N.Y. Social Services Law § 363-d: Provider compliance program

§ 363-d. Provider compliance program. 1. The legislature finds that

medical assistance providers may be able to detect and correct payment

and billing mistakes and fraud if required to develop and implement

compliance programs. It is the purpose of such programs to organize

provider resources to resolve payment discrepancies and detect

inaccurate billings, among other things, as quickly and efficiently as

possible, and to impose systemic checks and balances to prevent future

recurrences. The legislature accordingly declares that it is in the

public interest that providers within the medical assistance program

implement compliance programs. The legislature also recognizes the wide

variety of provider types in the medical assistance program and the need

for compliance programs that reflect a provider's size, complexity,

resources, and culture. For a compliance program to be effective, it

must be designed to be compatible with the provider's characteristics.

At the same time, however, the legislature determines that there are key

components that must be included in every compliance program and such

components should be required if a provider is to be a medical

assistance program participant. Accordingly, the provisions of this

section require providers to adopt effective compliance program

elements, and make each provider responsible for implementing such a

program appropriate to its characteristics.

2. Every provider of medical assistance program items and services

that is subject to subdivision four of this section shall adopt and

implement a compliance program. The office of Medicaid inspector general

shall create and make available on its website guidelines, which may

include a model compliance program, that reflect the requirements of

this section. Such compliance programs shall meet the requirements

included in this subdivision as a condition of payment from the medical

assistance program. The compliance program required pursuant to this

section may be a component of more comprehensive compliance activities

by the medical assistance provider so long as the requirements of this

section are met. Every provider shall adopt and implement an effective

compliance program, which shall include measures that prevent, detect,

and correct non-compliance with medical assistance program requirements

as well as measures that prevent, detect, and correct fraud, waste, and

abuse. The compliance program shall include the following requirements:

(a) Written policies, procedures, and standards of conduct that:

(1) articulate the organization's commitment to comply with all

applicable federal and state standards;

(2) describe compliance expectations as embodied in the standards of

conduct;

(3) implement the operation of the compliance program;

(4) provide guidance to employees and others on dealing with potential

compliance issues;

(5) identify how to communicate compliance issues to appropriate

compliance personnel;

(6) describe how potential compliance issues are investigated and

resolved by the organization;

(7) include a policy of non-intimidation and non-retaliation for good

faith participation in the compliance program, including but not limited

to reporting potential issues, investigating issues, conducting

self-evaluations, audits and remedial actions, and reporting to

appropriate officials; and

(8) all requirements listed under 42 U.S.C.1396-a(a)(68).

(b) Designation of a compliance officer and a compliance committee who

report directly and are accountable to the organization's chief

executive or other senior management.

(c)(1) Each provider shall establish and implement effective training

and education for its compliance officer and organization employees, the

chief executive and other senior administrators, managers and governing

body members.

(2) Such training and education shall occur at a minimum annually and

shall be made a part of the orientation for a new employee and new

appointment of a chief executive, manager, or governing body member.

(d) Establishment and implementation of effective lines of

communication, ensuring confidentiality, between the compliance officer,

members of the compliance committee, the organization's employees,

managers and governing body, and the organizations first tier,

downstream, and related entities. Such lines of communication shall be

accessible to all and allow compliance issues to be reported including a

method for anonymous and confidential good faith reporting of potential

compliance issues as they are identified.

(e) Well-publicized disciplinary standards through the implementation

of procedures which encourage good faith participation in the compliance

program by all affected individuals.

(f) Establishment and implementation of an effective system for

routine monitoring and identification of compliance risks. The system

should include internal monitoring and audits and, as appropriate,

external audits, to evaluate the organization's compliance with the

medical assistance program requirements and the overall effectiveness of

the compliance program.

(g) Establishment and implementation of procedures and a system for

promptly responding to compliance issues as they are raised,

investigating potential compliance problems as identified in the course

of self-evaluations and audits, correcting such problems promptly and

thoroughly to reduce the potential for recurrence, and ensure ongoing

compliance with the medical assistance programs requirements.

3. Upon enrollment in the medical assistance program, a provider shall

certify to the department that the provider satisfactorily meets the

requirements of this section. Additionally, the commissioner of health

and Medicaid inspector general shall have the authority to determine at

any time if a provider has a compliance program that satisfactorily

meets the requirements of this section.

