Performance Standards for Medicaid Fraud Control Units, 76431-76434 [2024-20416]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES
• Office of Inspector General

[Federal Register Volume 89, Number 181 (Wednesday, September 18, 2024)]
[Rules and Regulations]
[Pages 76431-76434]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-20416]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of Inspector General

42 CFR Part 1007


Performance Standards for Medicaid Fraud Control Units

AGENCY: Office of Inspector General (OIG), Department of Health and 
Human Services (HHS).

ACTION: Notice of final revised performance standards.

-----------------------------------------------------------------------

SUMMARY: This document sets forth OIG guidance regarding standards OIG 
will apply in assessing the performance of Medicaid Fraud Control Units 
(MFCUs or Units). Based on its experience in overseeing MFCUs, and 
after consultation with key stakeholders, OIG is revising the 
standards. These standards replace and supersede standards published on 
June 1, 2012.

DATES: Effective Date: These standards are effective upon publication.

FOR FURTHER INFORMATION CONTACT: Susan Burbach, OIG Office of 
Evaluation and Inspections, 202-731-8516, [email protected].

SUPPLEMENTARY INFORMATION:

I. Background

    The mission of MFCUs is to investigate and prosecute (or refer for 
prosecution): (1) fraud committed by Medicaid providers, (2) fraud in 
the administration of the Medicaid program, and (3) patient abuse or 
neglect of residents in health care facilities and board and care 
facilities and of Medicaid enrollees in noninstitutional or other 
settings. MFCUs receive most of their funding from the Federal 
Government, and each MFCU operates as ``a single, identifiable entity 
of State government.'' Each of the 50 States has a MFCU, as well as the 
District of Columbia, Puerto Rico, and the U.S. Virgin Islands. Except 
for four States, each MFCU is organized as part of the State Attorney 
General's office.
    HHS-OIG has been delegated authority under sections 1903(q) and 
1903(a)(6) of the Social Security Act (the Act) to certify and annually 
recertify Units as eligible for Federal financial participation (FFP), 
and to reimburse States for costs incurred in operating a MFCU. Through 
the certification and recertification process, OIG ensures that the 
Units meet the requirements for FFP set forth in section 1903(q) of the 
Act and in Federal regulations found at 42 CFR part 1007. As part of 
this process, OIG applies a series of performance standards, as 
required by section

[[Page 76432]]

1902(a)(61) of the Act, in determining the effectiveness of Units in 
carrying out required MFCU functions. The standards provide helpful 
guidance to MFCUs in their operations and assist OIG in its 
recertification process and periodic reviews of MFCUs. If OIG 
determines there are opportunities for a Unit to improve its adherence 
to the standards, OIG will work with the Unit to implement changes or 
may impose and monitor formal recommendations for improvement.
    The standards reflect practices identified both by OIG and MFCUs 
that will improve MFCU effectiveness in fulfilling their oversight 
mission. OIG's goal, both with these standards and with OIG's other 
oversight activities, is to support each Unit in maximizing its 
effectiveness in fighting Medicaid fraud and protecting enrollees and 
other facility residents. We encourage Units to implement these 
standards in light of each State's organization and practices and to 
identify additional best practices that will improve their 
effectiveness.
    OIG initially published the MFCU performance standards in 1994 (see 
59 FR 49080, September 26, 1994) and revised the standards in 2012 (see 
77 FR 32645, June 1, 2012). Based on its experience in overseeing 
MFCUs, OIG has updated the standards. The updated standards were 
developed in consultation with the National Association of Medicaid 
Fraud Control Units. OIG welcomes stakeholder feedback on the standards 
and may consider future revisions in response to feedback.

