Supporting Statement Part A
Medicare Part C and Part D Program Audit and Industry-Wide Part C Timeliness
Monitoring Project (TMP) Protocols
(CMS-10717; OMB 0938-1395)
Background
Under the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 and implementing regulations at 42 CFR Parts 422 and 423, Medicare Part D plan sponsors and Medicare Advantage organizations (herein after referred to as Sponsoring organizations) are required to comply with all Medicare Parts C and D program requirements. The Centers for Medicare and Medicaid’s (CMS) annual audit plan ensures that we evaluate Sponsoring organizations’ compliance with these requirements by conducting program audits that focus on high-risk areas that have the greatest potential for beneficiary harm. As such, CMS has developed the following audit protocols1 for use by Sponsoring organizations to prepare for their audit:
Compliance Program Effectiveness (CPE)
Part D Formulary and Benefit Administration (FA)
Part D Coverage Determinations, Appeals, and Grievances (CDAG)
Part C Organization Determinations, Appeals, and Grievances (ODAG)2
Special Needs Plans Care Coordination (SNPCC)
Each year, CMS conducts program audits of a subset of Sponsoring organizations at the parent organization (as defined in 42 CFR 422.2 and 423.4) level. These routine audits collect subset of data to subject each Sponsoring organization to only the applicable program area protocols. For example, if a Sponsoring organization does not offer a special needs plan, or an accrediting organization has deemed a special needs plan compliant with CMS regulations and standards, CMS would not apply the SNPCC protocol. Likewise, CMS would not apply the ODAG audit protocol to an organization that offers only a standalone prescription drug plan since that organization does not offer the MA benefit. Conversely, ad hoc audits resulting from referral may be limited in scope and, therefore, all program area protocols may not be applied.
In addition, as part of the robust program audit process, CMS also requires Sponsoring organizations that have undergone a program audit and found to have deficiencies to undergo a validation audit to ensure correction. The validation audit uses the same audit protocols, but only tests the elements where deficiencies were found as opposed to re-administering the entire audit. Finally, CMS conducts annual industry-wide timeliness monitoring of all Part C organizations by using a subset of the ODAG protocol. However, Sponsoring organizations that successfully submitted all of their Part C data in response to a program audit in the prior year are excluded from submitting new data for the timeliness monitoring effort in the year following their program audit.
CMS is requesting an Extension request for OMB approval due to minimal grammatical updates to the collection instruments. Please refer to the Crosswalk of Changes for a complete summary of updates made to this collection request since 2021.
Section 1857(d) of the Social Security Act (Act), added by the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA) and implementing regulations at 42 CFR § 422.503 and § 422.504 state that CMS must oversee a Medicare Advantage (MA) organization’s continued compliance with the requirements for a MA organization.
Section 1860D-12 of the Act, added by MMA and implementing regulations at 42 CFR § 423.504 and § 423.505 state that CMS must oversee a Part D plan sponsor’s continued compliance with the requirements for a Part D plan sponsor.