(a) A compliance program that is accepted by the federal department of

health and human services office of inspector general and remains in

compliance with the standards promulgated by such office shall be deemed

in compliance with the provisions of this section, so long as such plans

adequately address medical assistance program risk areas and compliance

issues.

(b) A compliance program that meets Federal requirements for managed

care provider compliance programs, as specified in the contract or

contracts between the department and the Medicaid managed care provider

shall be deemed in compliance with the provisions in this section, so

long as such programs adequately address medical assistance program risk

areas and compliance issues. For purposes of this section, a managed

care provider is as defined in paragraph (c) of subdivision one of

section three hundred sixty-four-j of this chapter, and includes managed

long term care plans.

(c) In the event that the commissioner of health or the Medicaid

inspector general finds that the provider does not have a satisfactory

program within ninety days after the effective date of the regulations

issued pursuant to subdivision four of this section, the provider may be

subject to any sanctions or penalties permitted by federal or state laws

and regulations, including revocation of the provider's agreement to

participate in the medical assistance program.

(d)(1) In the first instance of the Medicaid inspector general's

determination that the provider, including a Medicaid managed care

provider, that has failed to adopt and implement a compliance program

which satisfactorily meets the requirements of this section, the

Medicaid inspector general may impose a monetary penalty of five

thousand dollars per calendar month, for a maximum of twelve calendar

months against a provider, including Medicaid managed care providers.

(2) The Medicaid inspector general may impose a monetary penalty of up

to ten thousand dollars per calendar month, for a maximum of twelve

calendar months against a provider, including a Medicaid managed care

provider, that has failed to adopt and implement a compliance program

which satisfactorily meets the requirements of this section, if a

penalty was previously imposed under subparagraph one of this paragraph

within the previous five years.

(e) A provider, including a Medicaid managed care provider, against

whom a monetary penalty is imposed pursuant to paragraph (d) of this

subdivision shall be entitled to notice and an opportunity to be heard,

including the right to request a hearing pursuant to section twenty-two

of this chapter.

4. Providers that shall be subject to the provisions of this section

include, but are not limited to:

(a) those subject to the provisions of articles twenty-eight and

thirty-six of the public health law;

(b) those subject to the provisions of articles sixteen and thirty-one

of the mental hygiene law;

(c) notwithstanding the provisions of section forty-four hundred

fourteen of the public health law, managed care providers, as defined in

section three hundred sixty-four-j of this title and includes managed

long-term care plans; and

(d) other providers of care, services and supplies under the medical

assistance program for which the medical assistance program is a

substantial portion of their business operations.

5. (a) The Medicaid inspector general, in consultation with the

department of health, shall promulgate any regulations necessary to

implement this section.

(b) The Medicaid inspector general shall accept programs and processes

implemented pursuant to section forty-four hundred fourteen of the

public health law as satisfying the obligations of this section and the

regulations promulgated thereunder when such programs and processes

incorporate the objectives contemplated by this section.

6. (a) If a person has received an overpayment under the medical

assistance program, the person shall:

(1) report and return the overpayment to the department; and

(2) notify the Medicaid inspector general in writing of the reason for

the overpayment.

(b) An overpayment shall be reported and returned under paragraph (a)

of this subdivision by the later of: (1) the date which is sixty days

after the date on which the overpayment was identified; or (2) the date

any corresponding cost report is due, if applicable. A person has

identified an overpayment when the person has or should have through the

exercise of reasonable diligence, determined that the person has

received an overpayment and quantified the amount of the overpayment. A

person should have determined that the person received an overpayment

and quantified the amount of the overpayment if the person fails to

exercise reasonable diligence and the person in fact received an

overpayment.

(c) The deadline for returning overpayments shall be tolled when the

following occurs:

(1) the Medicaid inspector general acknowledges receipt of a

submission to the Medicaid inspector general's self-disclosure program

under subdivision seven of this section, and shall remain tolled until

such time as a self-disclosure and compliance agreement, pursuant to

subdivision seven of this section is fully executed, the person

withdraws from the self-disclosure program, the person repays the

overpayment and any interest due, or the person is removed from the

self-disclosure program by the Medicaid inspector general; or

(2) in the absence of a finding of fraud a person may repay an

overpayment through installment payments as described in subdivision

seven of this section and shall remain tolled until such time as the

provider repays the overpayment and any interest due, the Medicaid

inspector general rejects the installment payment schedule requested by

the provider, or the provider fails to comply with the terms of the

installment payment schedule.

