CMS-10913 Medicare PartC UM Audit Protocol Data Request

Medicare Part C Utilization Management (UM)

Audit Protocol and Data Request

Contents

UM Audit Protocol 3

Purpose 3

Compliance Standards 4

UM Audit Data Request 6

Audit Engagement and Universe Submission Phase 6

CMS List of Targeted Services 6

UM Supplemental Questions Document 6

Universe Submissions 6

Universe Table 1: Utilization Management Criteria (UMC) Record Layout 7

Audit Field Work Phase 12

Documentation Submissions for Selected Services 12

Initial Submission 12

CMS Review and Data Validation 13

Evidentiary Sources Submission: 13

Root Cause Analysis Submissions 14

Impact Analysis Submissions 14

Impact Analysis Requests 15

Impact Analysis Table 1: UM Internal Criteria Impact Analysis (UMIC-IA) Record Layout

. 15

Verification of Information Collected 17

UM Audit Protocol

Purpose

To evaluate compliance with regulatory requirements identified in this Audit Protocol and Data Request related to Medicare Part C Utilization Management (UM). The Centers for Medicare and Medicaid Services (CMS) performs UM audit activities in accordance with the data requests, compliance standards, and criteria in this Audit Protocol. At a minimum, CMS will evaluate the information collected against the requirements listed below, but reserves the right to modify its scope as requirements are added or revised, or new issues emerge.

Compliance Standards

• For purposes of the following compliance standards, “service” is meant to include all services, items and Part B drugs.

• CMS reserves the right to expand the scope of this audit to ensure Medicare Advantage Organization (MAO) compliance with UM regulatory requirements.

Compliance Standard	Data Request	Method of Evaluation	Criteria Effective 01/01/2024
1.1	Universe Table 1: Utilization Management Criteria	Select up to 20 services for review from the Utilization Management Criteria (UMC) Record Layout. MAO will submit any guidelines, tools, criteria in the format requested by CMS.
1.2	Universe Table 1: Utilization Management Criteria	For each sampled service, review coverage criteria to determine if the MAO created or utilized internal criteria that inappropriately restricted a service that is covered under traditional Medicare by applying a more stringent standard than would apply in traditional Medicare.	42 CFR § 422.101(b)(1)-(3)
1.3	Universe Table 1: Utilization Management Criteria	For each sampled service, review coverage criteria to determine if the MAO created or utilized internal coverage criteria for a service that is fully established under CMS Medicare rules.	42 CFR § 422.101(b)(6)
1.4	Universe Table 1: Utilization Management Criteria	For each sampled service, review criteria to determine if the MAO created or utilized internal coverage criteria that was not based on current evidence in widely used treatment guidelines or clinical literature.	42 CFR § 422.101(b)(6)

Compliance Standard	Data Request	Method of Evaluation	Criteria Effective 01/01/2024
1.5	Universe Table 1: Utilization Management Criteria	For each sampled service, review website to determine if internal coverage criteria is publicly available.	42 CFR § 422.101(b)(6)(ii)
1.6	Universe Table 1: Utilization Management Criteria	For each sampled service, review internal coverage criteria to determine if the MAO has evidence that the UM committee reviewed and approved the internal coverage criteria prior to implementation.	42 CFR § 422.137(b)
1.7	Universe Table 1: Utilization Management Criteria	For each sampled service, review criteria to determine if the MAO has evidence that the UM committee reviewed and approved the internal coverage criteria at least annually.	42 CFR § 422.137(d)(1)
1.8	Universe Table 1: Utilization Management Criteria	For each sampled service, review internal coverage criteria to determine if the MAO has evidence of the UM committee’s decisions regarding the development of UM policies in writing.	42 CFR § 422.137(d)(5)

UM Audit Data Request

Audit Engagement and Universe Submission Phase

CMS List of Targeted Services

CMS will provide each MAO selected for audit with the CMS List of Targeted Services at the time of the audit engagement letter.

UM Supplemental Questions Document

MAOs must complete and return the Medicare Part C UM Supplemental Questions document to CMS within 5 business days of the audit engagement letter date. Reference the UM Supplemental Questions document for additional instructions.

Universe Submissions

MAOs must submit the Utilization Management Criteria (UMC) universe in Microsoft Excel (.xlsx) file format with a header row, and following the instructions outlined in Table 1 below. The universe must be comprehensive of all contracts and Plan Benefit Packages (PBP) identified in the audit engagement letter.

Characters are required in all requested fields, unless otherwise specified, and data must be limited to the request specified in each record layout. MAOs must submit an accurate and timely universe within 15 business days of the audit engagement letter date. Submissions that do not strictly adhere to the record layout specifications will be rejected. MAOs may use the optional excel spreadsheet titled “Utilization Management Criteria (UMC) Record Layout with Examples” to submit the universe. This spreadsheet includes examples of how to populate the requested information.