The data collected by way of the audit protocols included in this package allow CMS to conduct a comprehensive review of MA and Part D organizations’ compliance within specific program areas. CMS uses the data collected to test an organization’s compliance with the following federal requirements:
Compliance Program Effectiveness—42 CFR, §§ 422.503 and 423.504
Part D Formulary and Benefit Administration—42 CFR, Part 423, Subpart C
Part D Coverage Determinations, Appeals, and Grievances—42 CFR, Part 423, Subpart M
Part C Organization Determinations, Appeals, and Grievances—42 CFR, Part 422, Subpart M
Special Needs Plans Care Coordination —42 CFR §§§ 422.4(a)(iv), 422.101(f), and 422.152(g)
The information gathered during this program audit will be used by the Medicare Parts
C and D Oversight and Enforcement Group (MOEG) within the Center for Medicare
(CM) and CMS Regional Offices to assess Sponsoring organizations’ compliance with Medicare program requirements. Specifically, as part of its FA review, MOEG reviews samples of rejected claims to ensure that the point-of-sale rejections are appropriate; its purpose is to ensure Part D organizations are administering their formulary and transition benefit in accordance with their CMS-approved formulary and the overriding regulations. MOEG’s ODAG and CDAG reviews focus on the timeliness of coverage decisions and grievances related to requests for services and drugs. ODAG and CDAG universes are collected and reviewed at the universe level to ensure organizations are meeting the notification and effectuation timeframe requirements outlined in regulation, and samples are reviewed to ensure proper procedures are followed in processing these requests, such as providing appeal rights for denied requests, ensuring the appropriate level of review when initial requests are denied for lack of medical necessity, etc. As part of its CPE review, MOEG uses audit universes and information collected via questionnaires to assess the extent to which Part C and Part D organizations have adopted and implemented an effective compliance program, inclusive of measures that prevent, detect, and correct noncompliance with CMS' program requirements. And finally, if the audited MA organization offers a SNP, MOEG’s review evaluates a sample of SNP enrollees to ensure the SNP is coordinating care, administering health risk assessments, updating individual care plans, and assigning interdisciplinary care teams in accordance with the CMS-approved model of care.
If outliers or other data anomalies are detected, MOEG requires audited organizations to provide impact analyses to better understand and report the scope of the noncompliance. These MA and Part D organizations then receive their audit results, are required to implement corrective actions, and to demonstrate correction of all conditions cited in the final audit report by undergoing a validation audit. If the validation audit demonstrates substantial correction of the conditions, MOEG will communicate its decision to close the audit in a letter to the MA and Part D organization. Any new or isolated issues of noncompliance that remain will be referred to the CMS Account Manager for follow-up. Regional Offices will work in collaboration with MOEG and other divisions within CMS for resolution.
Sponsoring organizations are able to produce approximately 65 percent of requested information from their internal systems. CMS is able to obtain the remaining 30 percent via our internal systems. The remaining 5 percent of data is manually entered by the Sponsoring organizations in response to questionnaires or other audit requests.
Information collected from the Sponsoring organizations for use in the audit is obtained electronically via the Health Plan Management System (HPMS), a system that was developed and is maintained by CMS and to which all Sponsoring organizations have access. This system is also secure, requiring users to request and gain access via CMS personnel and then must create and maintain a secure user id and password.
Our routine program audits are conducted remotely using secure webinar technology. This saves CMS and audited Sponsoring organizations time, money, and other resources needed to complete the audit.
4. Duplication of Efforts
This information collection does not duplicate any other effort and the information cannot be obtained from any other source.
This collection will have a minimal impact on small businesses since applicants must possess an insurance license and be able to accept substantial financial risk. Generally, state statutory licensure requirements effectively preclude small businesses from being licensed to bear risk needed to serve Medicare beneficiaries.
42 CFR Part 423 Subpart K and 422 Subpart K stipulate that CMS must oversee a sponsoring organization’s continued compliance with CMS requirements. In general, CMS attempts to audit coverage for at least 95 percent of MA and Part D covered enrollees by conducting program audits at the parent organization level within a given audit cycle. Each audit cycle averages 4 years in duration, and organizations with the most MA and Part D enrollees tend to be audited at the beginning of each audit cycle. Organizations with less MA and Part D enrollees, or organizations that have never been subject to a program audit, tend to be scheduled in the latter half of the cycle. Given the variance in total enrollment, the number of audits conducted each year can range from 13 to 40 audits, and the frequency with which an audit occurs can also be influenced by the identification of compliance issues, referral for program audit, a spike in the size of an organization, and the amount of time since the last audit. In addition, CMS conducts annual timeliness monitoring of Part C organization determinations and appeals.
Less frequent collection of the data from Sponsoring organizations would severely limit CMS’ ability to perform accurate and timely oversight, monitoring, compliance, and auditing activities around the Parts C and D Medicare benefits and could result in an increased potential for harm to Medicare beneficiaries.
