National Association of Community Health Centers ISSUE BRIEF Medicare/Medicaid Technical Assistance #88 Recent CMS Guidance on Requirements that Providers Educate Employees on False Claims Laws and Policy April 2007 Prepared by: Melinda G. Murray Feldesman Tucker Leifer Fidell, LLP 2001 L Street, N.W. Second Floor Washington, DC 20036 (202) 466-8960 For more information, please contact: Roger Schwartz, JD Director of State Affairs and Legislative Counsel Division of Federal, State, and Public Affairs National Association of Community Health Centers, Inc. 1400 Eye Street, NW Suite 330 Washington, DC 20005 Tele.#: (202) 296-0158 Fax: (202) 296-3526 rschwartz@nachc.com This publication was supported by Grant/Cooperative Agreement Number U3OCS00209 from the Health Resources Services Administration, Bureau of Primary Health Care (HRSA/BPHC). Its contents are solely the responsibility of the authors and do not necessarily represent the official views of HRSA/BPHC. 1
AN UPDATE ON THE DEFICIT REDUCTION ACT OF 2005: CMS Guidance on Employee Education Requirements By Melinda G. Murray Last July, NACHC published Issue Brief #87: More Compliance Sticks and Carrots: The Deficit Reduction Act of 2005 in which we addressed various compliance enforcement provisions, especially Section 6032 which requires that entities that receive more than $5 million in Medicaid funds must provide employee education about false claims recoveries and whistleblower protections. In this Issue Brief, we address the Centers for Medicare and Medicaid Services ( CMS ) guidance on the implementation of that Section in the form of two letters to State Medicaid Directors. 1 By way of background, the Deficit Reduction Act of 2005, which was signed into law on February 1, 2006, contains in Section 6032 of the Act, (Section 1902(a)(68) of the Social Security Act) requirements that any entity that receives or pays more than $5 million in Medicaid payments, as a condition of receiving Medicaid payments, must establish written policies for all employees and for all contractors and agents explaining the Federal False Claims Act 2, along with other Federal and State laws that involve civil or criminal penalties for false claims. The entity must also have policies for uncovering 1 The first letter, issued December 13, 2006 (SMDL #06-024) elaborated on the definitions of entity, employee and contractor in the Act, as well as the effective date and the nature of the policies. The second letter (SMDL #07-003), issued March 22, 2007, came in the form of Frequently Asked Questions, available at http://www.cms.hhs.gov/smdl/smd/list.asp#topofpage (scroll to the March 22, 2007 date). 2 31 U.S.C. 3729-3733. The False Claims Act provides civil penalties and damages against anyone who knowingly submits, causes, the submission, or presents a false claim to any U.S. employee or agency for payment or approval, such as a claim for reimbursement under Medicare or Medicaid. A unique feature of the law is the ability of a citizen to bring an action on behalf of the government and share in the recovery ( whistleblower provision. ) Many States have State false claims acts and in fact, States are now incentivized under Section 6031of the DRA to pass their own equivalent of the Federal False Claims Act, especially the whistleblower provisions. If they do, then they will receive a larger share of the Federal Medical Assistance Percentage (FMAP). 2
fraud, waste, and abuse, as well as advising an employee of the whistleblower protections under the Federal False Claims Act or State law. Although the effective date of this section of the DRA was January 1, 2007 3, many providers, especially health centers with multiple sites or subsidiaries that may cross state lines, had questions about how the $5 million threshold would be calculated (on a per location or per organization basis), what type of education would be required, which contractors and agents would be covered, and the degree of contractor compliance required. While CMS has brought more clarity to some of these issues in its two State Medicaid Director letters, there are still unanswered questions. This Issue Brief summarizes the CMS guidance by topic. What kind of entity is required to comply with this education provision? The definition of entity is broad and includes a governmental agency, organization, unit corporation, partnership, or other business arrangement, including any Medicaid managed care organization, whether for profit or not-for-profit, and regardless of the form of the business structure, which receives or makes payments of at least $5 million annually under a State plan approved under title XIX (Medicaid), under a waiver of such plan, or a Title XIX demonstration. How is the $5 million calculated for a health center with multiple locations or sub-units? If the health center is providing services or items at more than one location and receives Medicaid payments for services provided or items supplied at these locations of $5 million or more in the aggregate, then it must comply with Section 6032. This is true even if there is more than one provider identification or tax I.D. number 3 Unless a State has an approved request for delayed implementation of the requirements of section 6032, the State Plan Amendment must be submitted by March 31, 2007. 3
