New York State Proposes Changes to Medicaid Fraud, Waste and Abuse Prevention Programs and its Compliance Program Requirements 

The New York State Office of Medicaid Inspector General (OMIG) has proposed regulations (the “Regulations”) to revamp its provider compliance program and enforcement. The proposed regulations are in the State Register and address (a) provider compliance programs; (b) Medicaid managed care plan organization (MMCO) fraud, waste and abuse prevention programs; and (c) the reporting and returning of Medicaid overpayments to OMIG.

Provider Compliance Programs

The Regulations propose to repeal the current Provider Compliance Program regulatory requirements and replace them with a new Subpart 521-1, which imposes obligations on “required providers” to adopt and implement effective compliance programs. “Required providers” include LHCSAs, other Article 36 entities, as well as Article 28, 16 and 31 entities (including MLTCs) and any other entity for which Medicaid is a substantial portion of its business.  

Additionally, the Regulations include several new requirements that do not appear in existing regulations, including:

  • 10-year document retention requirements for managed care organizations (“MCOs”) and a 6-year document retention period for all other “required providers.”
  • All compliance program requirements expressly apply to the required providers’ contractors, agents, subcontractors, and independent contractors.
  • A new “risk area” — contractors, subcontractors, agents and independent contractor oversight – must be considered by all required providers, and a number of additional “risk areas” must also be considered by MCOs (including MLTCs).
  • Providers that are “required providers” must submit a compliance certification to each MCO for which they are a participating provider upon execution of the MMCO’s participating provider agreement and annually thereafter (and the submission method shall be described on the MCO’s website).
  • Required providers must comply with OMIG’s regulations regarding Medicaid overpayments.
  • Specifically enumerating the compliance officer’s duties, including his or her reporting structure. Notably, under the proposed regulations, the compliance officer is no longer required to be an “employee” of the covered provider.
  • Establish and implement an effective system for the routine monitoring and identification of compliance risks, including the types of audits the provider must undertake and the frequency of such audits.
  • Establish and maintain procedures for responding to and addressing compliance issues as they are raised.

MMCO Fraud, Waste and Abuse Programs

The Regulations – with respect to Medicaid fraud, waste, and abuse programs – would apply to all MLTCs, regardless of member enrollment, and further require the establishment of a dedicated full-time Special Investigation Unit (with details about staffing, reporting and work plan requirements) if the MCO has an enrolled population of 1,000 or more.

Some of the more significant requirements in proposed Subpart 521-2 that do not appear in existing regulations, include:

  • Audit and investigation requirements which include the scope of such audits and investigations and the general requirements for conducting such audits and investigations.
  • Obligations to report cases of fraud, waste and abuse to OMIG in accordance with the MMCO’s contract with the Department of Health.
  • Obligation to file a fraud, waste and abuse prevention plan with OMIG 

Medicaid Overpayments

The Regulations reinforce that covered providers or individuals must report, explain and return Medicaid overpayments to OMIG. The term “person” includes home care agencies, hospices and MCOs (including MLTCs and their contractors and participating providers) and virtually any other provider or supplier that is enrolled in the Medicaid program. A reportable incident (and the timeline for reporting the same) begins when the covered individual “has or should have through the exercise of reasonable diligence, determined that they received an overpayment and quantified the amount of the overpayment.”

Comment Period

The regulation will be subject to a 60-day public comment period. Providers who might have comments to the proposed regulations can reach out to our firm and request that comments be formally submitted to the State on their behalf.