42 CFR § 422.504(d) and § 423.505(d) stipulate that records are to be maintained for 10 years. CMS could potentially require clarification around, or validation of, submitted data and, therefore need to contact Medicare Part D plan sponsors and Medicare Advantage organizations within 30 days of data submission. Ad hoc audits initiated in response to an audit referral could also require immediate action providing a Sponsoring organization less than 30 days to respond to universe requests. However, in general, and as outlined in the five program area protocols, within 15 business days of receipt of the program audit Engagement Letter, each of the pre-audit collection instruments (i.e., all except the program area data request templates) must be populated and submitted to CMS. Sponsoring organizations are also required to provide responses to CMS requests for root cause analyses within two business days and impact analyses within ten business days of a request during and after program audit fieldwork. While these submissions are required in fewer than 30 days of receipt of the individual notices, these timeframes are necessary to complete the entire program audit process timely. Otherwise, there are no special circumstances that would require an information collection to be conducted in a manner that requires respondents to:
Report information to the agency more often than quarterly;
Prepare a written response to a collection of information in fewer than 30 days after receipt of it;
Submit more than an original and two copies of any document;
Collect data in connection with a statistical survey that is not designed to produce valid and reliable results that can be generalized to the universe of study;
Use a statistical data classification that has not been reviewed and approved by
OMB;
Include a pledge of confidentiality that is not supported by authority established in statute or regulation that is not supported by disclosure and data security policies that are consistent with the pledge, or which unnecessarily impedes sharing of data with other agencies for compatible confidential use; or
Submit proprietary trade secret, or other confidential information unless the agency can demonstrate that it has instituted procedures to protect the information's confidentiality to the extent permitted by law.
The 60-day notice published in the Federal Register on May 1, 2023 (88 FR 26551). CMS received 1 public submission, which included 13 comments. We then combined the 13 comments into 9 unique comments and provided responses in the comment and response summary that is included in this collection request. We adopted 3 of the commenter’s suggestions and believe that those corresponding edits simplify and clarify the collection instruments. Please refer to the Crosswalk of Changes for a complete summary of updates made to this collection request since the May 1, 2023 publication.
The 30-day notice published in the Federal Register (88 FR 71367) on October 16, 2023.
There are no payments or gifts to respondents associated with this information collection request. MA and Part D organizations are required to comply with CMS oversight (produce records for examination, etc.) and CMS could terminate a contract for failure to comply.
CMS will adhere to all statutes, regulations, and agency policies regarding confidentiality. While Sponsoring organizations are required to provide CMS access to records, data and other beneficiary information, CMS will ensure that the collected information and any sensitive or personal information will be transferred and/or stored through the Health Plan Management System (HPMS) which is a secure site.
There are no sensitive questions associated with this collection. Specifically, the collection does not solicit questions of a sensitive nature, such as sexual behavior and attitudes, religious beliefs, and other matters that are commonly considered private.
To derive average costs, we used data from the U.S. Bureau of Labor Statistics’ May 2021
National Occupational Employment and Wage Estimates for all salary estimates
(https://www.bls.gov/oes/current/oes_nat.htm). In this regard, the following table presents the mean hourly wage, the cost of fringe benefits (calculated at 100 percent of salary), and the adjusted hourly wage. We selected the following personnel for our burden estimate based on our previous experiences conducting similar Part C and Part D program audits.
National Occupational Mean Hourly Wage and Adjusted Hourly Wage
Occupation Title |
Occupation Code |
Mean Hourly Wage ($/hr.) |
Fringe Benefit ($/hr.) |
Adjusted Hourly Wage ($/hr.) |
General and Operations Managers (Program Director) |
11-1021 |
55.41 |
55.41 |
110.82 |
Compliance Officer |
13-1041 |
36.45 |
36.45 |
72.90 |
Management Analysts |
13-1111 |
48.33 |
48.33 |
96.66 |
Business Operations Specialists, All Other |
13-1199
|
38.10 |
38.10 |
76.20 |
Computers and Information Systems Manager |
11-3021 |
78.33 |
78.33 |
156.66 |
Administrative Assistants |
43-6014 |
19.75 |
19.75 |
39.50 |
Lead Claims Analyst |
13-1031 |
34.11 |
34.11 |
68.22 |
Project Management Specialist |
13-1082 |
47.32 |
47.32 |
94.64 |
As indicated, we are adjusting our employee hourly wage estimates by a factor of 100 percent. This is necessarily a rough adjustment, both because fringe benefits and overhead costs vary significantly from employer to employer, and because methods of estimating these costs vary widely from study to study. Nonetheless, there is no practical alternative, and we believe that doubling the hourly wage to estimate total cost is a reasonably accurate estimation method.
