2) concerning the qualifications of auditors 
did not include information on how the auditors would perform 
operational audits of health care entities.
    Response: MFCU auditors do not conduct operational audits of health 
care entities. Units are restricted at Sec.  1007.19(e)(1) from 
receiving FFP for expenditures attributable to cases involving 
``program abuse or other failures to comply with applicable laws and 
regulations.'' Therefore, we decline to make modifications to the rule 
to address operational auditing.
    Comment: A commenter expressed concern about the limitation in the 
proposed rule at Sec.  1007.13(g)(2) that a Unit may not ``rely on 
individuals not employed directly by the Unit for the investigation or 
prosecution of cases.'' The commenter asked that we clarify that a Unit 
``may hire special counsel or other investigative or litigation support 
services to work jointly with the Unit to assist in specific, discrete 
investigations or cases, where the Unit can demonstrate that additional 
assets or expertise may be needed for the discrete case.''
    Response: We agree with the concern that Units should be able to 
hire experts to support the investigative and prosecutorial work of the 
Units, as long as the experts do not actually conduct investigations 
and prosecutions of Medicaid fraud or of patient or resident abuse or 
neglect. We believe, however, that this need is addressed by proposed 
paragraph (g)(1), which stated that the Unit may employ, or have 
available through consultant agreements or other contractual 
arrangements, individuals who have forensic or other specialized skills 
that support the investigation and prosecution of cases.
    We believe that the proposed regulatory language provides the right 
distinction that Units may not ``rely'' on contractors to investigate 
or prosecute cases, but may have contracts or consultant agreements 
with experts who may ``support'' the investigation and prosecution.

S. Recertification Requirements

    Comment: Proposed Sec.  1007.17(a)(2)(iv) states that Units are to 
submit statistical reports on staffing, caseload, and outcomes, 
including monetary recoveries. A commenter made technical comments on 
the definitions of the types of monetary recoveries reported.
    Response: While we appreciate the comments, we do not believe that 
addressing detailed technical comments about statistical reporting is 
appropriate in the rule itself. We will consider the commenter's 
concerns outside of the rulemaking.
    Comment: Proposed Sec.  1007.17(b)(2) requires the Units to provide 
``other information OIG deems necessary or warranted.'' One commenter 
noted that in the past the Units have been asked to provide additional 
information to OIG, but the requested data is not routinely kept by the 
Units. The commenter also noted that while not every contingency can be 
predicted, a request for ``other information'' without prior notice is 
cumbersome and potentially void of a high level of accuracy. The 
commenter suggested adding language that advance notice would be 
provided to the Unit for other information OIG deems necessary and 
warranted.
    Response: While we decline to accept this level of prescription in 
the final rule, we agree about the need to provide Units advance notice 
of information requests. OIG needs to maintain the ability to collect 
information from the Units but will always strive to provide advance 
notice and to be sensitive to requesting data that is not routinely 
kept by the Units.

T. Federal Financial Participation

    Comment: A commenter endorsed the approach of the Proposed Rule to 
limit those situations, other than through ``data mining,'' in which 
FFP would be prohibited for the identification of potential fraud 
cases. The Proposed Rule accomplished this by proposing to modify the 
language in Sec.  1007.19(e)(2), which currently prohibits FFP for 
``efforts to identify [other than through an approved data mining 
waiver] situations in which a question of fraud may exist, including 
the screening of claims and analysis of patterns of practice . . .'' 
with ``efforts to identify situations of fraud . . . by the screening 
of claims and analysis of patterns of practice . . .'' [emphasis 
added]. The purpose of the change was to acknowledge ways in which a 
Unit may identify possible fraud that would not interfere with 
activities of the Medicaid agency, such as undercover operations. The 
commenter also suggested that we further clarify the issue by adding 
the following sentence to this preamble:

    This subsection is not intended to limit the Unit's ability to 
engage in activities, other than routine verification of services 
received and data mining, to identify potential civil or criminal 
fraud in the Medicaid program.

    Response: We agree that the suggested additional sentence correctly 
describes those activities to identify potential fraud, in addition to 
an approved data mining program, that would be permissible for purposes 
of receiving FFP, and we adopt the sentence here. This clarification is 
consistent with the proposed changes to the subsection and does not 
require a change to the text of the regulation.
    Comment: A commenter expressed concern with the longstanding 
prohibition, modified in the Proposed Rule at Sec.  1007.19(e)(5), that 
a Unit may not receive FFP for cases ``involving a beneficiary's 
eligibility for benefits, unless the suspected fraud also involves 
conspiracy with a provider.'' The existing regulation similarly 
prohibits FFP for the ``investigation or prosecution of cases of 
suspected beneficiary fraud not involving suspected conspiracy with a 
provider.'' The commenter expressed that the language in Sec.  
1007.19(e)(5) is too limiting regarding the types of permissible 
beneficiary fraud cases because the word ``suspected'' modifies

[[Page 10711]]

the word ``fraud.'' The commenter observed that there are cases that 
involve conspiracy between a beneficiary and provider but that may 
involve suspected conduct other than fraud, such as alleged identity 
theft. The commenter suggested that the prohibition be modified to 
refer to conspiracy involving ``joint criminal conduct'' rather than 
narrowly to ``fraud.''
    Response: We decline to make the proposed revision regarding the 
reference to ``suspected fraud.'' We agree that identity theft (or 
other activities not strictly involving fraudulent billing to the 
program) could be identified as integral to, or evidence of, a 
conspiracy between a beneficiary and provider. However, the underlying 
conduct, consistent with the authority of the Unit to receive FFP, must 
involve ``fraud.'' As long as the other criminal conduct identified as 
part of the conspiracy, such as identity theft, has a connection to the 
fraud allegations, the Unit may receive FFP for the investigation and 
prosecution of the case. To promote clarity, we have amended the 
provision to refer to the investigation or prosecution of ``fraud'' 
cases involving a beneficiary's eligibility for benefits, unless the 
suspected fraud ``cases'' also involve conspiracy with a provider.

U. Disallowances of FFP

    Comment: One commenter suggested that the language proposed in 
Sec.  1007.21(a), regarding OIG's determination that a claim or portion 
of a claim for grant funding is not allowable, should be consistent 
with the contents of the Federal regulation to which it refers, 42 CFR 
430.42(a), by clarifying that OIG's determination should be made 
``promptly.''
    Response: We agree and have included the word ``promptly'' in the 
final regulation. The proposed changes were intended to mirror the 
disallowance procedures in 42 CFR 430.42(a), including that OIG's 
determination be made ``promptly.''

