(ATTACHMENT VI) COMPLIANCE PROGRAM EFFECTIVENESS SELF ... · Directions for completing the self-assessment questionnaire: This document will assist your organization in evaluating

(ATTACHMENT VI) COMPLIANCE PROGRAM EFFECTIVENESS

SELF-ASSESSMENT QUESTIONNAIRE

Page 1 of 25

Name of Sponsoring Organization:______________________________________________

MA-PD/PDP Contract Numbers: _______________________________________________

Name/Title of Person Completing Assessment: ____________________________________

Date of Assessment:__________________________________________________________

Directions for completing the self-assessment questionnaire: This document will assist your organization in evaluating the effectiveness of your Medicare Compliance Program. Please read each question carefully and respond according to the current status of your Compliance Program. If the answer is “YES” to any question below, check the “YES” box and provide a BRIEF description of what supports that response in the “Evidence of Compliance” column. The Evidence of Compliance description should also provide a cross reference (when applicable) to where the evidence supporting the “Yes” response can be located. For example, if your response is “YES” to the third question below (“Do your written Ps & Ps and Standards of Conduct articulate the organization’s commitment to comply with all applicable Federal and State standards including but not limited to statutes, regulations and sub regulatory guidance”), please indicate what section/page of the Standards of Conduct and policies and procedures where these compliance provisions are found. If the answer is “No” to a question, check the “No” box and document the rationale for the response in the “…or Action Required” column. In the “Measuring Effectiveness of Your Compliance Program” section, please read each question carefully and mark the appropriate letter(s) box for each question. The final set of questions permit a more thorough (but still brief) explanation of particular internal controls within your organization related to Medicare Non-Compliance and Fraud, Waste and Abuse. Please specifically note the following when completing the questionnaire:

References to “you” refer to your organization, not necessarily a specific person.

References to the board of directors, CEO and highest level of the organization’s management are to the board, CEO and management of the parent organization.

Unless specific reference is made in the question to the “full board” the term “board of

directors” means either the full board or a committee of the board delegated to conduct oversight of the day-to-day operation of the Medicare compliance program on behalf of the full board.



Page 2 of 25

Element I: Written Policies and Procedures and Standards of Conduct

42 CFR §422.503(b)(4)(vi)(A) and 42 CFR §423.504(b)(4)(vi)(A)

Description Yes No

Evidence of Compliance or

Action Required 1. Do you have written policies and

procedures (Ps & Ps) and Standards of Conduct that address Medicare program compliance?

2. Do you have written Ps & Ps and Standards of Conduct that address Medicare fraud, waste and abuse (FWA)?

3. Do your written Ps & Ps and Standards of Conduct articulate the organization’s commitment to comply with all applicable Federal and State standards, including but not limited to, all applicable statutes, regulations and sub-regulatory guidance?

4. Do your written Ps & Ps and Standards of Conduct describe compliance expectations of employees?

5. Do your written Ps & Ps and Standards of Conduct describe the ramifications for your employees’ and FDRs’ failure to meet compliance expectations?

6 Do your written Ps & Ps and Standards of Conduct implement the operation of the compliance program?

7 Do your written Ps & Ps and Standards of Conduct provide guidance to employees on dealing with potential Medicare program compliance and FWA issues?



Page 3 of 25



Description Yes No


Action Required

8 Do your written Ps & Ps and Standards of Conduct provide guidance to FDRs on dealing with potential Medicare program compliance and FWA issues?

9 Do your written Ps & Ps and Standards of Conduct explain how employees can communicate compliance and FWA issues to appropriate compliance personnel?

10 Do your written Ps & Ps and Standards of Conduct explain how FDRs can communicate compliance and FWA issues to appropriate compliance personnel?

11 Do your written Ps & Ps and Standards of Conduct describe how potential compliance and FWA issues are investigated and resolved?

12 Do your written Ps & Ps and Standards of Conduct include a policy of non-intimidation and non-retaliation against employees for good faith participation in the compliance program, including but not limited to reporting potential issues, investigating issues, conducting self-evaluations, audits and remedial actions, and reporting to appropriate officials?



Page 4 of 25



Description Yes No


Action Required 13 Do your written Ps & Ps and

Standards of Conduct include a policy of non-intimidation and non-retaliation against FDRs for good faith participation in the compliance program, including but not limited to reporting potential issues, investigating issues, conducting self- evaluations, audits and remedial actions, and reporting to appropriate officials?

14 Do your written Ps & Ps and Standards of Conduct state the obligation of employees and board members to report Medicare program noncompliance to the organization, CMS, or CMS’ designee (such as the MEDICs)?

15 Do your written Ps & Ps and Standards of Conduct state the obligation of FDRs to report Medicare program noncompliance to the Sponsor, CMS, or CMS’ designee (such as the MEDICs)?

16 Do your written Ps & Ps and Standards of Conduct state the obligation of employees and board members to report FWA and violations of law to the organization, CMS, CMS’ designee (such as the MEDICs) and/or to law enforcement?