II. Standards for Assessing MFCU Performance

Performance Standard 1--Compliance With Requirements

    A Unit conforms with applicable statutes, regulations, and policy 
directives, including:
    A. Section 1903(q) of the Social Security Act, containing the basic 
requirements for operation of a MFCU;
    B. Regulations for operation of a MFCU contained in 42 CFR part 
1007;
    C. Federal administrative requirements, cost principles, and audit 
requirements referenced in the notice of grant award terms and 
conditions;
    D. Applicable State and Federal requirements and standards 
pertaining to information security as described in Standard 7F;
    E. OIG policy transmittals as maintained on the OIG website; and
    F. Terms and conditions of the notice of the grant award as 
maintained on the OIG website.

Performance Standard 2--Staffing

    A Unit maintains reasonable staff levels and office locations in 
relation to the State's Medicaid program expenditures and has a salary 
and benefit package that allows the Unit to recruit and retain 
qualified staff. To determine whether a Unit meets this standard, OIG 
will consider the following performance indicators:
    A. The Unit seeks to employ a total number of professional staff 
that is commensurate with the State's total Medicaid program 
expenditures and that enables the Unit to effectively investigate and 
prosecute (or refer for prosecution) an appropriate volume of case 
referrals and workload for both Medicaid fraud and abuse or neglect of 
patients or residents.
    B. The Unit employs an appropriate mix and number of attorneys, 
auditors, investigators, and other professional staff that is 
commensurate with the State's total Medicaid program expenditures and 
that allows the Unit to effectively investigate and prosecute (or refer 
for prosecution) an appropriate volume of case referrals and workload 
for both Medicaid fraud and abuse or neglect of patients or residents.
    C. The Unit, when warranted for the number of employees, designates 
one or more supervisory staff, such as senior investigators, to 
supervise the activities of individual investigators or other 
employees.
    D. The Unit employs a number of administrative staff in relation to 
its overall size that allows the Unit to operate effectively.
    E. The Unit, consistent with State requirements, offers a 
competitive salary and benefits package that permits the Unit to 
recruit and retain qualified professional staff in the region where the 
Unit operates.
    F. To the extent that a Unit maintains multiple office locations, 
such locations are distributed throughout the State and are adequately 
staffed, commensurate with the volume of case referrals and workload 
for each location.

Performance Standard 3--Policies and Procedures

    A Unit establishes written policies and procedures for its 
operations and ensures that staff are familiar with, and adhere to, 
policies and procedures. To determine whether a Unit meets this 
standard, OIG will consider the following performance indicators:
    A. The Unit has written guidelines or manuals that contain current 
policies and procedures, consistent with these performance standards 
and any applicable laws, regulations, and policy transmittals, for the 
investigation and (for those Units with prosecutorial authority) 
prosecution of Medicaid fraud and abuse and neglect of patients or 
residents.
    B. The Unit adheres to current policies and procedures in its 
operations.
    C. The Unit periodically reviews and updates its policies and 
procedures and creates and implements new policies and procedures as 
appropriate.
    D. Policies and procedures also address, at a minimum, the 
following:
    1. A timeframe for conducting periodic supervisory case reviews 
(see Standard 5C);
    2. A process for referring cases, when appropriate, to Federal and 
State agencies;
    3. Training standards for Unit employees;
    4. A policy to ensure collaboration with Federal partners as 
required by 42 CFR 1007.11(e)(5); and
    5. For those Units with sworn law enforcement agents, policies and 
procedures to address the exercise of the Unit's law enforcement 
authorities.
    E. Written guidelines and manuals are readily available to all Unit 
staff, either electronically or in hard copy.

Performance Standard 4--Maintaining Adequate Referrals

    A Unit takes steps to maintain an adequate volume and quality of 
referrals from the State Medicaid agency and other sources. To 
determine whether a Unit meets this standard, OIG will consider the 
following performance indicators:
    A. The Unit takes steps to ensure that the State Medicaid agency, 
managed care organizations, and other pertinent entities refer to the 
Unit suspected provider fraud. Steps to ensure referrals may include 
having consistent communication and meetings with referring entities, 
providing feedback on the quality and volume of referrals, and training 
on the characteristics of an effective referral.
    B. The Unit, unless prohibited by law, provides timely information 
to the referring entity when the entity requests information on the 
status of MFCU investigations, including when the Medicaid agency 
requests quarterly certification pursuant to 42 CFR 455.23(d)(3)(ii).
    C. The Unit takes steps to encourage pertinent entities to refer 
complaints of patient or resident abuse or neglect to the Unit. 
Pertinent entities may include licensing and certification agencies, 
the State Long-Term Care Ombudsman, and adult protective services 
offices.