III. Provisions of the Final Rule

    This final rule incorporates most of the provisions in the Proposed 
Rule but with some substantive and technical changes to the regulatory 
text that are described in this section and in section II above.
    We are finalizing, with certain revisions described in section II, 
all of the proposed definitions. We made revisions to the definitions 
of several kinds of conduct, such as ``fraud'' and ``abuse of patients 
or residents,'' to more clearly adopt those definitions of conduct as 
contained in applicable State laws. We also similarly expanded the 
definition of ``provider'' to adopt applicable State law, as well as to 
reference managed care and prescribing physicians. We also expanded 
references to abuse and neglect of patients to include ``residents.''
    We are finalizing the characteristics of what it means to be a 
single, identifiable entity at Sec.  1007.5. We included a 
clarification to the requirement that the headquarters office and any 
field offices should each have their own contiguous space, unless a 
Unit demonstrates to OIG that circumstances may warrant a different 
arrangement for certain employees.
    We are finalizing the proposed changes to the prosecutorial 
authority requirements of a Unit at Sec.  1007.7, with one additional 
modification. At Sec.  1007.7(b), we are finalizing the requirement for 
a Unit to establish formal written procedures for referring cases of 
patient or resident abuse and neglect prosecutions, in addition to 
fraud cases, to the appropriate prosecuting authority, when there is no 
State agency with statewide authority and capability for patient or 
resident abuse prosecutions. Similarly, we are making a technical 
amendment to Sec.  1007.7(a) to clarify that if a Unit is located in 
the office of the State Attorney General or another office with 
statewide prosecutorial authority, it must have the authority to 
prosecute individuals for violations of criminal laws with respect to 
patient or resident abuse and neglect in addition to fraud.
    We are finalizing the provisions pertaining to the Unit's 
relationship and agreement with the Medicaid agency at both Sec.  
1007.9 and the companion CMS regulation at Sec.  455.21(c), with one 
additional provision. As described in detail in section II, we are 
adding a new paragraph at Sec.  1007.9(d)(3) and at Sec.  455.21(c)(3) 
requiring the Unit and the Medicaid agency to agree to establish 
procedures by which the Unit will receive referrals of potential fraud 
from MCOs, as applicable, either directly or through the Medicaid 
agency.
    We are finalizing a number of provisions proposed, some with 
certain modifications, related to the duties and responsibilities of a 
Unit found at Sec.  1007.11. However, for reasons explained above, we 
are not finalizing the proposal to make mandatory the review of 
complaints of misappropriation of patients' or residents' funds and 
have retained language in the final rule to continue that authority as 
optional. We are also not finalizing the word ``must'' to describe a 
Unit's responsibilities at Sec.  1007.11(a), (b)(1), (b)(3), (b)(4), 
(c), and (d), and are retaining the word ``will'' in the final rule.
    We are finalizing the provision to clarify that applicable State 
laws pertaining to Medicaid fraud include criminal statutes as well as 
civil false claims statutes and other civil authorities, but we have 
incorporated the clarification into Sec.  1007.11(a) in the final rule, 
rather than in the proposed paragraph (a)(3). We are finalizing the 
provision at Sec.  1007.11(c), with a slight modification, to clarify 
that when a Unit discovers that overpayments have been made to a 
provider or facility, the Unit will either recover the overpayment as 
part of its resolution of a fraud case or refer the matter to the 
appropriate agency for collection.
    We are finalizing provisions pertaining to coordination with 
Federal investigators and attorneys at Sec.  1007.11(e), with slight 
modifications to the proposed language. At paragraph (e)(5), we have 
modified the final rule such that a Unit will establish written policy 
consistent with paragraph (e), rather than establish written 
procedures.
    We are finalizing a provision at Sec.  1007.11(g) requiring a Unit 
to transmit to OIG, for purposes of excluding convicted individuals and 
entities from participation in Federal health care programs under 
section 1128 of the Act, pertinent documentation on all convictions 
obtained by the Unit. We made a minor modification to paragraph (3) 
requiring transmission of information within 30 days of sentencing, or 
as soon as practicable if the Unit encounters delays in receiving the 
necessary information from the ``court,'' rather than the ``sentencing 
court'' as was proposed.
    We are finalizing all of the provisions in the Proposed Rule 
related to the staffing requirements of a Unit at Sec.  1007.13, with 
the following modifications. We are finalizing clarifications at Sec.  
1007.13(b) to the qualifications of attorneys, auditors, and 
investigators, but we made one modification to paragraph (3) to specify 
that the investigators be capable of conducting investigations of 
health care fraud and patient or resident abuse and neglect matters. 
Additionally, we are not finalizing the use of the word ``must'' to 
describe a Unit's staffing requirements at Sec.  1007.13(c), (d)(1), 
(d)(4), and (h) and have modified the final rule to use the 
sufficiently prescriptive word ``will.'' For consistency with the other 
paragraphs, we have modified paragraph (b) to use the word ``will'' 
rather than the original rule's use of ``must.''

[[Page 10712]]

    In Sec.  1007.17, to reduce burden on the Units, we are eliminating 
the specific requirement of providing an ``annual report'' to OIG. 
However, we continue to receive information from the Units that allows 
OIG to evaluate the Unit's performance for purposes of recertification.
    Finally, we have made editorial and other nonsubstantive changes to 
the final rule, where appropriate, to clarify our meaning.