Based on the table above, we then added the estimated hourly rate (rounded to the nearest whole dollar) for each position and divided by the total number of positions to get the average hourly rate.
4 Program Directors $111/hr x 4 $444
1 Compliance Officer $73/hr x 1 $73 5 Management Analysts $97/hr x 5 $485 1 Project Management Specialist $95 x 1 $95
Quality Assurance Specialists $76/hr x 6 $456
Computer & Information Systems Managers $157/hr x 5 $785
5 Administrative Assistants $40/hr x 6 $240
4 Claims Analysts $68/hr x 4 $272
Taking the average of the above rates, we estimate an average hourly rate of $89/hr ($2,850/32 positions).
We also created a burden estimate for the industry- wide TMP using the same table above.
2 Computer & Information Systems Managers $157/hr x 2 $314
2 Administrative Assistants $40/hr x 2 80
2 Claims Analysts $68/hr x 2 136
Taking the average of the above rates, we estimate an average hourly rate of $88/hr ($530/6 positions).
Based on our audit strategy, routine program audits are defined as the audits scheduled throughout the year. Ad hoc audits could be added to the annual audit plan based on referral, should an immediate need arise to address emergent issues of noncompliance. For each Sponsoring organization, we estimate an average of 200 hours for administrative and systemic work to assemble the requested information, 60 hours to review the information for completeness, 30 minutes to submit the information to CMS, 160 hours for the actual administration of the audit, 40 hours to respond to audit documentation requests, 40 hours to review and respond to the draft audit report and 10 minutes to complete the optional postaudit survey. The total burden equals 500 hours and 40 minutes, rounded up to 501 hours. We estimate the annual number of parent organizations that will undergo an annual program audit to be 25.
Each organization selected for program audit will also incur validation and close out activity burden. We estimate an additional 200 hours for these activities, regardless of whether the Sponsoring organization is required to hire an independent auditing firm (in accordance with 42 CFR § 422.503 (d)(2)(B)(iv) and § 423.504 (d)(2)(B)(iv)) or rely on CMS to conduct the validation audit. In general, a Sponsoring organization with more than five non-CPE conditions identified in its final audit report may be required to hire an independent auditing firm. We estimate that annually, 21 of the 25 Sponsoring organizations (84 percent of audited organizations) will be required to hire independent auditing firms.
For each Sponsoring organization that will be required to hire an independent auditing firm, we estimate an average of 55 hours to populate the validation work plan, 8 hours to respond to CMS input, 35 hours for administrative and systemic work in assembling/reviewing the required information, 10 hours reviewing the information for completeness, 50 hours participating in the independent audit, 10 hours responding/requesting validation audit documentation, 30 hours to drafting/reviewing the validation audit report and 2 hours to submit the information to CMS. In addition to burden hours, Sponsoring organizations that will be required to hire an independent auditing firm will incur the auditing firm’s fee. While those costs will vary, we estimate the average cost is $150,000.
For each Sponsoring organization that will be required to undergo a CMS-led validation audit, we estimate an average of 200 hours in assembling, reviewing and submitting data to CMS, participating in the audit with CMS, and responding to CMS’ requests for additional information. Sponsoring organizations that undergo a CMS-led validation audit do not incur the independent auditing firm expense.
Combining the program audit and validation audit burden, we estimate a total of approximately 701 hours for each Sponsoring organization. We have included this cost in the total audit estimate.
