CMS-10191 - Supporting_Statement Part A [rev 11-13-2013 by OSORA PRA]

Supporting Statement Part A

Medicare Parts C and D Universal Audit Guide

CMS-10191, OCN 0938-1000

_Background

Under the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 and implementing regulations at 42 C.F.R. Parts 422 and 423 Medicare Part D plan sponsors and Medicare Advantage organizations are required to comply with all Medicare Parts C and D program requirements. In 2010 the explosive growth of these sponsoring organizations forced CMS to develop an audit strategy to ensure we continue to obtain meaningful audit results. As a result, CMS’ audit strategy reflected a move to a more targeted, data-driven and risk-based audit approach. We focused on high-risk areas that have the greatest potential for beneficiary harm.

To accomplish this we have combined all Part C and Part D audit elements into one universal guide which will also promote consistency, effectiveness and reduce financial and time burdens for both CMS and Medicare-contracting entities. The Medicare Part C & D Universal combined audit guide received OMB approval in 2010 (Appendix A). It is also available in the Health Plan Management System (HPMS). HPMS is the current conduit by which organizations submit many sources of audit materials such as bids and other ongoing updates to CMS. Since this guidance is ever evolving, in an effort to keep the document more relevant to current audit processes, CMS has removed all references to specific sections within the manual chapters. Please note the guide is very comprehensive in that it describes all areas that could be audited. Due to limited resources, CMS is unable to audit all areas for any particular sponsor. Some areas could be monitored by the Account Manager, etc. Other areas could be the audited in the program audits.

To maximize resources, CMS will focus on assisting the industry to improve their operations to ensure beneficiaries receive access to care. One way to accomplish this is CMS will develop an annual audit strategy which describes how sponsors will be selected for audit and the areas that will be audited. The audit strategy will be shared with the industry via the CMS website, HPMS memo, the Part C & D user call, and other conferences. Once the audit areas are defined, CMS will design audit protocols describing in detail the focus of the audit, the data required for the audit, etc. The engagement letter (Appendix B) and protocols (Appendix C) will be sent to all sponsors selected for audit 4 weeks prior to starting the audit. In addition, the protocols will be released to the industry at the beginning of each calendar year via the same manner as the audit strategy. To assist in improving the audit process, CMS sends the plan sponsors a survey (Appendix D) at the end of each audit to complete in order to obtain the sponsors feedback. The sponsor is not required to complete the survey.

_{A. Justification}

_{1. Need and Legal Basis}

Section 1857(d) of the Social Security Act (Act), added by the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA) and implementing regulations at 42 C.F.R §422.502(d) states that CMS must oversee a Medicare Advantage (MA) organization’s continued compliance with the requirements for a MA organization.

Section 1860D-12 of the Act, added by MMA and implementing regulations at 42 C.F.R. §423.503(d) states that CMS must oversee a Part D plan sponsor’s continued compliance with the requirements for a Part D plan sponsor.

_{2. Information Users}

Data will be used by CMS Regional Office staff, CMS’ Center Medicare (CM), and CMS’ Medicare Part C and D Oversight and Enforcement Group (MOEG). If outliers or other data anomalies are detected, Regional Offices will work in collaboration with (MOEG) and other divisions within CMS for follow-up and resolution. CMS has also contracted with n outside vendor to assist in the administration of auditing sponsoring organizations.

3. Use of Information Technology

Sponsoring organizations are able to produce approximately 70% of requested information from their internal systems. CMS is able to obtain the remaining 30% via our internal systems and there is no level of effort required on the part of the sponsoring organizations.

If a virtual audit is conducted, 100% of the plan produced information is provided electronically via Secure File Transfer Protocol (SFTP). If an onsite audit is conducted, approximately 90% of plan produced information is provided electronically via Secure File Transfer Protocol (SFTP). The SFTP allows sponsors to securely upload information requested by CMS. The remaining 10% is provided while CMS is onsite at the sponsoring organizations location during the audit.

CMS and its subcontractors, in turn, communicate to sponsoring organizations regarding this information. HPMS therefore is already a familiar tool for organizations to navigate through the auditing requirements. Additionally, as access to HPMS must be granted to each user, and is protected by individual login and password, electronic signatures are unnecessary.

4. Duplication of Efforts

This information collection does not duplicate any other effort and the information cannot be obtained from any other source.

_{5. Small Businesses}

This collection does not impose a significant impact on small businesses and other entities.

_{6. Less Frequent Collection}

42 C.F.R. 423 Subpart K and 422 Subpart J of the final rule stipulate CMS must oversee a sponsoring organization’s continued compliance with CMS requirements. Less frequent collection of the data from sponsoring organizations would severely limit CMS’ ability to perform accurate and timely oversight, monitoring, compliance and auditing activities around the Part C and D Medicare benefits and could result in an increased potential for harm to Medicare beneficiaries.

_{7. Special Circumstances}

42 CFR §§460.190 – 460.192 require CMS to perform an audit of PACE organizations annually for the first three contract years and biannually thereafter.

42 C.F.R. §422.504(d) and §423.505(d) stipulates records are to be maintained for 10 years.

CMS could potentially require clarification around submitted data, and therefore CMS may need to contact Medicare Part D plan sponsors and Medicare Advantage organizations within 30 days of data submission.