IV. Regulatory Impact Statement

    We have examined the impact of this rule, as required by Executive 
Order 12866 on Regulatory Planning and Review (September 30, 1993), 
Executive Order 13563 on Improving Regulation and Regulatory Review 
(January 18, 2011), the Regulatory Flexibility Act (RFA) (September 19, 
1980, Pub. L. 96-354), section 1102(b) of the Social Security Act, 
section 202 of the Unfunded Mandates Reform Act of 1995 (March 22, 
1995, Pub. L. 104-4), Executive Order 13132 on Federalism (August 4, 
1999), the Congressional Review Act (5 U.S.C. 804(2)), and Executive 
Order 13771 on Reducing Regulation and Controlling Regulatory Costs 
(January 30, 2017).
    Executive Orders 12866 and 13563 direct agencies to assess all 
costs and benefits of available regulatory alternatives and, if 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety effects; distributive impacts; and equity). A 
regulatory impact analysis (RIA) must be prepared for major rules with 
economically significant effects ($100 million or more in any 1 year). 
This rule does not reach the economic threshold, and thus is not 
considered a major rule. Since the regulation only implements current 
practice and policy, we believe the economic impact to be negligible.
    The RFA requires agencies to analyze options for regulatory relief 
of small entities. For purposes of the RFA, small entities include 
small businesses, nonprofit organizations, and small governmental 
jurisdictions. Most hospitals and most other providers and suppliers 
are small entities, either by nonprofit status or by having revenues of 
$7.5 million to $38.5 million in any 1 year. Individuals and States are 
not included in the definition of a small entity. We did not prepare an 
analysis for the RFA because we have determined, and the Secretary of 
Health and Human Services certifies, that this final rule will not have 
a significant economic impact on a substantial number of small 
entities.
    In addition, section 1102(b) of the Act requires us to prepare a 
RIA if a rule may have a significant impact on the operations of a 
substantial number of small rural hospitals. This analysis must conform 
to the provisions of section 604 of the RFA. For purposes of section 
1102(b) of the Act, we define a small rural hospital as a hospital that 
is outside of a Metropolitan Statistical Area for Medicare payment 
regulations and has fewer than 100 beds. We did not prepare an analysis 
for section 1102(b) of the Act because we have determined, and the 
Secretary of Health and Human Services certifies, that this final rule 
will not have a significant impact on the operations of a substantial 
number of small rural hospitals.
    Section 202 of the Unfunded Mandates Reform Act of 1995 also 
requires that agencies assess anticipated costs and benefits before 
issuing any rule whose mandates require spending in any 1 year of $100 
million in 1995 dollars, updated annually for inflation. This rule has 
no consequential effect on State, local, or Tribal governments or on 
the private sector.
    Executive Order 13132 establishes certain principles and criteria 
that an agency must follow when it implements a regulation or other 
policy that has Federalism implications, defined in Order 13132 to mean 
that the regulation or policy has substantial direct effects on the 
States, on the relationship between the National Government and the 
States, or on the distribution of power and responsibilities among the 
various levels of government. Order 13132 also requires a level of 
consultation with State or local officials when an agency formulates 
and implements a regulation that has Federalism implications, imposes 
substantial direct compliance costs on State and local governments, and 
is not required by statute.
    We do not believe that this regulation has Federalism implications 
as it does not have a substantial direct effect on the States or on the 
relationship or distribution of power and responsibilities among levels 
of government. Nor do we believe the regulation imposes substantial 
direct compliance costs on States. Rather, the regulation reflects 
certain statutory changes governing operation of the Units that have 
already been implemented and codifies policy and practice involving the 
organization and operation of the Units. We believe the content of the 
regulation is consistent with the partnership between the Federal and 
State Governments that has been established for the financing and 
administration of the larger Medicaid program. We further believe that 
any costs related to compliance with the regulation are minimal and not 
substantial.
    However, to the extent that that the regulation is seen as having 
Federalism implications, the regulation is consistent with the 
principles and criteria established in Order 13132. The regulation 
would strictly adhere to constitutional principles and would be 
deferential to the States with respect to the policymaking and 
administration of State operations related to the investigation and 
prosecution of Medicaid provider fraud and patient or resident abuse or 
neglect. With regard to consultation, the policies contained in the 
regulation were developed in consultation and collaboration with the 
States.
    Executive Order 13771 requires an agency to identify at least two 
deregulatory actions for each new regulation that the agency proposes 
or otherwise promulgates. Any new incremental costs associated with a 
new regulation must, to the extent permitted by law, be offset by the 
elimination of existing costs through deregulatory actions. It has been 
determined that this rule is a deregulatory action.
    In accordance with the provisions of Executive Order 12866, this 
regulation was reviewed by the Office of Management and Budget.

V. Paperwork Reduction Act

    This rule revises the scope of our annual collection of information 
at 42 CFR 1007.17. Under the Paperwork Reduction Act of 1995 (PRA), 
Federal agencies generally must take certain steps, such as seeking 
public comment on proposed collections of information and submitting 
proposed collections for review and approval by the Office of 
Management and Budget, before requiring or requesting information from 
the public. Accordingly, we solicited public comment on the information 
required in proposed 42 CFR 1007.17 for OIG's annual review and 
recertification of Units. After we published the Proposed Rule, 
however, the Inspector General Empowerment Act of 2016 (Empowerment 
Act), Public Law No. 114-317, was signed into law on December 16, 2016. 
Section 2 of the Empowerment Act added subsection (k) to section 6 of 
the Inspector General Act of 1978. Under new subsection (k), the PRA 
does not apply to ``the collection of information during the conduct of 
an audit, investigation, inspection, evaluation, or other review 
conducted by . . . any Office of Inspector General

[[Page 10713]]

. . . .'' As a result, the collection of information under 42 CFR 
1007.17 of this rule is exempt from the requirements of the PRA.

List of Subjects

42 CFR Part 455

    Fraud, Grant programs-health, Health facilities, Health 
professions, Investigations, Medicaid, Reporting and recordkeeping 
requirements

42 CFR Part 1007

    Administrative practice and procedure, Fraud, Grant programs-
health, Medicaid, Reporting and recordkeeping requirements

    The Centers for Medicare & Medicaid Services (CMS) and the Office 
of Inspector General (OIG), respectively, amend 42 CFR part 455 and 
1007 as follows:

PART 455--PROGRAM INTEGRITY: MEDICAID

0
1. The authority citation for part 455 continues to read as follows:

    Authority: Sec. 1102 of the Social Security Act (42 U.S.C. 
1302).


0
2. Section 455.21 is amended by adding paragraph (c) to read as 
follows:


Sec.  455.21   Cooperation with State Medicaid fraud control units.

* * * * *
    (c) The agency must enter into a written agreement with the unit 
under which:
    (1) The agency will agree to comply with all requirements of Sec.  
455.21(a);
    (2) The unit will agree to comply with the requirements of Sec.  
1007.11(c) of this title; and
    (3) The agency and the unit will agree to--
    (i) Establish a practice of regular meetings or communication 
between the two entities;
    (ii) Establish procedures for how they will coordinate their 
efforts;
    (iii) Establish procedures for Sec. Sec.  1007.9(e) through 
1007.9(h) of this title;
    (iv) Establish procedures by which the unit will receive referrals 
of potential fraud from managed care organizations, if applicable, 
either directly or through the agency, as required at Sec.  
438.608(a)(7) of this title; and
    (v) Review and, as necessary, update the agreement no less 
frequently than every five (5) years to ensure that the agreement 
reflects current law and practice.

0
3. Part 1007 is revised to read as follows:

PART 1007--STATE MEDICAID FRAUD CONTROL UNITS

Sec.
Subpart A--General Provisions and Definitions
1007.1 Definitions.
1007.3 Statutory basis and organization of rule.
Subpart B--Requirements for Certification
1007.5 Single identifiable entity requirements of Unit.
1007.7 Prosecutorial authority requirements for Unit.
1007.9 Relationship and agreement between Unit and Medicaid agency.
1007.11 Duties and responsibilities of Unit.
1007.13 Staffing requirements of Unit.
1007.15 Establishment and certification of Unit.
1007.17 Annual recertification of Unit.
Subpart C--Federal Financial Participation
1007.19 FFP rate and eligible FFP costs.
1007.20 Circumstances of permissible data mining.
1007.21 Disallowance of claims for FFP.
Subpart D--Other Provisions
1007.23 Other applicable HHS regulations.

    Authority: 42 U.S.C. 1302, 1396a(a)(61), 1396b(a)(6), 
1396b(b)(3), and 1396b(q).

Subpart A--General Provisions and Definitions


Sec.  1007.1   Definitions.

