Current through Register Vol. 46, No. 39, September 25, 2024
(a)
General. Required providers shall, as a condition of receiving payment under
the MA program, adopt, implement, and maintain an effective compliance program
which satisfies the requirements of this SubPart. The required provider's
compliance program may be a component of more comprehensive compliance
activities by the required provider so long as the requirements of this SubPart
are met. Required providers must implement and maintain a compliance program,
adopted pursuant to this SubPart, for the entire period that the person meets
the definition of being a required provider.
(b) Record retention. A required provider
shall retain all records demonstrating that it has adopted, implemented and
operated an effective compliance program and has satisfied the requirements of
this SubPart. The required provider shall make available to the department,
OMIG, or MFCU upon request, copies of such records. Records shall be retained:
(1) by required providers for a period not
less than six (6) years from the date such program was implemented, or any
amendments thereto, were made; or
(2) by MMCOs in accordance with the retention
periods specified in their contract with the department to participate as
MMCOs.
(c) Contractors,
agents, subcontractors, and independent contractors.
(1) Contractors, agents, subcontractors, and
independent contractors are hereinafter referred to collectively, unless
otherwise noted, as "contractor" or "contractors".
(2) The required provider shall ensure that
contracts with contractors specify that the contractors are subject to the
required provider's compliance program, to the extent that such contractors are
affected by the required provider's risk areas and only within the scope of the
contracted authority and affected risk areas.
(3) The required provider shall ensure that
such contracts include termination provisions for failure to adhere to the
required provider's compliance program requirements.
(4) The required provider is ultimately
responsible for the adoption, implementation, maintenance, enforcement, and
effectiveness of its compliance program.
(d) Risk areas. The compliance program shall
apply to the required provider's risk areas, which are those areas of operation
affected by the compliance program and shall apply to:
(1) billings;
(2) payments;
(3) ordered services;
(4) medical necessity;
(5) quality of care;
(6) governance;
(7) mandatory reporting;
(8) credentialing;
(9) contractor, subcontractor, agent or
independent contract oversight;
(10) other risk areas that are or should
reasonably be identified by the provider through its organizational experience;
and
(11) for MMCOs, in addition to
paragraphs (1) - (10) of this subdivision, the following risk areas:
(i) compliance with terms of the MMCO's
contract with the department to participate as an MMCO;
(ii) cost reporting;
(iii) submission of encounter data to the
department;
(iv) network adequacy
and contracting;
(v) provider and
subcontractor oversight;
(vi)
underutilization;
(vii)
marketing;
(viii) provision of
medically necessary services;
(ix)
payments and claims processing; and
(x) statistically valid service
verification.
(e) The required provider shall comply with
all directives of the department or OMIG with respect to the adoption,
implementation and maintenance of compliance programs required by this
SubPart.
(f) Certification.
(1) Required providers shall certify to the
department upon enrollment and annually thereafter, using a form and manner
required by OMIG and the department, that the required provider has met the
requirements of section 363-d of
the Social Services Law and this SubPart.
(2) Participating providers that are also
required providers pursuant to this SubPart shall provide a copy of the
certification, required under the preceding paragraph, to each MMCO for which
they are a participating provider upon signing the provider agreement with the
MMCO, and annually thereafter. MMCOs shall maintain a method for submitting
such certification on the MMCO's website, which may include a dedicated email
address, and shall retain such certification in accordance with the
requirements of subdivision (b) of this section.
(g) Report, return and explain. Required
providers shall comply with the requirements of SubPart 521-3 of this Part to
report, return and explain overpayments.