[[Page 76433]]

    D. The Unit takes steps through public outreach or other means to 
encourage the public to make referrals to the Unit.

Performance Standard 5--Maintaining Case Progression

    A Unit takes steps to maintain reasonable case progression and to 
complete cases within an appropriate timeframe based on the complexity 
of the cases. To determine whether a Unit meets this standard, OIG will 
consider the following performance indicators:
    A. Each stage of an investigation and prosecution is completed 
within an appropriate timeframe.
    B. Supervisors document the approval to open and close all 
investigations in the case files or electronic case management system.
    C. Supervisors conduct periodic case reviews, consistent with a 
specific timeframe established in the Unit's policies and procedures. 
Case reviews include a review of case progress and ensure that staff 
complete each stage of an investigation and prosecution within an 
appropriate timeframe. The Unit maintains a record of these reviews in 
the case files or electronic case management system.
    D. Significant delays to cases are documented and explained in the 
case files or electronic case management system.
    E. The Unit pursues, when warranted for the case, the availability 
and use of appropriate technology, such as digital forensics, 
surveillance technology, and data analytics.
    F. Unit staff are issued, or have appropriate access to, electronic 
devices and other technology to effectively perform their duties.

Performance Standard 6--Case Mix

    A Unit's case mix, as practicable, covers all significant provider 
types and includes a balance of cases involving fraud and abuse or 
neglect of patients or residents. To determine whether a Unit meets 
this standard, OIG will consider the following performance indicators:
    A. The Unit seeks to have a broad mix of cases among the 
significant provider types in the State and seeks to allocate resources 
among provider types based on levels of Medicaid expenditures or other 
objective measures of risk.
    B. For those States that cover a significant number of Medicaid 
enrollees under managed care plans, the Unit investigates an 
appropriate number of cases arising in a managed care setting in its 
mix of cases.
    C. The Unit investigates a balance of cases of fraud and cases of 
abuse or neglect of patients or residents, for those Units with the 
responsibility and jurisdiction to investigate or prosecute abuse or 
neglect of patients or residents.

Performance Standard 7--Maintaining Case Information

    A Unit maintains case files in an effective manner and uses an 
electronic case management system that allows efficient access to case 
information and other performance data. To determine whether a Unit 
meets this standard, OIG will consider the following performance 
indicators:
    A. The Unit has an electronic case management system that manages 
and tracks case information from initiation to resolution.
    B. Case file documentation is included within the Unit's electronic 
case management system unless particular circumstances (e.g., space 
limitations or security concerns) require the selective use of another 
storage system.
    C. Case files or the electronic case management system include all 
relevant information, including investigative reports and data 
analyses.
    D. Significant litigation documents, such as charging documents, 
judgments, and settlement agreements, are included in the case files.
    E. Investigative reports, consistent with the Unit's policies and 
procedures, address all relevant aspects of the investigation and are 
accurate, clear, complete, concise, logically organized, timely, and 
objective.
    F. The Unit's electronic case management system ensures the 
protection of sensitive data, case information, and confidential 
sources.
    1. The Unit's information system, including the electronic case 
management system, complies with applicable State requirements 
pertaining to information security and breach reporting and with 
current cybersecurity standards and guidelines as maintained in either: 
(a) the applicable version of the U.S. Department of Justice FBI 
Criminal Justice Information Services Division (CJISD) ``Security 
Policy,'' CJISD-ITS-DOC-08140-5.9, or (b) the applicable version of the 
National Institute of Standards and Technology (NIST), special 
publication, ``Security and Privacy Controls for Information Systems 
and Organizations,'' NIST SP 800-53.
    2. The Unit maintains documentation of its compliance with policies 
identified in subsection F1.
    3. Any audits, reviews, or risk assessments of the Unit's 
information system are shared with OIG as a part of the Unit's annual 
recertification submission.
    4. Any known security breaches are reported within 30 days of 
discovering the incident to the OIG Information Systems Security 
Officer, [email protected].
    G. The Unit's electronic case management system allows for 
monitoring cases and for monitoring and reporting case outcome data to 
OIG as specified in 42 CFR 1007.17(a)(2).
    H. The Unit stores nondocumentary evidence securely and records the 
evidence in an effective and accessible system.