    As used in this part, unless otherwise indicated by the context:
    Abuse of patients or residents means any act that constitutes abuse 
of a patient or resident of a health care facility or board and care 
facility under applicable State law. Such conduct may include the 
infliction of injury, unreasonable confinement, intimidation, or 
punishment with resulting physical or financial harm, pain, or mental 
anguish.
    Board and care facility means a residential setting that receives 
payment (regardless of whether such payment is made under Title XIX of 
the Social Security Act) from or on behalf of two or more unrelated 
adults who reside in such facility, and for whom one or both of the 
following is provided:
    (1) Nursing care services provided by, or under the supervision of, 
a registered nurse, licensed practical nurse, or licensed nursing 
assistant.
    (2) A substantial amount of personal care services that assist 
residents with the activities of daily living, including personal 
hygiene, dressing, bathing, eating, toileting, ambulation, transfer, 
positioning, self-medication, body care, travel to medical services, 
essential shopping, meal preparation, laundry, and housework.
    Data mining means the practice of electronically sorting Medicaid 
or other relevant data, including, but not limited to, the use of 
statistical models and intelligent technologies, to uncover patterns 
and relationships within that data to identify aberrant utilization, 
billing, or other practices that are potentially fraudulent.
    Director means a professional employee of the Unit who supervises 
all Unit employees, either directly or through other Unit managers.
    Exclusive effort means that a Unit's professional employees, except 
as otherwise permitted in Sec.  1007.13, dedicate their efforts 
``exclusively'' to the functions and responsibilities of a Unit as 
described in this part. Exclusive effort requires that duty with the 
Unit be intended to last for at least one (1) year and includes an 
arrangement in which an employee is on detail or assignment from 
another government agency, but only if the detail or arrangement is 
intended to last for at least one (1) year.
    Fraud means any act that constitutes criminal or civil fraud under 
applicable State law. Such conduct may include deception, concealment 
of material fact, or misrepresentation made intentionally, in 
deliberate ignorance of the truth, or in reckless disregard of the 
truth.
    Full-time employee means an employee of the Unit who has full-time 
status as defined by the State.
    Health care facility means a provider that receives payments under 
Medicaid and furnishes food, shelter, and some treatment or services to 
four or more persons unrelated to the proprietor in an inpatient 
setting.
    Misappropriation of patient or resident funds means the wrongful 
taking or use, as defined under applicable State law, of funds or 
property of a patient or resident of a health care facility or board 
and care facility.
    Neglect of patients or residents means any act that constitutes 
neglect of a patient or resident of a health care facility or board and 
care facility under applicable State law. Such conduct may include the 
failure to provide goods and services necessary to avoid physical harm, 
mental anguish, or mental illness.
    Part-time employee means an employee of the Unit who has part-time 
status as defined by the State.
    Professional employee means an investigator, attorney, or auditor.
    Program abuse means provider practices that do not meet the 
definition of civil or criminal fraud under applicable State law, but 
nonetheless are inconsistent with sound fiscal, business, or medical 
practices.

[[Page 10714]]

    Provider means:
    (1) An individual or entity that furnishes or arranges for the 
furnishing of items or services for which payment is claimed under 
Medicaid, including an individual or entity in a managed care network;
    (2) An individual or entity that is required to enroll in a State 
Medicaid program, such as an ordering, prescribing, or referring 
physician; or
    (3) Any individual or entity that may operate as a health care 
provider under applicable State law.
    Unit means State Medicaid Fraud Control Unit.


Sec.  1007.3  Statutory basis and organization of rule.

    (a) Statutory basis. This part codifies sections 1903(a)(6) and 
1903(b)(3) of the Social Security Act (the Act), which establish the 
amounts and conditions of Federal matching payments for expenditures 
incurred in establishing and operating a State MFCU. This part also 
implements section 1903(q) of the Act, which establishes the basic 
requirements and standards that Units must meet to demonstrate that 
they are effectively carrying out the functions of the Unit in order to 
be certified by OIG as eligible for FFP under Title XIX of the Act. 
Section 1902(a)(61) of the Act requires a State to provide in its 
Medicaid State plan that it operates a Unit that effectively carries 
out the functions and requirements described in this part, as 
determined in accordance with standards established by OIG, unless the 
State demonstrates that a Unit would not be cost effective because of 
minimal Medicaid fraud in the covered services under the plan and that 
beneficiaries under the plan will be protected from abuse and neglect 
in connection with the provision of medical assistance under the plan 
without the existence of such a Unit. CMS retains the authority to 
determine a State's compliance with Medicaid State plan requirements in 
accordance with section 1902(a) of the Act.
    (b) Organization of this part. Subpart A of this part defines terms 
used in this part and sets forth the statutory basis and organization 
of this part. Subpart B specifies the certification requirements that a 
Unit must meet to be eligible for FFP, including requirements for 
applying and reapplying for certification. Subpart C specifies FFP 
rates, costs eligible and not eligible for FFP, and FFP disallowance 
procedures. Subpart D specifies other HHS regulations applicable to the 
MFCU grants.

Subpart B--Requirements for Certification


Sec.  1007.5  Single, identifiable entity requirements of Unit.

    (a) A Unit must be a single, identifiable entity of the State 
government.
    (b) To be considered a single, identifiable entity of the State 
government, the Unit must:
    (1) Be a single organization reporting to the Unit director;
    (2) Operate under a budget that is separate from that of its parent 
agency; and
    (3) Have the headquarters office and any field offices each in 
their own contiguous space, unless the Unit demonstrates to OIG that 
circumstances warrant a different arrangement for certain employees.


Sec.  1007.7  Prosecutorial authority requirements of Unit.

    A Unit must be organized according to one of the following three 
options related to a Unit's prosecutorial authority:
    (a) The Unit is in the office of the State Attorney General or 
another department of State government that has statewide authority to 
prosecute individuals for violations of criminal laws with respect to 
fraud and patient or resident abuse or neglect in the provision or 
administration of medical assistance under a State plan implementing 
Title XIX of the Act.
    (b) If there is no State agency with statewide authority and 
capability for criminal fraud or patient or resident abuse or neglect 
prosecutions, the Unit has established formal written procedures 
ensuring that the Unit refers suspected cases of criminal fraud in the 
State Medicaid program or of patient or resident abuse and neglect to 
the appropriate prosecuting authority or authorities, and coordinates 
with and assists such authority or authorities in the prosecution of 
such cases.
    (c) The Unit has a formal working relationship with the office of 
the State Attorney General, or another office with statewide 
prosecutorial authority, and has formal written procedures for 
referring to the State Attorney General or other office suspected 
criminal violations and for effective coordination of the activities of 
both entities relating to the detection, investigation, and prosecution 
of those violations relating to the State Medicaid program. Under this 
working relationship, the office of the State Attorney General, or 
other office, must agree to assume responsibility for prosecuting 
alleged criminal violations referred to it by the Unit. However, if the 
State Attorney General finds that another prosecuting authority has the 
demonstrated capacity, experience, and willingness to prosecute an 
alleged violation, he or she may refer a case to that prosecuting 
authority, as long as the office of the State Attorney General 
maintains oversight responsibility for the prosecution and for 
coordination between the Unit and the prosecuting authority.