MAOs do not need to submit any additional information at the time of the universe submission. CMS will use the UMC universe to further narrow and select services for review of criteria in accordance with the instructions in the Audit Field Work Phase of this protocol.

Please use the guidance below for the following record layout:

Universe Table 1: Utilization Management Criteria (UMC) Record Layout

• For purposes of the following record layout, “service” is meant to include all services, items and Part B drugs.

• Include all services identified on the CMS List of Targeted Services and complete a separate row for each.

• Unless the instructions in the description column indicate otherwise, enter the requested information based on the status of the service at the time the universe is submitted to CMS, taking into account all first tier, downstream, and related entities (FDRs), localities, contracts and/or plan benefit packages (PBPs).

• Enter information in each field (i.e., no blank fields). If the field does not apply to the specific service, enter NA.

• Enter information in the specific formatting requested (when applicable).

Column ID	Field Name	Description
A	Name of Service	Enter the name of the Medicare service as identified by the CMS List of Targeted Services.
B	Fully Established	Does your organization consider the coverage criteria in Medicare for this service to be fully established by CMS as defined by § 422.101(b)(6)(i) in any of the jurisdictions applicable to your organization’s service area(s)? Enter Y for Yes if your organization considers the service to be fully established in any jurisdiction applicable to your organization’s service area(s). Enter N for No if your organization does NOT consider the service to be fully established in any jurisdiction applicable to your organization’s service area(s).

Column ID	Field Name	Description
C	Fully Established Medicare Administrative Contractor (MAC) Jurisdictions	Please identify all MAC jurisdictions where your organization considers the Medicare service to be fully established. When entering the jurisdiction, enter “J-” and the jurisdiction code. For example, J-5. MAC jurisdiction codes are available at: https://www.cms.gov/medicare/coding-billing/medicare- administrative-contractors-macs/who-are-macs If the service is fully established in multiple MAC jurisdictions, enter all of the jurisdictions using a comma- separated list. If the service is fully established in all MAC jurisdictions, enter “All.” Enter NA if you believe this service is not fully established in any jurisdiction.
D	Not Fully Established- No Applicable Medicare Rules (422.101(b)(6)(i)(C))	Did your organization determine the service was not fully established because there were no applicable Medicare rules related to the service (e.g., regulations, NCDs and/or LCDs) in any jurisdiction applicable to your organization’s service area(s)? Enter Y if Yes. Enter N if No. Enter NA if your organization considers this service fully established in all jurisdictions.

Column ID	Field Name	Description
E	Not Fully Established- Interpretation Needed	Did your organization determine the service was not fully established because criteria was needed to interpret or supplement general provisions in order to consistently render medical necessity decisions, as allowed in § 422.101(b)(6)(i)(A) in any jurisdiction applicable to your organization’s service area(s)? Enter Y if Yes. Enter N if No. Enter NA if your organization considers this service fully established in all jurisdictions.
F	Not Fully Established- Flexibility Explicitly Allowed	Did your organization determine the service was not fully established because either an NCD or LCD includes flexibility that explicitly allows for coverage in circumstances beyond the specific Medicare indications, as allowed in § 422.101(b)(6)(i)(B) in any jurisdiction applicable to your organization’s service area(s)? Enter Y if Yes. Enter N if No. Enter NA if your organization considers this service fully Established in all jurisdictions.
G	Internal Coverage Criteria	Does your organization, including any FDRs, currently utilize internal coverage criteria to render medical necessity decisions for this service in any jurisdiction applicable to your organization’s service area(s)? Enter Y if Yes. Enter N if No.

Column ID	Field Name	Description
H	Total Number of Internal Coverage Criteria Policies and Documents	Enter the number of unique internal coverage criteria policies or documents are currently utilized by your organization (including any FDRs) to render medical necessity decisions related to this service. Example: if your organization utilizes a third-party vendor that has 20 different internal coverage criteria policies related to CT scans, enter 20.
I	Previous Coverage Guidelines	Did your organization, including any FDRs, create or utilize internal coverage criteria for this service for any portion of the current calendar year (even if not currently used by your organization)? Enter Y if Yes. Enter N if No.
J	Organization or Vendor	Enter the name(s) of any entity (your organization and/or any vendors) that developed, assisted with developing, or is responsible for updating the internal coverage criteria related to this service using a comma-separated list (e.g., MCG). Enter NA if no vendors are utilized.
K	Internal Coverage Criteria Supported by Evidence	Does your organization have documentation to support that all internal coverage criteria for this service are supported by widely used treatment guidelines or clinical literature? Enter Y for Yes. Enter N for No. Enter NA if there is no internal coverage criteria used for this service.