involved for the different locations or units. It also applies to a health center that is structured as a public health center in which a public entity provides the Medicaid services or health care items, in conjunction with a Section 330-compliant governing board, and receives more than $5 million in Medicaid. How is the yearly $5 million calculated and what s the cut-off date? If the health center received or made payments of $5 million for the Federal fiscal year 06, then it must comply. For each Federal fiscal year (October 1-September 30) after this, the health center that receives or pays $5 million will then have to comply as of the January 1 that follows. 4 In calculating the total amount annually, a health center can use either the date that the services were performed or the date that the payment was received, as long as that methodology is consistently applied throughout the year. However, it is only payments received that count towards the $5 million, not amounts billed. The patient contribution to care under the State plan (i.e., co-payments and other cost-sharing) does not count towards the $5 million. The entity counts only the amounts received directly from the State Medicaid Agency when calculating the $5 million and not those dollars received from the Medicaid Managed Care Organization ( MCO ) for managed care arrangements for the health center s MCO patients. What about Medicaid MCOs who receive and spend Medicaid money? The annual threshold of $5 million is met by calculating either payments made to providers or payments received from a State plan. So if the Medicaid MCO receives $3 million in payments from the State and makes payments of $2 million, these amounts are not aggregated to see if the Medicaid MCO is an entity under the Act. 4 There is a delay in effective date under Section 6034(e) for some States whose legislatures did not meet in time for the January 1, 2007 effective date. 4
What if the health center receives payments from more than one State? There appears to be inconsistency in two of the questions on the issue of whether a health center s sub-units that also furnish Medicaid health care items or services are aggregated to meet the threshold of $5 million that requires employee education. On the one hand, in the answer to FAQ (Frequently Asked Questions) #5, CMS states that for compliance with Section 6032, an entity is the largest separate organizational unit (i.e. the health center) that provides Medicaid items or services and includes all sub-units of that organizational unit that furnish Medicaid services and items, even if the components are separately incorporated or located in different States. Unless it is part of a health system, each organizational unit is separate for determining whether the $5 million threshold has been met, therefore requiring employee education. If the health center is part of a health system or itself is considered a health system, the entire organization is considered an entity for purposes of compliance with Section 6032. On the other hand, in questions 18 and 20, when asked whether payments from multiple States are aggregated to meet the $5 million threshold, CMS s answer is no, payments from multiple States are not aggregated to reach the $5 million threshold, unless it is a health system that is the corporate parent or itself provides Medicaid health care items or services. We think that the answer to question 18 is correct: payments should not be aggregated since each State plan is different, but the apparent conflict needs further clarification, especially with respect to how a health center with subsidiaries might be regarded. NACHC will attempt to obtain an answer to the question of whether payments from different States should be aggregated and whether the health center is considered a health system. Pending a definitive answer, a health center that is 5
unsure about whether it meets the $5 million threshold for the requirement of employee education as a result of aggregating sites in different states should conduct the education recommended in this Issue Brief. It is clear that once the health center receives $5 million under one State s Medicaid State plan or waiver program, the health center must provide the education to all of its employees even if the employees are in different States. Do Medicare payments count? Medicare payments are not considered in determining whether a health center has to comply with Section 6032, but if a State agency pays deductibles for dual-eligible individuals and Qualified Medicare Beneficiaries, then those amounts should be considered in connection with whether the health center must comply. What kind of training and education does the health center have to conduct? Section 6032 requires employee education in the form of information about policies and does not require in-person training, although we recommend in-services as the most effective way to educate employees. A health center must disseminate its policies and procedures relating to the detection of fraud, waste, and abuse, the elements of laws such as the False Claims Act, and the rights and protections of whistleblowers in writing or electronically. The health center may insert these policies into the employee handbook, if it has a handbook. However, it is not necessary to create a handbook if one does not exist. It may make the policies available on the intranet and/or distribute them at an employee s initial orientation. How far does a health center have to go in insuring compliance of its contractors and vendors? One of the major questions that many health centers and other providers had about Section 6032 was the requirement that the employee education 6