Sec.  1007.9  Relationship and agreement between Unit and Medicaid 
agency.

    (a) The Unit must be separate and distinct from the Medicaid 
agency.
    (b) No official of the Medicaid agency will have authority to 
review the activities of the Unit or to review or overrule the referral 
of a suspected criminal violation to an appropriate prosecuting 
authority.
    (c) The Unit will not receive funds paid under this part either 
from or through the Medicaid agency.
    (d) The Unit must enter into a written agreement with the Medicaid 
agency under which:
    (1) The Medicaid agency will agree to comply with all requirements 
of Sec.  455.21(a) of this title;
    (2) The Unit will agree to comply with the requirements of Sec.  
1007.11(c) of this title; and
    (3) The Medicaid agency and the Unit will agree to:
    (i) Establish a practice of regular meetings or communication 
between the two entities;
    (ii) Establish procedures for how they will coordinate their 
efforts;
    (iii) Establish procedures for Sec. Sec.  1007.9(e) through 
1007.9(h) of this title;
    (iv) Establish procedures by which the Unit will receive referrals 
of potential fraud from managed care organizations, if applicable, 
either directly or through the Medicaid agency, as required at Sec.  
438.608(a)(7) of this title; and
    (v) Review and, as necessary, update the agreement no less 
frequently than every five (5) years to ensure that the agreement 
reflects current law and practice.
    (e)(1) The Unit may refer any provider with respect to which there 
is pending an investigation of a credible allegation of fraud under the 
Medicaid program to the Medicaid agency for payment suspension in whole 
or part under Sec.  455.23 of this title.
    (2) Referrals may be brief but must be in writing and include 
sufficient information to allow the Medicaid agency to identify the 
provider and to explain the credible allegations forming the grounds 
for the payment suspension.

[[Page 10715]]

    (f) Any request by the Unit to the Medicaid agency to delay 
notification to the provider of a payment suspension under Sec.  455.23 
of this title must be made promptly in writing.
    (g) The Unit should reach a decision on whether to accept a case 
referred by the Medicaid agency in a timely fashion. When the Unit 
accepts or declines a case referred by the Medicaid agency, the Unit 
promptly notifies the Medicaid agency in writing of the acceptance or 
declination of the case.
    (h) Upon request from the Medicaid agency on a quarterly basis 
under Sec.  455.23(d)(3)(ii), the Unit will certify that any matter 
accepted on the basis of a referral continues to be under 
investigation, thus warranting continuation of the payment suspension.


Sec.  1007.11   Duties and responsibilities of Unit.

    (a) The Unit will conduct a statewide program for investigating and 
prosecuting (or referring for prosecution) violations of all applicable 
State laws, including criminal statutes as well as civil false claims 
statutes or other civil authorities, pertaining to the following:
    (1) Fraud in the administration of the Medicaid program, the 
provision of medical assistance, or the activities of providers.
    (2) Fraud in any aspect of the provision of health care services 
and activities of providers of such services under any Federal health 
care program (as defined in section 1128B(f)(1)of the Act), if the Unit 
obtains the written approval of the Inspector General of the relevant 
agency and the suspected fraud or violation of law in such case or 
investigation is primarily related to the State Medicaid program.
    (b)(1) The Unit will also review complaints alleging abuse or 
neglect of patients or residents in health care facilities receiving 
payments under Medicaid and may review complaints of the 
misappropriation of funds or property of patients or residents of such 
facilities.
    (2) At the option of the Unit, it may review complaints of abuse or 
neglect, including misappropriation of funds or property, of patients 
or residents of board and care facilities, regardless of whether 
payment to such facilities is made under Medicaid.
    (3) If the initial review of the complaint indicates substantial 
potential for criminal prosecution, the Unit will investigate the 
complaint or refer it to an appropriate criminal investigative or 
prosecutorial authority.
    (4) If the initial review does not indicate a substantial potential 
for criminal prosecution, the Unit will, if appropriate, refer the 
complaint to the proper Federal, State, or local agency.
    (c) If the Unit, in carrying out its duties and responsibilities 
under paragraphs (a) and (b) of this section, discovers that 
overpayments have been made to a health care facility or other 
provider, the Unit will either recover such overpayment as part of its 
resolution of a fraud case or refer the matter to the appropriate State 
agency for collection.
    (d) Where a prosecuting authority other than the Unit is to assume 
responsibility for the prosecution of a case investigated by the Unit, 
the Unit will ensure that those responsible for the prosecutorial 
decision and the preparation of the case for trial have the fullest 
possible opportunity to participate in the investigation from its 
inception and will provide all necessary assistance to the prosecuting 
authority throughout all resulting prosecutions.
    (e)(1) The Unit, if requested, will make available to OIG 
investigators and attorneys, or to other Federal investigators and 
prosecutors, all information in the Unit's possession concerning 
investigations or prosecutions conducted by the Unit.
    (2) The Unit will coordinate with OIG investigators and attorneys, 
or with other Federal investigators and prosecutors, on any Unit cases 
involving the same suspects or allegations that are also under 
investigation or prosecution by OIG or other Federal investigators or 
prosecutors.
    (3) The Unit will establish a practice of regular Unit meetings or 
communication with OIG investigators and Federal prosecutors.
    (4) When the Unit lacks the authority or resources to pursue a 
case, including for allegations of Medicare fraud and for civil false 
claims actions in a State without a civil false claims act or other 
State authority, the Unit will make appropriate referrals to OIG 
investigators and attorneys or other Federal investigators or 
prosecutors.
    (5) The Unit will establish written policy consistent with 
paragraphs (e)(1) through (4) of this section.
    (f) The Unit will guard the privacy rights of all beneficiaries and 
other individuals whose data is under the Unit's control and will 
provide adequate safeguards to protect sensitive information and data 
under the Unit's control.
    (g)(1) The Unit will transmit to OIG pertinent information on all 
convictions, including charging documents, plea agreements, and 
sentencing orders, for purposes of program exclusion under section 1128 
of the Act.
    (2) Convictions include those obtained either by Unit prosecutors 
or non-Unit prosecutors in any case investigated by the Unit.
    (3) Such information will be transmitted to OIG within 30 days of 
sentencing, or as soon as practicable if the Unit encounters delays in 
receiving the necessary information from the court.


Sec.  1007.13  Staffing requirements of Unit.