Column ID	Field Name	Description
L	Website Link(s)	Provide a direct link or links to the webpage or webpages where all internal coverage criteria for this service can be found. At a minimum, the link(s) provided must allow CMS to easily navigate to the identified criteria. If there are multiple links, please provide all applicable links using a comma separated list. Enter NA if no internal coverage criteria has been adopted or used for the identified service.

Audit Field Work Phase

Documentation Submissions for Selected Services

CMS will review the submitted UMC universe and select a subset of up to 20 services to review. The MAO will then be asked to submit all coverage criteria applicable to the selected services, including any coverage criteria used by FDRs for purposes of rendering medical necessity decisions. CMS will evaluate the criteria to determine whether the MAO is compliant with its Medicare Part C contract requirements, as outlined in the Compliance Standards found in this protocol.

Initial Submission

The following initial submissions must be submitted for each of the selected services within 15 business days of the request:

For selected services with internal coverage criteria:

• All internal coverage criteria created or utilized by the MAO related to the selected services in the universe.

• In addition to all internal coverage criteria policies, the MAO must also submit the Analysis of Internal Coverage Criteria spreadsheet with Part 1 and Part 2 columns A-E completed for each internal coverage criterion.

• For all internal coverage criteria, documentation, meeting minutes, and notes from the MAO’s UM committee, including:

  • Dates of all meetings where UM requirements for the selected services were discussed,

  • Documentation that demonstrates when coverage criteria for the selected services were reviewed and approved (e.g., before 1/1/2026), and

• For all internal coverage criteria, documentation of all decisions related to the coverage criteria from the UM committee.

For all services (regardless of whether there is internal coverage criteria):

• Any instructional guidelines, operational tools, decision trees, algorithms, or other methods of communicating coverage criteria to clinicians or other staff rendering medical necessity decisions within the MAO or to any applicable FDRs.

• If the MAO does not have a system capable of searching by service name or some other similar identifier, the MAO will be asked to submit a report of denials for each of the selected services.

  • The denial report does not need to be formatted in a specific way but should

include the minimum information necessary for CMS to target potential beneficiary level denials to review in the system for each of the selected services.

• If a denial report is requested, CMS will attempt to limit the timeframe of the request to 2 months of information. If there are no denials within that time period, CMS will expand the timeframe in order to collect sufficient information.

CMS Review and Data Validation:

Upon receipt of the initial submission, CMS will review all criteria, tools, guidelines, analyses of criteria and UM committee minutes. CMS will validate the accuracy and completeness of an organization’s coverage criteria, including when the MAO indicates a selected service does not have internal coverage criteria, through one or more of the mechanisms below:

• Review denial notification letters issued during the data request period for sampled services.

  • CMS will attempt to select and review denial letters by searching the MAO’s (or their FDR’s) electronic systems during a live webinar.

  • If CMS is unable to locate denials through a live webinar, we will request a report of denials for selected services (i.e., the 20 targeted services) and then conduct a live webinar to review denial letters.

• Require an organization to participate in webinars in which CMS reviews the organizations’ systems live, including the screen share of coverage criteria, guidelines, and decision-making tools.

CMS may request additional information, including but not limited to a revised UMC universe submission or additional analyses of criteria from an MAO based on the results of the data validation.

Evidentiary Sources Submission:

Following review and data validation, CMS will review the evidentiary sources of selected internal criteria at the criterion level. CMS will flag internal coverage criteria selected for the review of evidentiary sources by populating column F in the Analysis of Internal Coverage Criteria. For those selections, the MAO will provide the citation(s) for the evidentiary source(s) used to create each selected internal coverage criterion by populating column G of the Analysis of Internal Coverage Criteria. MAOs may also be asked to provide copies or documentation of the evidentiary source(s) if CMS is unable to navigate to the source directly.

MAOs must submit the requested information within 10 business days of the request. Extensions may be granted dependent on the quantity and complexity of the internal coverage criteria being reviewed.

Root Cause Analysis Submissions

MAOs may be required to provide a root cause analysis using the Root Cause Template provided by CMS. MAOs have two business days from the date of the request to respond.

Impact Analysis Submissions

When non-compliance with UM requirements is identified on audit, MAOs must submit each requested impact analysis, comprehensive of all contracts and Plan Benefit Packages (PBP) identified in the audit engagement letter, in the Microsoft Excel (.xlsx) file provided by CMS. Descriptions and clarifications of what must be included in each submission and data field is outlined in the individual table below. Characters are required in all requested fields, unless otherwise specified, and data must be limited to the request specified in each table. MAOs must provide accurate and timely impact analysis submissions within 10 business days of the request. Extensions will be granted on a case-by-case basis depending on the services requested within the impact analysis. Submissions that do not strictly adhere to the record layout specifications will be rejected.

Impact Analysis Requests

Impact Analysis Table 1: UM Internal Criteria Impact Analysis (UMIC-IA) Record Layout

• CMS will fill out Columns A, B, and C prior to requesting an Impact Analysis submission.