17 Do your written Ps & Ps and Standards of Conduct state the



Page 5 of 25



Description Yes No


Action Required obligation of FDRs to report FWA and violations of law to the Sponsor, CMS, CMS’ designee (such as the MEDICs) and/or to law enforcement?

18 Do your written Ps & Ps and Standards of Conduct include a process for all board members, employees, volunteers, consultants, and P & T committee members to submit a statement regarding conflict of interest at least annually?

19 Do your written Ps & Ps and Standards of Conduct include a requirement that all board members, employees, volunteers, consultants and P & T committee members immediately notify the compliance officer whenever a potential or actual conflict of interest arises?

20 Do you require FDRs to obtain from its board members and employees, volunteers, consultants, and P & T committee members, if any, conflict of interest statements at least annually?

21 Do you require FDRs to certify or attest that they have obtained from their board members and employees, volunteers, consultants, and P & T committee, if any, conflict of interest statements at least annually?

22 Do you distribute hard copies of your Standards of Conduct and Ps & Ps to



Page 6 of 25



Description Yes No


Action Required your board members and employees upon hire and annually thereafter?

23 Do you distribute your Standards of Conduct to your FDRs?

24 If the answer to the question above (#23) is “no”, do you require that your FDRs adopt and follow Standards of Conduct that reflect a commitment to preventing, detecting, and correcting noncompliance with Medicare program requirements and FWA?

25 Do you require your employees, as a condition of employment, to provide a written or electronic certification that they have received, read, understood and will comply with all written Standards of Conduct?

26 Do you require certification or attestation from your FDRs that they have obtained written or electronic certifications from their employees and that, as a condition of employment/contract, they have received, read, understood and will comply with all written Standards of Conduct?

27 Are your Standards of Conduct approved by your board of directors?

28 Do you have written Ps & Ps requiring all board members, employees, volunteers, consultants who have any



Page 7 of 25



Description Yes No


Action Required responsibilities related to the Medicare Parts C and D programs and members of the P & T Committee to be screened against the OIG and GSA exclusion lists upon hire and at least annually thereafter?

29 Do you have written Ps & Ps requiring FDRs to screen all their board members, employees, volunteers, consultants and members of the P & T Committee against the OIG and GSA exclusion lists upon hire and at least annually thereafter?

30 Do you have written Ps & Ps requiring the immediate removal of any excluded person or entity from any position directly or indirectly related to Federal health care programs?

31 Do you have written Ps & Ps requiring immediate removal of any excluded person or entity that furnishes, orders or prescribes items or services that are paid in whole or in part, directly or indirectly from Federal funds?

32 Do you have written Ps & Ps that require appropriate corrective action such as repayment for items or services paid for by Federal funds that were ordered, furnished or prescribed by an excluded person or entity?

33 Do you have written Ps & Ps requiring all board members, employees,



Page 8 of 25



Description Yes No


Action Required volunteers, consultants who have any responsibilities related to the Medicare Parts C and D programs and members of the P & T Committee to disclose their exclusion from participation in Federal health care programs?

34 Do you have written Ps & Ps requiring FDRs to disclose their exclusion and that of their employees from participation in Federal health care programs?

35 Do you have written Ps & Ps requiring FDRs to attest to their screening of all employees against the OIG and GSA exclusion lists upon hire and at least annually thereafter?

Element II: Compliance Officer and Compliance Committee

42 CFR §422.503(b)(4)(vi)(B) and 42 CFR §423.504(b)(4)(vi)(B)

Description Yes No Evidence of Compliance

or Action Required

36 Does your Medicare Compliance Officer report directly to the chief executive officer (CEO) of your organization?

37 If the answer to the above question (#36) is “no,” explain the Medicare Compliance Officer’s reporting structure.



Page 9 of 25




or Action Required

38 Is your Medicare Compliance Officer your employee or that of your organization’s parent company or affiliate, if any?

39 Is there a Medicare Compliance report at least quarterly to the board of directors?

40 Does the Medicare Compliance report to the board of directors include the activities and status of the Medicare compliance program, including issues identified, investigated and resolved by the Medicare compliance program?

41 Does your Medicare Compliance Officer devote his/her full time to the Medicare Compliance program? If your answer is “no,” please identify all other duties he/she is responsible for and the percentage of time devoted to the Medicare compliance program and each of his/her other such duties.

42 Are the products of the Medicare Compliance Committee reported directly to the CEO?

43 If the answer to the above question (#42) is “no”, describe where the products of the Medicare Compliance Committee are reported.

44 Are the products of the Medicare Compliance Committee reported at least quarterly to the board of



Page 10 of 25




or Action Required

directors?

45 When the products of the Medicare Compliance Committee are reported to the board of directors does the report include the activities and status of the Medicare compliance program, including Medicare program compliance issues and FWA identified, investigated and resolved by the Medicare compliance program?

Element III: Training and Education

42 CFR §422.503(b)(4)(vi)(C) and 42 CFR §423.504(b)(4)(vi)(C)


or Action Required

46 Do you require employees who have responsibilities related to the Medicare program to have general compliance training on the structure and operation of the Medicare compliance program upon initial hiring and annually thereafter?