    (a) The Unit will employ sufficient professional, administrative, 
and support staff to carry out its duties and responsibilities in an 
effective and efficient manner.
    (b) The Unit will employ individuals from each of the following 
categories of professional employees, whose exclusive effort, as 
defined in Sec.  1007.1, is devoted to the work of the Unit:
    (1) One or more attorneys capable of prosecuting the Unit's health 
care fraud or criminal cases and capable of giving informed advice on 
applicable law and procedures and providing effective prosecution or 
liaison with other prosecutors;
    (2) One or more experienced auditors capable of reviewing financial 
records and advising or assisting in the investigation of alleged 
health care fraud and patient or resident abuse and neglect; and
    (3) One or more investigators capable of conducting investigations 
of health care fraud and patient or resident abuse and neglect matters, 
including a senior investigator who is capable of supervising and 
directing the investigative activities of the Unit.
    (c) The Unit will employ a director, as defined in Sec.  1007.1, 
who supervises all Unit employees.
    (d) Professional employees:
    (1) Will devote their exclusive effort to the work of the Unit, as 
defined in Sec.  1007.1 and except as provided in paragraphs (d)(2) and 
(3) of this section;
    (2) May be employed outside the Unit during nonduty hours, only if 
the employee is not:
    (i) Employed with a State agency (other than the Unit itself) or 
its contractors; or
    (ii) Employed with an entity whose mission poses a conflict of 
interest with Unit function and duties;
    (3) May perform non-Unit assignments for the State government only 
to the extent that such duties are limited in duration; and
    (4) Will be under the direction and supervision of the Unit 
director.
    (e) The Unit may employ administrative and support staff, such as

[[Page 10716]]

paralegals, information technology personnel, interns, and secretaries, 
who may be full-time or part-time employees and must report to the Unit 
director or other Unit supervisor.
    (f) The Unit will employ, or have available to it, individuals who 
are knowledgeable about the provision of medical assistance under Title 
XIX of the Act and about the operations of health care providers.
    (g)(1) The Unit may employ, or have available through consultant 
agreements or other contractual arrangements, individuals who have 
forensic or other specialized skills that support the investigation and 
prosecution of cases.
    (2) The Unit may not, through consultant agreements or other 
contractual arrangements, rely on individuals not employed directly by 
the Unit for the investigation or prosecution of cases.
    (h) The Unit will provide training for its professional employees 
for the purpose of establishing and maintaining proficiency in Medicaid 
fraud and patient or resident abuse and neglect matters.


Sec.  1007.15   Establishment and certification of Unit.

    (a) Initial application. In order to demonstrate that it meets the 
requirements for certification, the State or territory must submit to 
OIG an application approved by the Governor or chief executive, 
containing the following:
    (1) A description of the applicant's organization, structure, and 
location within State government, and a statement of whether it seeks 
certification under Sec.  1007.7(a), (b), or (c);
    (2) A statement from the State Attorney General that the applicant 
has authority to carry out the functions and responsibilities set forth 
in Subpart B. If the applicant seeks certification under Sec.  
1007.7(b), the statement must also specify either that:
    (i) There is no State agency with the authority to exercise 
statewide prosecuting authority for the violations with which the Unit 
is concerned, or
    (ii) Although the State Attorney General may have common law 
authority for statewide criminal prosecutions, he or she has not 
exercised that authority;
    (3) A copy of whatever memorandum of agreement, regulation, or 
other document sets forth the formal procedures required under Sec.  
1007.7(b), or the formal working relationship and procedures required 
under Sec.  1007.7(c);
    (4) A copy of the agreement with the Medicaid agency required under 
Sec. Sec.  1007.9 and 455.21(c);
    (5) A statement of the procedures to be followed in carrying out 
the functions and responsibilities of this part;
    (6) A proposed budget for the 12-month period for which 
certification is sought; and
    (7) Current and projected staffing, including the names, education, 
and experience of all senior professional employees already employed 
and job descriptions, with minimum qualifications, for all professional 
positions.
    (b) Basis for, and notification of, certification. (1) OIG will 
make a determination as to whether the initial application under 
paragraph (a) of this section meets the requirements of Sec. Sec.  
1007.5 through 1007.13 and whether a Unit will be effective in using 
its resources in investigating Medicaid fraud and patient or resident 
abuse and neglect.
    (2) OIG will certify a Unit only if OIG specifically approves the 
applicant's formal written procedures under Sec.  1007.7(b) or (c), if 
either of those provisions is applicable.
    (3) If the application is not approved, the applicant may submit a 
revised application at any time.
    (4) OIG will certify a Unit that meets the requirements of this 
Subpart B for 12 months.


Sec.  1007.17  Annual recertification of Unit.

    (a) Information required annually for recertification. To continue 
receiving payments under this part, a Unit must submit to OIG:
    (1) Reapplication for recertification. Reapplication is due at 
least 60 days prior to the expiration of the 12-month certification 
period. A reapplication must include:
    (i) A brief narrative that evaluates the Unit's performance, 
describes any specific problems it has had in connection with the 
procedures and agreements required under this part, and discusses any 
other matters that have impaired its effectiveness. The narrative 
should include any extended investigative authority approvals obtained 
pursuant to Sec.  1007.11(a)(2).
    (ii) For those Units approved to conduct data mining under Sec.  
1007.20, all costs expended by the Unit attributed to data mining 
activities; the amount of staff time devoted to data mining activities; 
the number of cases generated from those activities; the outcome and 
status of those cases, including the expected and actual monetary 
recoveries (both Federal and non-Federal share); and any other relevant 
indicia of return on investment from such activities.
    (iii) Information requested by OIG to assess compliance with this 
part and adherence to MFCU performance standards, including any 
significant changes in the information or documentation provided to OIG 
in the previous reporting period.
    (2) Statistical reporting. By November 30 of each year, the Unit 
will submit statistical reporting for the Federal fiscal year that 
ended on the prior September 30 containing the following statistics:
    (i) Unit staffing. The number of Unit employees, categorized by 
attorneys, investigators, auditors, and other employees, on board, and 
total number of approved Unit positions;
    (ii) Caseload. The number of open, new, and closed cases 
categorized by type of case and the number of open criminal and civil 
cases categorized by type of provider;
    (iii) Criminal case outcomes. The number of criminal convictions 
and indictments categorized by type of case and by type of provider; 
the number of acquittals, dismissals, referrals for prosecution, 
sentences, and other nonmonetary penalties categorized by type of case; 
and the amount of total ordered criminal recoveries categorized by type 
of provider; the amount of ordered Medicaid restitution, fines ordered, 
investigative costs ordered, and other monetary payment ordered 
categorized by type of case;
    (iv) Civil case outcomes. The number of civil settlements and 
judgments and recoveries categorized by type of provider; the number of 
global (coordinated among a group of States) civil settlements and 
successful judgments; the amount of global civil recoveries to the 
Medicaid program; the amount of other global civil monetary recoveries; 
the number of other civil cases opened, filed, or referred for filing; 
the number of other civil case settlements and successful judgments; 
the amount of other civil case recoveries to the Medicaid program; the 
amount of other monetary recoveries; and the number of other civil 
cases declined or closed without successful settlement or judgment;
    (v) Collections. The monies actually collected on criminal and 
civil cases categorized by type of case; and
    (vi) Referrals. The number of referrals received categorized by 
source of referral and type of case; the number of cases opened 
categorized by source of referral and type of case; and the number of 
referrals made to other agencies categorized by type of case.