• Submit the requested information in Columns D through P.

• Timeframes will be determined by CMS prior to requesting the impact analysis and will be based on size of the organization and type of service(s).

• Timeframes may be expanded to include the entire calendar year if the service is rarely requested, or the organization is small. For purposes of this impact analysis, for data fields that mention reconsiderations, only enter information on Level 1 reconsiderations.

• For purposes of the following impact analysis, “service” is meant to include all services, items and Part B drugs.

• Pull data for this IA based on when you processed a request or determination.

  • The date a request or determination was “processed” may include the date you approved, denied, dismissed, auto-forwarded or otherwise issued a determination.

  • For payment requests “processed” includes the date of payment or notification of denial, or for upheld reconsiderations, the date the case was forwarded to the IRE.

Column ID	Field Name	Description
A	Service	CMS will enter the name of the service as identified by the CMS List of Targeted Services.
B	Internal Criteria	CMS will enter the name(s) of the internal coverage criteria and guideline documents that were determined to be inappropriate.
C	Timeframe for Service	CMS will enter the timeframe the organization should review for each specific service.
D	Total Initial Determinations related to Service	Enter the total number of initial determinations processed related to this service, regardless of how the organization classified the request, including but not limited to prior authorization requests, concurrent reviews, retrospective reviews, payment reviews.

Column ID	Field Name	Description
E	Total Organization Determinations/ Initial Determinations (service)	Enter the total number of organization determinations/initial determinations (service) processed by your organization related to this service. Do not include payment organization determinations.
F	Total Denied Organization Determinations/Initial Determinations (service)	Enter the total number of organization determinations/initial determinations (for services) denied by your organization related to this service. Do not include payment organization determinations.
G	Total denied Organization Determinations/ Initial Determinations Resulting from the use of Inappropriate Criteria and/or Guidelines (service)	Enter the number of organization determinations/ initial determinations (service) that were denied as a result of the use of inappropriate coverage criteria and/or guidelines for this service. Do not include payment organization determinations.
H	Total Organization Determinations/ Initial Determinations (payment)	Enter the total number of organization determinations/ initial determinations (payment) processed by your organization related to this service.
I	Denied Organization Determinations/ Initial Determinations (payment)	Enter the total number of organization determinations/ initial determinations denied by your organization related to this service.
J	Denied Organization Determinations/ Initial Determinations (payment) Resulting from the use of Inappropriate Criteria and/or Guidelines	Enter the number of organization determinations/ initial determinations (payment) that were denied as a result of the use of inappropriate coverage criteria and/or guidelines for this service.

Column ID	Field Name	Description
K	Total Reconsiderations Requests (service)	Enter the total number of reconsideration requests (service) processed by your organization related to this service.
L	Denied Reconsideration Requests (service)	Enter the total number of reconsideration determinations (service) denied by your organization for this service.
M	Denied Reconsideration Requests (service) Resulting from the use of Inappropriate Criteria and/or Guidelines	Enter the number of reconsideration determinations (service) that were denied as a result of the use of inappropriate coverage criteria and/or guidelines service.
N	Total Reconsiderations Requests (payment)	Enter the total number of reconsideration requests (payment) processed by your organization related to this service.
O	Denied Reconsideration Requests (payment)	Enter the total number of reconsideration determinations (payment) denied by your organization related to this service.
P	Denied Reconsideration Requests (payment) Resulting from the use of Inappropriate Criteria and/or Guidelines	Enter the number of reconsideration determinations (payment) that were denied as a result of the use of inappropriate coverage criteria and/or guidelines.

Verification of Information Collected

CMS may conduct integrity tests to validate the accuracy of all universes, impact analyses, and other related documentation submitted in furtherance of the audit. If data integrity issues are noted, MAOs may be required to resubmit their data.

According to the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it displays a valid OMB control number. The valid OMB control number for this information collection is OMB 0938-New. This information collection will allow CMS to conduct a comprehensive review of Sponsoring organizations’ compliance with Medicare Part C utilization management (UM) requirements. The time required to complete this information collection is estimated at 410 hours per response, including the time to review instructions, search existing data resources, gather the data needed, to review and complete the information collection. This information collection is mandatory per CMS’s authority under Section 1857(d) of the Social Security Act and implementing regulations at 42 CFR § 422.503 and § 422.504, which state that CMS must oversee a Medicare Advantage (MA) organization’s continued compliance with the requirements for a MA organization. Additionally, per § 422.516(a), MA organizations are required to compile and report to CMS information related to the utilization of services, and other matters as CMS may require. If you have comments concerning the accuracy of the time estimate or suggestions for improving this form, please write to: CMS, 7500 Security Boulevard, Attn: PRA Reports Clearance Officer, Mail Stop C4-26-05, Baltimore, Maryland 21244- 1850.

Page 17 of 17