and policies apply to contractors. The contractor or vendor who is covered by these requirements is one which or who, on behalf of the entity: 1) furnishes or otherwise authorizes the furnishing of Medicaid health care items or services; 2) performs billing and coding functions; or 3) is involved in the monitoring of health care provided by the entity. It does not include janitors, grounds maintenance personnel, or insurance agents, but it does include contracted physicians, therapists, pharmacies, behavioral health providers, billing companies, and performance improvement consultants. CMS requires that the elements of the law be incorporated into each State s provider enrollment agreements. Unless a State has been given delayed implementation, it is required to amend the State Plan to set forth the manner by which it will ensure an entity s compliance with the Section by March 31, 2007. In addition, the State has to describe how it will ensure compliance oversight and the frequency with which it will reassess compliance going forward. CMS may also audit the entities and review a State s procedures though its own routine oversight of States. Although CMS does not require any particular language in the contract itself, the Medicaid State Plan might include requirements to ensure compliance with Section 6032. We recommend that if the State has not spoken about particular provisions and if the contract does not already have language about compliance with health center policies, a health center should: 1) Insert language in new contracts requiring compliance with health center policies with specific reference to policies that relate to fraud, waste, and abuse. 7
2) For existing contracts, draft a simple amendment containing the language. The policies and procedures that relate to detecting fraud, waste, and abuse, as well as the protection of whistleblowers that are distributed to employees should also be distributed to the contractors. It is up to the health center to determine what distribution method works best for its employees, agents, and contractors. The contractor does not have to actually adopt the health center policies that are implemented to detect and prevent fraud, waste, and abuse, but it is required to cooperate. For example, if the health center conducts audits of particular claims, then a contractor, such as a laboratory services company, would have to participate in the audit of laboratory claims. Does a health center that receives money from a Medicaid MCO comply as an entity or as a contractor? If the health center receives $5 million per year from a State Medicaid Agency directly, it would be considered an entity regardless of whether it also contracts with a Medicaid MCO. If it is a contractor of a Medicaid MCO which meets the $5 million threshold, then the health center is in the position of having to comply as a contractor, too. So a health center could be put in the position of having to adhere to two different sets of policies its own and the Medicaid MCO s. Will CMS provide model policies? CMS has said it will not provide sample policies or model language to comply with Section 6032. But NACHC has sample policies attached to Issue Brief # 87 [Listed as out of stock on website]. What are the penalties for non-compliance? Each State will determine how it will oversee and enforce compliance, but a State could decide to discontinue a health center s participation in Medicaid, if it does not comply. The DRA requirements must be 8
incorporated into each State provider enrollment agreement and a State Plan amendment is required which could set forth additional penalties. Unanswered Questions. CMS has not provided answers to the following: 1) If an entity such as a health center has subsidiaries or locations in different states, will the amounts received by those sub-units or locations be aggregated to reach the $5 million threshold so that the health center will have to comply with the employee education provisions? (See previous discussion on this issue on p. 4) 2) What policies on the detection of fraud, waste, and abuse are sufficient? 3) What happens if as a contractor to several, or even one, Medicaid MCOs, the health center has to comply with its own policies, as well as possibly conflicting policies in its capacity as contractor to the Medicaid MCO? Recommendations: If a health center has to comply with Section 6032, it should: 1) Make sure its policies describe the Federal False Claims Act, Civil Monetary Penalties Law, administrative remedies, and State laws that provide remedies for false claims [These were also in NACHC Issue Brief #87] 2) Conduct in-person training of employees, agents and contractors about the policies regarding fraud, waste, and abuse and whistleblower rights. 5 3) Ensure that health center policies, whether in an employee handbook or elsewhere, have a well understood procedure to make compliance issues known to 5 Although Section 6032 does not require in-person training, we believe that dissemination of policies is ineffective unless training accompanies the policies. 9
the compliance officer or CEO, including an anonymous hot line, while advising the employee of his/her rights and protections as a whistleblower. 6 4) Set forth certain standards regarding billing and coding (such as billing for medically necessary, documented services only, no upcoding, no double billing). 5) Explain in the policies the way the health center prevents and detects fraud. 6) The contracts with all billing and coding vendors, contractors who provide Medicaid services and/or supplies, and contractors who monitor health center quality should be reviewed to make sure they require compliance with health center policies, including those relating to fraud, waste, and abuse and whistleblower rights. If the contracts do not have that language, they should be amended. 6 While requiring the employee to come to the compliance officer first probably cannot be made a condition of employment, employees should certainly be encouraged to seek resolution of the issue first within the health center, before exercising his or her rights as a whistleblower. 10