[[Page 10717]]

    (b) Other information reviewed for recertification. In addition to 
reviewing information required at Sec.  1007.17(a), OIG will review, as 
appropriate, the following information when considering recertification 
of a Unit:
    (1) Information obtained through onsite reviews and
    (2) Other information OIG deems necessary or warranted.
    (c) Basis for recertification. In reviewing the information 
described at Sec.  1007.17(a) and (b), OIG will evaluate whether the 
Unit has demonstrated that it effectively carries out the functions and 
requirements described in section 1903(q) of the Act as implemented by 
this part. In making that determination, OIG will take into 
consideration the following factors:
    (1) Unit's compliance with this part and other Federal regulations, 
including those specified in Sec.  1007.23;
    (2) Unit's compliance with OIG policy transmittals;
    (3) Unit's adherence to MFCU performance standards as published in 
the Federal Register;
    (4) Unit's effectiveness in using its resources in investigating 
cases of possible fraud in the administration of the Medicaid program, 
the provision of medical assistance, or the activities of providers of 
medical assistance under the State Medicaid plan, and in prosecuting 
cases or cooperating with the prosecuting authorities; and
    (5) Unit's effectiveness in using its resources in reviewing and 
investigating, referring for investigation or prosecution, or 
criminally prosecuting complaints alleging abuse or neglect of patients 
or residents in health care facilities receiving payments under the 
State Medicaid plan and, at the Unit's option, in board and care 
facilities.
    (d) Notification. OIG will notify the Unit by the Unit's 
recertification date of approval or denial of the recertification 
reapplication.
    (1) Approval subject to conditions. OIG may impose special 
conditions or restrictions and may require corrective action, as 
provided in 45 CFR 75.207, before approving a reapplication for 
recertification.
    (2) Written explanation for denials. If the reapplication is 
denied, OIG will provide a written explanation of the findings on which 
the denial was based.
    (e) Reconsideration of denial of recertification. (1) A Unit may 
request that OIG reconsider a decision to deny recertification by 
providing written information contesting the findings on which the 
denial was based.
    (2) Within 30 days of receipt of the request for reconsideration, 
OIG will provide a final decision in writing, explaining its basis for 
approving or denying the reconsideration of recertification.

Subpart C--Federal Financial Participation (FFP)


Sec.  1007.19   FFP rate and eligible FFP costs.

    (a) Rate of FFP. (1) Subject to the limitation of this section, the 
Secretary of Health and Human Services must reimburse each State by an 
amount equal to 90 percent of the allowable costs incurred by a 
certified Unit during the first 12 quarters of operation that are 
attributable to carrying out its functions and responsibilities under 
this part. Each quarter of operation must be counted in determining 
when the Unit has accumulated 12 quarters of operation and is, 
therefore, no longer eligible for a 90-percent matching rate. Quarters 
of operation do not have to be consecutive to accumulate.
    (2) Beginning with the 13th quarter of operation, the Secretary 
must reimburse 75 percent of allowable costs incurred by a certified 
Unit.
    (b) Retroactive certification. OIG may grant certification 
retroactive to the date on which the Unit first met all the 
requirements of section 1903(q) of the Act and of this part. For any 
quarter with respect to which the Unit is certified, the Secretary will 
provide reimbursement for the entire quarter.
    (c) Total amount of FFP. FFP for any quarter must not exceed the 
higher of $125,000 or one-quarter of 1 percent of the sums expended by 
the Federal, State, and local governments during the previous quarter 
in carrying out the State Medicaid program.
    (d) Costs eligible for FFP. (1) FFP is allowable under this part 
for the expenditures attributable to the establishment and operation of 
the Unit, including the cost of training personnel employed by the Unit 
and efforts to increase referrals to the Unit through program outreach. 
Reimbursement is allowable only for costs attributable to the specific 
responsibilities and functions set forth in this part and if the Unit 
has been certified and recertified by OIG.
    (2) Establishment costs are limited to clearly identifiable costs 
of personnel that meet the requirements of Sec.  1007.13 of this part.
    (e) Costs not eligible for FFP. FFP is not allowable under this 
part for expenditures attributable to:
    (1) The investigation of cases involving program abuse or other 
failures to comply with applicable laws and regulations, if these cases 
do not involve substantial allegations or other indications of fraud, 
as described in Sec.  1007.11(a) of this part;
    (2) Routine verification with beneficiaries of whether services 
billed by providers were actually received, or, except as provided in 
Sec.  1007.20, efforts to identify situations in which a question of 
fraud may exist by the screening of claims and analysis of patterns and 
practice that involve data mining as defined in Sec.  1007.1.
    (3) The routine notification of providers that fraudulent claims 
may be punished under Federal or State law;
    (4) The performance of any audit or investigation, any professional 
legal function, or any criminal, civil or administrative prosecution of 
suspected providers by a person who does not meet the professional 
employee requirements in Sec.  1007.13(d);
    (5) The investigation or prosecution of fraud cases involving a 
beneficiary's eligibility for benefits, unless the suspected fraud 
cases also involve conspiracy with a provider;
    (6) Any payment, direct or indirect, from the Unit to the Medicaid 
agency, other than payments for the salaries of employees on detail to 
the Unit; or
    (7) Temporary duties performed by professional employees that are 
not required functions and responsibilities of the Unit, as described 
at Sec.  1007.13(d)(3).


Sec.  1007.20  Circumstances of permissible data mining.

    (a) Notwithstanding Sec.  1007.19(e)(2), a Unit may engage in data 
mining as defined in this part and receive FFP only under the following 
conditions:
    (1) The Unit identifies the methods of coordination between the 
Unit and the Medicaid agency, the individuals serving as primary points 
of contact for data mining, as well as the contact information, title, 
and office of such individuals;
    (2) Unit employees engaged in data mining receive specialized 
training in data mining techniques;
    (3) The Unit describes how it will comply with paragraphs (a)(1) 
and (2) of this section as part of the agreement required by Sec.  
1007.9(d); and
    (4) OIG, in consultation with CMS, approves in advance the 
provisions of the agreement as defined in paragraph (a)(3) of this 
section.
    (i) OIG will act on a request from a Unit for review and approval 
of the agreement within 90 days after receipt of a written request, or 
the request shall be considered approved if OIG fails to respond within 
90 days after receipt of the written request.
    (ii) If OIG requests additional information in writing, the 90-day

[[Page 10718]]

period for OIG action on the request begins on the day OIG receives the 
information from the Unit.
    (iii) The approval is for 3 years.
    (iv) A Unit may request renewal of its data-mining approval for 
additional 3-year periods by submitting a written request for renewal 
to OIG, along with an updated agreement with the Medicaid agency.