8. Federal Register/Outside Consultation

Federal Register

The 2012 protocols were made available for public review/comment along with the publication of the 60-day FR notice on January 22, 2013 (78 FR 4412). Comments were received and CMS’ response has been added to this PRA package.

Since that time, MOEG has transitioned to the 2013 protocols and has made them available to the public for review/comment along with the publication of the 30-day FR notice on July 18, 2013 (78 FR 42957). These protocols, including the addition of the Special Needs Plan Model of Care Implementation (SNP MOC) protocol, have been published via HPMS memo on January 25, 2013 entitled, “2013 Program Audit Process and Protocols” and are available on the CMS website at http://www.cms.gov/Medicare/Compliance-and-Audits/Part-C-and-Part-D-Compliance-and-Audits/Program-Audits.html. These protocols have also been widely publicized through extensive trainings offered by CMS, user group calls, discussions at conferences as well through a mailbox MOEG has established to address comments on the protocols.

Additionally, there has been a CMS group name change. The Program Compliance and Oversight Group (PCOG) has been renamed the Medicare Part C and P Oversight and Enforcement Group (MOEG).

Outside Consultation

The original Part C audit guide was reviewed by the industry, including trade groups, Medicare Advantage plans, and independent consultants, and was approved by OMB in October 2006. In the development of the Part D Audit guide, we worked closely with subject matter experts covering each of the functional areas forming the basis for the 14 chapters of the guide. An independent consultant was contracted to assist in capturing all new MMA and CMS policy requirements when revising the Part D Audit Guide.

_{9. Payments/Gifts to Respondents}

There are no payments or gifts to respondents associated with this information collection request.

_{10. Confidentiality}

CMS will adhere to all statutes, regulations, and agency policies.

_{11. Sensitive Questions}

CMS will adhere to all statutes, regulations, and agency policies.

_{12. Burden Estimates (Hours & Wages)}

Anticipated staff needed for collecting data and their estimated hourly rate follow:

program director $66

compliance officer 82 lead analyst 50

quality assurance specialist 33 information technology specialist 39

2 clerical/administrative assistants 25 ea

Lead claims analyst 37

Total $357

Taking the average of the above rates, we estimate an average hourly rate of $44.62.

Routine Audits

Based on our audit strategy, routine audits are defined as the audits scheduled throughout the year. CMS describes the audit selection methodology in the audit strategy. For each sponsoring organization we estimate an average of 80 hours for administrative and systemic work to assemble the requested information, 39.5 hours to review the information for completeness, 30 minutes to submit the information to CMS and 30 mins to complete the post audit survey. This is a total of approximately 121 hours for each sponsoring organization. The average number of parent organizations that will receive a routine audit annually is 75. This number includes 40 Medicare Part C and D sponsoring organizations, plus 35 PACE organizations.

Adhoc Audits

Based on our audit strategy, adhoc audits are audits not scheduled like a routine audit. Ad hoc audits are an oversight tool that allows to promptly act when there is reason to believe that a sponsor is non-compliant with CMS policy. For each sponsoring organization we estimate an average of 40 hours for administrative and systemic work to assemble the requested information, 19.5 hours to review the information for completeness and 30 minutes to submit the information to CMS. This is a total of approximately 60 hours for each sponsoring organization but this estimate may be less based on the elements selected for audit. The average number of parent organizations subject to an adhoc audit annually is 120. Although some parent organizations may be subject to multiple focused audits. So for purposes of the burden estimate, we estimate that approximately 250 focused audits will be performed on 120 parent organizations.

Calculation of Total Audit Hours & Approximate Cost

Some of the parent organizations mentioned above may receive both a routine and ad adhoc audit, however, we have simply added the 75 parent organizations mentioned under the routine audits and the 120 parent organizations mentioned under the adhoc audits to come up with a total of 195 parent organizations subject to audit annually. The average number of hours per parent organization is roughly 121.

	Total audit hours (195 x 121)	=	23,595
	Average hourly wage	=	$44.62 per hour
13.	Total Cost of Collection Effort Capital Costs	=	$ 1,052,808.90

There is no capital cost associated with this collection.

_{14. Cost to Federal Government}

There are no costs to the Federal Government associated with this collection.

15. Changes to Burden

Under Routine Audits, the total hour burden has been adjusted from 120 hr to 121 hr. Also, the average number of hours per parent organization has been adjusted from 124 to 121 hr. Consequently, the total burden has been adjusted from 24,180 to 23,595 hr.

The added and revised instructions, templates, and forms have no impact on the burden estimates. Please see the Crosswalks for changes.

_{16. Publication/Tabulation Dates}

This is a collection that has been used and is being revised to account for the changes that have been required by regulation and operational policy. This is a coverage benefit for Medicare beneficiaries and the collection of these data for Medicare Parts C and D will continue indefinitely.

_{17. Expiration Date}

With the exception of the Universal Audit Guide, CMS would like an exemption from displaying the expiration date as these forms are used on a continuing basis. To include an expiration date would result in having to discard a potentially large number of forms.

The expiration date will be added to the Universal Audit Guide.”

_{18. Certification Statement}

There are no exceptions.

_{B. Collections of Information Employing Statistical Methods}

Not applicable. The information collection does not employ statistical methods.

2