We estimate that a total of 157 Part C organizations will incur burden associated with the annual TMP. This number is based on the average, annual number of Part C organizations who have undergone a TMP audit in recent years. For this effort, we estimate an average of 80 hours for administrative and systemic work to assemble the requested information, 24 hours to review the information for completeness, 30 minutes to submit the information to CMS, and 16 hours to conduct validation webinars to ensure accurate information. This is a total of approximately 120.5 hours for each Sponsoring organization.
Information Collection |
Respondents |
Responses (per Respondent) |
Total Responses |
Burden per Response (hours) |
Total Annual Burden (hours) |
Labor Cost of Reporting ($/hr) |
Total Cost |
Program Audits |
25 |
1 |
25 |
701 |
|
$89.00 |
$1,559,725* |
|
|
|
|
|
17,525 |
|
|
Information Collection |
Respondents |
Responses (per Respondent) |
Total Responses |
Burden per Response (hours) |
Total Annual Burden (hours) |
Labor Cost of Reporting ($/hr) |
Total Cost |
Yearly Timeliness Monitoring |
157 |
1 |
157 |
120.5 |
18,919 |
$88.00 |
$1,664,872 |
Total |
182 |
1 - 2 |
182** |
Varies |
36,444 |
Varies |
$3,224,597* |
*This total does not account for costs of hiring an independent auditing firm. We estimate that organizations that hire independent auditing firms to conduct validation audits will incur an additional $150,000.
**The total accounts for 1 -2 annual responses per respondent.
|
|
Total Annual Costs ($) |
|
Program Audits |
|
|
1,559,725 |
Independent Auditing (21 x 150,000) |
|
|
3,150,000 |
Timeliness Monitoring |
|
|
1,664,872 |
Total |
|
|
6,374,597 |
13. Capital Costs
There is no capital cost associated with this collection.
The costs to the federal government include staff time to participate in the audit, travel expenses and money used to fund two audit support contracts that are used as staff extenders during audits, but that also perform a host of other audit and enforcement activities outside of activities related to this collection effort.
Staff Time*
CMS staff serve as either team leads (TLs) or DAO Liaisons.
Team leads run their portion of the audit (e.g., CDAG, ODAG, FA, etc.) by administering the protocol and evaluating that portion of the Sponsoring organization’s operation. They are assisted by team members who document all audit findings in the internal audit work papers.
The DAO Liaison oversees the entire audit team to ensure the timely progression of the audit and provides support to the audit team when needed. The DAO Liaison is the primary pointof-contact for auditor-in-charge throughout the audit process and is responsible for the accuracy for audit deliverables. The DAO Liaison may travel to the Sponsoring organization’s location when necessary.
The average annual number of CMS staff conducting program audits is 137. The average number of hours that each CMS staff member spends on an audit is 170. Most CMS auditing staff are GS-12s or GS-13s, with varying step level and locality adjustments. The average total base salary plus locality adjustment for a CMS staff member is roughly $53.00/hr ($110,240 annually)3.
Costs to the government for CMS staff time is as follows:
137 CMS staff x 170 hours/audit = 23,290 hours
23,290 hours x $53/hour = $1,234,370
For two protocols, CDAG and ODAG, CMS is assisted by either a CMS Medical Director or a contracted medical director during the Clinical Decision Making portion of the audit, this portion of the audit generally lasts one to two days. The average number of hours a medical director spends on an audit is 8 hours. There are 2 medical directors per audit, meaning a total of 50 medical directors. Due to limited resources, only 10 of the 50 slots are staffed by a CMS Medical Director, the remaining 40 come from contracted resources and will be included in the section discussing the budget to fund these contracts. The average hourly rate for a CMS Medical Director is $81.00/hr.
