Standards for Selecting a DV Contractor_20101012

D epartment of Health & Human Services

Centers for Medicare & Medicaid Services

7500 Security Boulevard

Baltimore, Maryland 21244-1850

C enter for Medicare

TO: All Medicare Advantage Organizations, Part D Sponsors, and 1876 Cost Plans

FROM: Cynthia G. Tudor, Ph.D., Director, Medicare Drug Benefit and C & D Data Group

SUBJECT: Release of CMS Standards for Selecting a Data Validation Contractor

DATE: October 12, 2010

To assist sponsoring organizations in preparing for the first annual independent data validation review that is required by 42 CFR §422.516(g) and §423.514(g), the Centers for Medicare & Medicaid Services (CMS) is pleased to release the attached Standards for Selecting a Data Validation Contractor. This document describes the minimum qualifications, credentials, and resources that a selected data validation contractor must possess.

We want to remind organizations of their responsibility to acquire an independent data validation contractor that meets these standards, and the requirement to document their selection process to show how the selected contractor meets the minimum qualifications, credentials, and resources set forth in this document.

If you have questions regarding the data validation program, please direct them to: [email protected]. Questions regarding the Part C and Part D Reporting Requirements Technical Specifications should be directed to [email protected] and [email protected], respectively.

Thank you.

Medicare Part C and Part D Data Validation Program

Standards for Selecting a Data Validation Contractor

October 12, 2010

Prepared by:

Centers for Medicare & Medicaid Services

Center for Medicare

Medicare Drug Benefit and C & D Data Group

Table of Contents

1.0 Background 1

2.0 STANDARDS FOR ORGANIZATIONAL INDEPENDENCE 1

3.0 Standards for RELEVANT DATA VALIDATION experience 2

3.1 Previous Experience Conducting Similar Types of Work 2

3.2 Successful Completion of Similar Data Validation Projects 2

3.3 Successful Completion of CMS Data Validation Training 2

4.0 Standards for Organizational background 2

4.1 Staff Credentials 2

4.2 Management Personnel Credentials 3

4.3 Overall Management Framework 3

4.4 Facility Requirements 3

4.5 Overall Resource Availability 4

5.0 Documentation of DATA VALIDATION CONTRACTOR SELECTION 4

1. Background

Part C and Part D sponsoring organizations are responsible for contracting with an independent data validation contractor to conduct the CMS-required annual validation of Part C and D Reporting Requirements data.

CMS is providing this set of Standards for Selecting a Data Validation Contractor as guidance for organizations to use in acquiring a data validation contractor. These standards describe the minimum qualifications, credentials, and resources that the selected contractor must possess.

Sponsoring organizations must acquire one data validation contractor to conduct the data validation review on reported data. The data validation contractor may subcontract in order to ensure it has the expertise required for each data validation area and to meet the minimum standards described in this document.

2. STANDARDS FOR ORGANIZATIONAL INDEPENDENCE

In order to ensure the independence of the data validation, organizations may not use their own staff to conduct the data validation review. CMS requires that the data validation review be conducted by an independent entity and believes that an independent external data validation review is the only way to ensure that the Part C and Part D reporting results will be seen as credible by CMS and other stakeholders. Therefore, the sponsoring organization is responsible for ensuring that the data validation contractor (and subcontractor(s), if applicable) meet the following standards:

• Is not employed, contracted, sub-contracted, represented or considered to be a first-tier, downstream or related entity by the sponsoring organization (the definitions of these terms are in the federal regulations at 42 CFR § 422.500 and § 423.501); and

• Is free of conflict of interest (A conflict of interest occurs when a person or person’s objectivity in performing the data validation review is compromised by their proximity or relationship to the immediate task, and can possibly give cause for influencing a decision). Consultants who provide management consulting or assist the sponsoring organization with its reporting procedures, reporting processes, or information systems used in storing, compiling, or reporting the Part C and/or Part D Reporting Requirements data to CMS may not serve as the data validation contractor for that organization.

Exhibit 1 provides additional guidance on whether an entity’s relationship with a sponsoring organization meets CMS’ standard for organizational independence in conducting the data validation review. The sponsoring organization should direct any specific questions regarding whether or not a particular entity meets this standard to [email protected].

Exhibit 1: Examples of Relationships that Meet/Do Not Meet Standards for Organizational Independence

Examples of Entity Relationships	Meets Standards for Organizational Independence? Y/N
Internal corporate audit team	No
Internal organization staff	No
Contractor who assists in preparing the sponsoring organization’s Part C/Part D reporting requirements data	No
Contractor who monitors/maintains/creates data used by the organization for reporting	No
Contractor not affiliated with the sponsoring organization, who is hired to perform a “pre-review”, “mock audit”, or “pre-assessment”	Yes
Contractor who assists in populating the OAI	No
Contractor who assists is creating Part C/Part D reporting requirements policies and procedures for the organization	No
Examples of Entity Relationships	Meets Standards for Organizational Independence? Y/N
External Quality Review Organizations (EQROs) and quality improvement organizations (QIO) contracted with a State Medicaid agency or the sponsoring organization to perform quality and other non-audit related activities	Yes

Sponsoring organizations may use their own staff to assist the contractor in obtaining the information, data, and documents needed to complete the data validation review.