(d) Any overpayment retained by a person after the deadline for

reporting and returning the overpayment under paragraph (b) of this

subdivision shall be subject to a monetary penalty pursuant to

subdivision four of section one hundred forty-five-b of this article.

(e) For purposes of this subdivision, "person" means a provider of

services or supplies, managed care provider, as defined in paragraph (b)

of subdivision one of section three hundred sixty-four-j of this title

and includes managed long-term care plans, and does not include

recipients of the medical assistance program.

7. Self-disclosure program. (a) Notwithstanding the provisions of any

other law to the contrary, there is hereby established a voluntary

self-disclosure program to be administered by the Medicaid inspector

general, in consultation with the commissioner, for all persons

described in this section owing any overpayment to the medical

assistance program.

(b) For purposes of this subdivision, "person" means any person

providing services or receiving payment under the medical assistance

program, a managed care provider as defined in paragraph (b) of

subdivision one of section three hundred sixty-four-j of this title,

including managed long-term care plans, and any subcontractors or

network providers thereof.

(c) In order to be eligible to participate in the self-disclosure

program, a person shall satisfy the following conditions:

(1) the person is not currently under audit, investigation or review

by the Medicaid inspector general, unless the overpayment and the

related conduct being disclosed does not relate to the Medicaid

inspector general's audit, investigation or review;

(2) the person is disclosing an overpayment and related conduct that

the Medicaid inspector general has not determined, calculated,

researched or identified at the time of the disclosure;

(3) the overpayment and related conduct is reported by the deadline

specified in subdivision six of this section; and

(4) the person is not currently a party to any criminal investigation

being conducted by the deputy attorney general for the Medicaid fraud

control unit or an agency of the United States government or any

political subdivision thereof.

(d) Notwithstanding subdivision three of section one hundred

forty-five-b of this article, the Medicaid inspector general may waive

interest on any overpayment reported, returned, and explained by an

eligible person under this subdivision. Furthermore, an eligible

person's good faith participation in the self-disclosure program may be

considered as a mitigating factor in the determination of an

administrative enforcement action.

(e) To participate in the self-disclosure program, an eligible person

shall apply by submitting a self-disclosure statement in the form and

manner prescribed by the Medicaid inspector general. The statement shall

contain all the information required by the Medicaid inspector general

to effectively administer the self-disclosure program.

(f) (1) The eligible person shall pay the overpayment amount

determined by the Medicaid inspector general to the department within

fifteen days of the Medicaid inspector general notifying the person of

the amount due.

(2) In the event the Medicaid inspector general is satisfied that the

person cannot make immediate full payment of the disclosed overpayment,

the Medicaid inspector general may permit the person to repay the

overpayment and any interest due through installment payments. The

Medicaid inspector general may require a financial disclosure statement

setting forth information concerning the person's current assets,

liabilities, earnings, and other financial information before entering

into an installment payment plan with the person.

(3) If the person and the overpayment are eligible under the

self-disclosure program, the Medicaid inspector general shall be

authorized to enter into a self-disclosure and compliance agreement with

the person. The self-disclosure and compliance agreement shall be in a

form to be established by the Medicaid inspector general and include

such terms as the Medicaid inspector general shall require for the

repayment of the person's disclosed overpayment and enable and require

the person to comply with the requirements of the medical assistance

program in the future. The person shall execute the self-disclosure and

compliance agreement within fifteen days of receiving said agreement

from the Medicaid inspector general, or such other timeframe permitted

by the Medicaid inspector general, provided however, that such other

period is not less than fifteen days.

(4) If the person provides false material information or omits

material information in his or her submissions to the Medicaid inspector

general, or attempts to defeat or evade an overpayment due pursuant to

the self-disclosure and compliance agreement executed under this

subdivision, or fails to comply with the terms of the self-disclosure

and compliance agreement, or refuses to execute the self-disclosure and

compliance agreement in the timeframes specified under this section,

such agreement shall be deemed rescinded and the provider's

participation in the self-disclosure program terminated.

(5) A person against whom a self-disclosure and compliance agreement

is rescinded and participation in the self-disclosure program is

terminated pursuant to subparagraph four of this paragraph shall be

entitled to notice.

(g) The Medicaid inspector general, in consultation with the

commissioner, may promulgate regulations, issue forms and instructions,

and take any and all other actions necessary to implement the provisions

of the self-disclosure program established under this section to

maximize public awareness and participation in such program.