Costs to the government for the medical director’s time is as follows:
10 Medical Directors x 8 hours per audit = 80 hours
80 hours x $81.00/hr = $6,480
Total costs to the government for staff time:
CMS staff cost $1,234,270
Total cost $1,240,850
Travel Costs
The total costs of travel for audits has been minimized due to CMS’ use of webinar technology. When necessary, the DAO Liaison and the AIC will travel during the third
3 2023 Salary Table (general schedule) (see https://www.opm.gov/policy-data-oversight/pay-leave/salarieswages/2023/general-schedule) average GS-12 and -13 step 5- 6 plus locality adjustment.
week of the audit to the Sponsoring organization’s location. The total travel costs to the federal government are
$10,000.
Contractor Costs
As previously mentioned, CMS has two audit support contractors that perform a variety of duties beyond just the performance of the audit. The duties performed related to this collection effort include performing AIC duties, performing TL duties, acting as the documenter (i.e., documenting all audit findings) for each audit team, providing the medical director for the CDAG and ODAG portions of the audit, receiving, analyzing and ensuring completeness of all audit data collected from Sponsoring organizations and draft and final audit report generation and any subsequent validation activities. Based on invoices received by the government. Each audit costs CMS approximately $268,000 in contracted resources. Consequently, the total cost to the government in contracted resources is as follows:
$268,000 per audit x 25 audits = $6,700,000
For the Part C timeliness monitoring project, the duties from the contractor include receiving, analyzing and ensuring the completeness of all of the data collected from 157 Sponsoring organizations annually. Additionally, contractors will run validation webinars with the Sponsoring organizations to ensure that the data in each universe contain accurate information. Finally, the contractor will conduct timeliness tests on the universes and report out on the results. We estimate that the cost to the contractors will be $522,025 for this monitoring effort per year. Therefore, we estimate the total contractor costs of this package to be:
$6,700,000 + $522,025 = $7,222,025
Adding up the costs to the government of staff time, travel and contractor costs we can estimate total cost to the government as follows:
Staff Cost |
$1,217,400 |
Travel Cost |
$10,000 |
Contractor Costs |
$7,222,025 |
Total Cost |
$8,472,875 |
CMS has made minimal changes to the collection request. These changes do not impact the burden estimate. As indicated in Section 12, we estimate the total hourly burden for routine program audits at 701 hours to reflect the entirety of the audit process. The total number of routine program audits is estimated at 25 and the corresponding total burden is 17,525 hours.
The total hourly burden for the industry wide timeliness monitoring project remains at 120.5 hours per respondent. As described above, the number of respondents for this timeliness monitoring project is 157 Sponsoring organizations per year. Consequently, the total burden for the industry wide monitoring effort is 18,919 hours.
The information collected during audits may be compiled from all audits in a given year and CMS may include aggregate level results in an annual audit report. The information regarding Part C and Part D program audit results is available on the CMS website at:
https://www.cms.gov/medicare/compliance-and-audits/part-c-and-part-d-compliance-andaudits/programauditresults
The expiration date will be displayed on all of the documents associated with this information, including the following documents:
CPE protocol;
FA protocol;
CDAG protocol;
ODAG protocol;
SNPCC protocol;
Pre-audit issue summary template;
CPE Compliance Officer questionnaire;
CPE FDR questionnaire;
CPE organizational structure and governance template;
FA questionnaire;
SNPCC questionnaire;
Root cause analysis template3;
Independent validation audit work plan template;
Attendance log template
18. Certification Statement
There are no exceptions.
No statistical methods are applied to any of the audit information collected.
1 Once approved by OMB, the Part C and Part D Program Audit protocols will be posted to CMS’ website at: https://www.cms.gov/medicare/compliance-and-audits/part-c-and-part-d-compliance-and-audits/programaudits
2 The ODAG protocol also evaluates the integrated organization determinations, appeals, and grievances of Sponsoring organizations offering an applicable integrated SNP plan with exclusively aligned enrollment as defined at 42 CFR § 422.561.
3 4 For use as needed.
| File Type | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
| File Title | Supporting Statement A 10717 |
| Subject | Program Audit PRA Package |
| Author | CMS |
| File Modified | 0000-00-00 |
| File Created | 2023-10-18 |