Performance Standard 8--Cooperation With Federal and Other State 
Authorities on Fraud Cases

    A Unit cooperates with OIG and other Federal and State agencies in 
the investigation and prosecution of Medicaid and other health care 
fraud. To determine whether a Unit meets this standard, OIG will 
consider the following performance indicators:
    A. The Unit communicates on a regular basis with OIG and other 
Federal or State agencies investigating or prosecuting health care 
fraud in the State.
    B. For criminal or civil cases that are regional or national in 
scope, the Unit collaborates with Federal agencies and other State 
MFCUs as appropriate.
    C. The Unit cooperates and, as appropriate, coordinates with OIG's 
Office of Investigations and other Federal agencies on cases being 
pursued jointly, cases involving the same suspects or allegations, and 
cases that have been referred to the Unit by OIG or another Federal 
agency.
    D. The Unit makes available, to the extent authorized by law and 
upon request by Federal investigators and prosecutors, all information 
in its possession concerning provider fraud or fraud in the 
administration of the Medicaid program.
    E. For cases that require the granting of extended authority under 
42 CFR 1007.11(a)(2) to investigate Medicare or other Federal health 
care fraud, the Unit seeks approval from the OIG regional Special Agent 
in Charge following procedures set by OIG or other relevant Federal 
Inspectors General under procedures set by those agencies.
    F. For cases that have civil fraud potential, the Unit investigates 
and prosecutes such cases under State authority or refers such cases to 
OIG or the U.S. Department of Justice.
    G. The Unit transmits to OIG, for purposes of program exclusions 
under section 1128 of the Social Security Act, all pertinent 
information on MFCU convictions, including joint cases. Pertinent 
information includes

[[Page 76434]]

judgments of conviction, charging documents, plea agreements, and 
sentencing orders. Information will be provided within 30 days of 
sentencing, or as soon as practicable if the Unit encounters delays in 
receiving the necessary information from the court, as required by 42 
CFR 1007.11(g)(3).
    H. The Unit reports qualifying cases, as defined by 45 CFR 60.5, to 
the National Practitioner Data Bank, or successor data bases, within 30 
days of sentencing or other reportable action.

Performance Standard 9--Program Recommendations

    A Unit makes statutory or programmatic recommendations, when 
warranted and appropriate, to the State government. To determine 
whether a Unit meets this standard, OIG will consider the following 
performance indicators:
    A. The Unit, when warranted and appropriate, makes statutory 
recommendations to the State legislature to improve the operation or 
effectiveness of the Unit, including amendments to the enforcement 
provisions of the State code.
    B. The Unit, when warranted and appropriate, makes other regulatory 
or administrative recommendations regarding program integrity issues to 
the State Medicaid agency and to other agencies responsible for 
Medicaid operations or funding.
    C. The Unit monitors and maintains records regarding actions taken 
by the State legislature and the State Medicaid agency or other 
agencies in response to Unit recommendations.