3. Standards for RELEVANT DATA VALIDATION experience

   1. Previous Experience Conducting Similar Types of Work

The data validation contractor must have at least two years of previous experience conducting similar types of data review and validation or auditing with projects of similar size and scope. The contractor shall possess, at a minimum, the following specialized expertise:

• Knowledge of the Part C and Part D Reporting Requirements and Technical Specifications;

• Knowledge of managed care and pharmacy benefits operations and management and how they relate to Medicare Part C and Part D;

• Ability to evaluate an organization’s performance of Medicare Part C and Part D data collection, storage, compilation, and reporting using CMS’ data validation standards;

• Ability to conduct source/programming code review;

• Ability to interface with a variety of data systems in a secure environment;

• Experience in conducting data validation (e.g., HEDIS Compliance Audits™) for commercial entities or governmental agencies; and

• Thorough understanding of HIPAA and Privacy requirements.

2. Successful Completion of Similar Data Validation Projects

The data validation contractor must demonstrate successful performance of current and previous data validation or auditing projects of similar size and scope. This may be demonstrated by submitting descriptions of previous projects that required data validation, information on any problems encountered during the execution of the project and how they were resolved, and whether budgets and deadlines established for the project were met. If available, performance evaluations should also be submitted to the sponsoring organization.

3. Successful Completion of CMS Data Validation Training

Prior to working on the data validation project, each individual staff member of the selected data validation contractor must take the web-based CMS Data Validation Training. All data validation contractor staff assigned to a data validation team, including the team project manager(s), are required to complete this training. The training will provide each participant with documentation that the training was completed, and the data validation contractor must provide this documentation to any hiring sponsoring organization for all staff assigned to the applicable data validation team before commencing work on the data validation.

4. Standards for Organizational background

   1. Staff Credentials

The data validation contractor must provide a cross-functional team to conduct the data validation review. The size and composition of this team will depend on the scope and complexity of the Part C and/or Part D Reporting Requirements and the expertise required for each data validation area. Available staff should include individuals with the following qualifications:

• IT staff with knowledge of different coding languages and methodologies (e.g., SAS, SQL, Crystal Reports, Cognos, MS Access);

• Statisticians;

• Individuals with experience in the review of claims and medical records data;

• Staff with knowledge of managed care and pharmacy benefits operations and management and how they relate to Medicare Part C and Part D; and

• Analysts with demonstrated understanding and subject matter expertise of Title I and II of the Medicare Modernization Act (MMA), Medicare Part C and Part D regulations (42 CFR § 422 and § 423), Medicare Managed Care Manual and Prescription Drug Benefit Manual.

The contractor must ensure that it has the right mix of expertise and qualified staff that can efficiently and successfully carry out all tasks prescribed in the least disruptive manner to the provider.

2. Management Personnel Credentials

The data validation contractor must provide management personnel with demonstrated project management experience leading to the successful completion of projects of similar size and scope, including maintaining project schedules and budgets.

The data validation contractor’s management personnel should also have

• Technical knowledge of CMS Part C and Part D Reporting Requirements; and

• Knowledge of different coding languages and methodologies (e.g., SAS, SQL, Crystal Reports, Cognos, MS Access) and statistical methodologies.

3. Overall Management Framework

The data validation contractor must provide an organization chart to the sponsoring organization showing the management framework and placement of all personnel who will be affiliated with the data validation review. The organization chart must be sufficient to provide an understanding of the roles and responsibilities or placement of proposed personnel.

4. Facility Requirements

The data validation review will be conducted through a combination of on-site (at the Part C organization/Part D sponsor location) and off-site activities. Therefore, the data validation contractor must provide the facilities and equipment necessary to perform the off-site portion of the data validation review. Given that the data validation contractor will be handling Personally Identifiable Information (PII) and proprietary/sensitive information regarding Part C organization/Part D sponsor internal operations, it must provide a facility and equipment that complies with applicable industry security standards, as well as maintain appropriate administrative, technical, procedural, and physical procedures to safeguard this information. The sponsoring organization is responsible for ensuring that it has established mutually agreeable methods for sharing propriety and/or secure (PHI/PII) data with the reviewer and that the data validation contractor complies with all HIPAA privacy and security requirements. This includes, but is not limited to, the following essential physical and operational security requirements:

• Ability to store secure data (hard copies and soft copies);

• Ability to provide a secure work space to ensure employees not directly involved with the data validation project do not have routine access to sensitive information;

• Systems capable of storing data and retrieving it securely; Computer files with sensitive information shall not be filed or backed up on the hard drive of computers, unless one of the two following exceptions are met: 1) the hard drive is a removable one that can be secured at night (the presumption is that a computer with a fixed hard drive is not secure); or 2) the computer can be protected (secured with a “boot” password, a password that is entered after the computer is turned on or powered on). This password prevents unauthorized users from accessing any information stored on the computer's local hard drive(s); and

• Ability to securely shred and dispose of documents.

5. Overall Resource Availability

The data validation contractor must have the resources required to successfully perform the data validation review on time and within budget while handling competing obligations. It must clearly demonstrate to the sponsoring organization an approach to executing this project that provides a clear chain of responsibility, quality assurance monitoring, cost control, contract administration, and adequate, qualified staff resources.

5. Documentation of DATA VALIDATION CONTRACTOR SELECTION

Sponsoring organizations must document their data validation contractor selection process and be able to show, upon request by CMS, how their chosen data validation contractor meets the minimum qualifications, credentials, and resources set forth in this document.