Sec.  1007.21  Disallowance of claims for FFP.

    (a) Notice of disallowance and of right to reconsideration. When 
OIG determines that a Unit's claim or portion of a claim for FFP is not 
allowable, OIG shall promptly send to the Unit notification that meets 
the requirements listed at 42 CFR 430.42(a).
    (b) Reconsideration of disallowance. (1) The Principal Deputy 
Inspector General will reconsider Unit disallowance determinations made 
by OIG.
    (2) To request a reconsideration from the Principal Deputy 
Inspector General, the Unit must follow the requirements in 42 CFR 
430.42(b)(2) and submit all required information to the Principal 
Deputy Inspector General. Copies should be sent via registered or 
certified mail to the Principal Deputy Inspector General.
    (3) The Unit may request to retain FFP during the reconsideration 
of the disallowance under section 1116(e) of the Act, in accordance 
with 42 CFR 433.38.
    (4) The Unit is not required to request reconsideration before 
seeking review from the Departmental Appeals Board.
    (5) The Unit may also seek reconsideration, and following the 
reconsideration decision, request a review from the Departmental 
Appeals Board.
    (6) If the Unit elects reconsideration, the reconsideration process 
must be completed or withdrawn before requesting review by the 
Departmental Appeals Board.
    (c) Procedures for reconsideration of a disallowance. (1) Within 60 
days after receipt of the disallowance letter, the Unit shall, in 
accordance with paragraph (b)(2) of this section, submit in writing to 
the Principal Deputy Inspector General any relevant evidence, 
documentation, or explanation.
    (2) After consideration of the policies and factual matters 
pertinent to the issues in question, the Principal Deputy Inspector 
General shall, within 60 days from the date of receipt of the request 
for reconsideration, issue a written decision or a request for 
additional information as described in paragraph (c)(3) of this 
section.
    (3) At the Principal Deputy Inspector General's option, OIG may 
request from the Unit any additional information or documents necessary 
to make a decision. The request for additional information must be sent 
via registered or certified mail to establish the date the request was 
sent by OIG and received by the Unit.
    (4) Within 30 days after receipt of the request for additional 
information, the Unit must submit to the Principal Deputy Inspector 
General all requested documents and materials.
    (i) If the Principal Deputy Inspector General finds that the 
materials are not in readily reviewable form or that additional 
information is needed, he or she shall notify the Unit via registered 
or certified mail that it has 15 business days from the date of receipt 
of the notice to submit the readily reviewable or additional materials.
    (ii) If the Unit does not provide the necessary materials within 15 
business days from the date of receipt of such notice, the Principal 
Deputy Inspector General shall affirm the disallowance in a final 
reconsideration decision issued within 15 days from the due date of 
additional information from the Unit.
    (5) If additional documentation is provided in readily reviewable 
form under paragraph (c)(4) of this section, the Principal Deputy 
Inspector General shall issue a written decision within 60 days from 
the due date of such information.
    (6) The final written decision shall constitute final OIG 
administrative action on the reconsideration and shall be (within 15 
business days of the decision) mailed to the Unit via registered or 
certified mail to establish the date the reconsideration decision was 
received by the Unit.
    (7) If the Principal Deputy Inspector General does not issue a 
decision within 60 days from the date of receipt of the request for 
reconsideration or the date of receipt of the requested additional 
information, the disallowance shall be deemed to be affirmed.
    (8) No section of this regulation shall be interpreted as waiving 
OIG's right to assert any provision or exemption under the Freedom of 
Information Act.
    (d) Withdrawal of a request for reconsideration of a disallowance. 
(1) A Unit may withdraw the request for reconsideration at any time 
before the notice of the reconsideration decision is received by the 
Unit without affecting its right to submit a notice of appeal to the 
Departmental Appeals Board. The request for withdrawal must be in 
writing and sent to the Principal Deputy Inspector General via 
registered or certified mail.
    (2) Within 60 days after OIG's receipt of a Unit's withdrawal 
request, a Unit may, in accordance with (f)(2) of this section, submit 
a notice of appeal to the Departmental Appeals Board.
    (e) Implementation of decisions for reconsideration of a 
disallowance. (1) After undertaking a reconsideration, the Principal 
Deputy Inspector General may affirm, reverse, or revise the 
disallowance and shall issue a final written reconsideration decision 
to the Unit in accordance with paragraphs (c)(4) and (5) of this 
section.
    (2) If the reconsideration decision requires an adjustment of FFP, 
either upward or downward, a subsequent grant action will be made in 
the amount of such increase or decrease.
    (3) Within 60 days after receipt of a reconsideration decision from 
OIG, a Unit may, in accordance with paragraph (f) of this section, 
submit a notice of appeal to the Departmental Appeals Board.
    (f) Appeal of disallowance. (1) The Departmental Appeals Board 
reviews disallowances of FFP under Title XIX of the Act, including 
disallowances issued by OIG to the Units.
    (2) A Unit that wishes to appeal a disallowance to the Departmental 
Appeals Board must follow the requirements in 42 CFR 430.42(f)(2).
    (3) The appeals procedures are those set forth in 45 CFR part 16 
for Medicaid and for many other programs, including the Units, 
administered by the Department.
    (4) The Departmental Appeals Board may affirm the disallowance, 
reverse the disallowance, modify the disallowance, or remand the 
disallowance to OIG for further consideration.
    (5) The Departmental Appeals Board will issue a final written 
decision to the Unit consistent with 45 CFR part 16.
    (6) If the appeal decision requires an adjustment of FFP, either 
upward or downward, a subsequent grant action will be made in the 
amount of such increase or decrease.

Subpart D--Other Provisions


Sec.  1007.23   Other applicable HHS regulations.

    The following regulations from 45 CFR, subtitle A, apply to grants 
under this part:
    (a) Part 16--Procedures of the Departmental Grant Appeals Board.
    (b) Part 75--Uniform Administrative Requirements, Cost Principles, 
and Audit Requirements for HHS Awards.
    (c) Part 80--Nondiscrimination under Programs Receiving Federal 
Assistance through HHS, Effectuation of Title VI of the Civil Rights 
Act of 1964.

[[Page 10719]]

    (d) Part 81--Practice and Procedure for Hearings under 45 CFR part 
80.
    (e) Part 84--Nondiscrimination on the Basis of Handicap in Programs 
and Activities Receiving Federal Financial Assistance.
    (f) Part 91--Nondiscrimination on the Basis of Age in Programs or 
Activities Receiving Federal Financial Assistance from HHS.

Daniel R. Levinson,
Inspector General.
    Approved: February 1, 2019.
Alex M. Azar II,
Secretary.
[FR Doc. 2019-05362 Filed 3-21-19; 8:45 am]
 BILLING CODE 4152-01-P