Performance Standard 10--Agreement With Medicaid Agency

    A Unit periodically reviews its memorandum of understanding (MOU) 
with the State Medicaid agency to ensure that the MOU reflects current 
practice, policy, and legal requirements. To determine whether a Unit 
meets this standard, OIG will consider the following performance 
indicators:
    A. The MOU complies with Federal regulations contained in 42 CFR 
1007.9(d), ``Relationship and agreement between Unit and Medicaid 
agency,'' including: (1) an agreement for regularly scheduled meetings 
or communication with the Medicaid agency (and procedures for how the 
two agencies will coordinate their efforts), (2) procedures (as 
applicable) for managed care referrals as required by 42 CFR 
438.608(a)(7), (3) a requirement that the Unit reviews the MOU at least 
every 5 years, and (4) an agreement that the Unit renegotiates the MOU 
as necessary to ensure that it addresses current law and practice.
    B. The MOU meets other current Federal legal requirements as 
contained in law or regulation, including 42 CFR 455.21, ``Cooperation 
with State Medicaid fraud control units,'' and 42 CFR 455.23, 
``Suspension of payments in cases of fraud.''
    C. The MOU is consistent with current Federal and State policy, 
including any policies issued by OIG or the Centers for Medicare & 
Medicaid Services (CMS).
    D. Consistent with Performance Standard 4, the MOU establishes a 
process to encourage the receipt of an adequate volume and quality of 
referrals to the Unit from the State Medicaid agency and, as 
applicable, from managed care organizations.
    E. The MOU incorporates by reference CMS's ``Performance Standard 
for Referrals of Suspected Fraud from a Single State Agency to a 
Medicaid Fraud Control Unit.''
    F. Consistent with 42 CFR 1007.11(c), the MOU specifies that 
overpayments will be referred to the State agency when the Unit is 
unable to recover such overpayments as a part of a fraud action.

Performance Standard 11--Fiscal Control

    A Unit exercises proper fiscal control over Unit resources. To 
determine whether a Unit meets this standard, OIG will consider the 
following performance indicators:
    A. The Unit promptly submits to OIG its preliminary budget 
estimates, proposed budget application, and Federal financial 
expenditure reports.
    B. The Unit limits its requests for grant funding, including its 
requested staffing levels, to operational amounts and staffing levels 
that it reasonably expects to fulfill in the upcoming fiscal period.
    C. The Unit makes reasonable efforts to employ the number of staff 
that is included in the Unit's budget application request as approved 
by OIG.
    D. The Unit maintains a property inventory that is updated 
regularly to reflect all equipment (as defined under 2 CFR 200.1) under 
the Unit's control and includes all property that may contain 
personally identifiable information or sensitive information or may be 
a potential security concern, such as computing devices, weapons, and 
investigative tools (e.g., surveillance video or audio equipment).
    E. The Unit maintains an effective time and attendance system and 
personnel activity records.
    F. The Unit applies generally accepted accounting principles in its 
control of Unit funding.
    G. The Unit employs a financial system in compliance with the 
standards for financial management systems contained in Federal grant 
administration requirements.

Performance Standard 12--Training

    A Unit conducts training that aids the mission of the Unit. To 
determine whether a Unit meets this standard, OIG will consider the 
following performance indicators:
    A. The Unit maintains a training plan for each professional 
discipline that includes an annual minimum number of training hours and 
that is at least as stringent as required for professional 
certification.
    B. The Unit ensures that professional staff comply with their 
training plans and maintains records of completed training.
    C. Professional certifications are maintained for all staff, 
including those that fulfill continuing education requirements.
    D. The Unit participates in MFCU-related training, including 
training offered by OIG, other MFCUs, and other relevant organizations, 
as such training is available and as funding permits.
    E. The Unit participates in cross-training with the fraud detection 
staff of the State Medicaid agency. As part of such training, Unit 
staff provide training on the elements of successful fraud referrals 
and receive training on the role and responsibilities of the State 
Medicaid agency. Unit training of Medicaid staff should be supplemented 
as appropriate with training for staff of managed care special 
investigations units.

Christi A. Grimm,
Inspector General.
[FR Doc. 2024-20416 Filed 9-17-24; 8:45 am]
BILLING CODE P