47 Do you require all board members who oversee any aspect of the Medicare program (including board members of the parent company, if applicable), to have general compliance training on the structure and operation of the Medicare compliance program upon initial hiring and annually thereafter?



Page 11 of 25




or Action Required

48 Do you require FDRs’ employees to receive general Medicare program compliance training upon initial hiring/contracting and annually thereafter?

49 Do you review and approve the general compliance training provided to FDRs’ employees in advance?

50 Do you require employees to have specialized compliance training on issues posing Medicare compliance risks based on their job function?

51 Is such specialized compliance training provided upon hire, when requirements change, when an area has been found to be noncompliant and at least annually thereafter?

52 Do you require your FDRs to have specialized compliance training related to their Medicare Parts C and/or D responsibilities?

53 Do you review and approve in advance specialized compliance training provided to FDRs’ employees?

54 Do you require all non-deemed employees of FDRs ((i.e. employees of FDRs who have not met the FWA certification requirements through enrollment into the Medicare program) to have FWA training upon hire and at least annually thereafter?



Page 12 of 25




or Action Required

55 Do you provide the FWA training materials for employees of pharmacies in your plans’ networks?

56 If the answer to the above question (#55) is “no”, does your PBM provide the FWA training materials for employees of pharmacies in your plans’ networks?

57 If the answer to the above question (#56) is “yes,” do you review and approve the training materials in advance?

58 Do you take steps to ensure that pharmacies do not provide their own FWA training materials to their employees?

59 For FDRs other than pharmacies, do you provide them with FWA training materials?

60 If the answer to the above question (#59) is “no,” do you review and approve FWA training materials provided by FDRs to their employees?

61 Does the FWA training provided to your employees, board members and FDRs include an overview of HIPAA, the CMS Data Use Agreement and the importance of maintaining confidentiality of Personal Health Information?

62 Do you measure the effectiveness of required training, such as pre and post



Page 13 of 25




or Action Required

training testing, or using other measures?

63 Do monitor your employees to ensure that those who do not receive FWA training meet the requirements to be designated as deemed?

64 Do you monitor the employees of your FDRs to ensure that those who do not receive FWA training meet the requirements to be designated as deemed?

Element IV: Effective Lines of Communication 42 CFR §422.503(b)(4)(vi)(D) and 42 CFR §423.504(b)(4)(vi)(D)


or Action Required

65 Are there one or more methods for employees to report Medicare program noncompliance and FWA to the Medicare Compliance Department, such as hot lines, suggestion boxes, employee exit interviews, emails or other methods?

66 Is there at least one method to report Medicare program noncompliance and FWA that is anonymous, such as a hotline?

67 Are the methods of reporting Medicare noncompliance and FWA available to all employees and board



Page 14 of 25



or Action Required

members?

68 Are the methods of reporting Medicare program noncompliance and FWA available 24 hours a day, seven days a week?

69 Are there one or more methods for employees of FDRs to anonymously report Medicare program noncompliance and FWA to the Sponsor’s Medicare Compliance Department, such as a hotline, a website or other methods?

70 Are the methods for employees of FDRs to report Medicare program noncompliance or FWA available to all such employees 24 hours a day, seven days a week?

71 Are there one or more methods for enrollees to anonymously report Medicare program noncompliance and FWA to the Medicare Compliance Department, such as a hotline or web site?

72 Are the methods of reporting Medicare program noncompliance or FWA available to all enrollees 24 hours a day, seven days a week?

73 Do you widely publicize to employees the method(s) for reporting Medicare program noncompliance and FWA?



Page 15 of 25



or Action Required

If the answer is “yes,” identify how publication is made and what documents support the conclusion.

74 Do you require FDRs to widely publicize to their employees the method(s) for reporting Medicare program noncompliance and FWA? If the answer is “yes,” identify how publication is made and what documents reflect the conclusion.

75 Do you widely publicize to enrollees the method(s) for reporting Medicare program noncompliance or FWA? If the answer is yes, identify how publication is made and what documents reflect the conclusion.

76 Do you instruct enrollees on how to recognize potential FWA?

77 Do you initiate investigations stemming from reported inquiries and complaints within two weeks of receiving the inquiry or complaint?

78 Do you initiate investigations of FWA reports within three days of receipt of the report?

79 Do you conclude investigations of FWA reports within 60 calendar days of receipt, unless you can justify an extension?



Page 16 of 25



or Action Required

80 If you cannot meet the above deadlines with regard to FWA reports, do you refer the matter to the MEDIC within two weeks of receipt of the report?

81 Do you track reported concerns and issues including the status of related investigations and corrective actions?

82 Do you require that concerns and inquiries reported to other departments within the organization (such as the SIU or the Human Relations Department) that concern Medicare program noncompliance or FWA be shared with the Medicare Compliance Department?

83 Do you require that concerns or inquiries reported to supervisors that concern Medicare program noncompliance or FWA be reported to the Medicare Compliance Department?

84 Do you analyze reported concerns and inquiries to identify patterns of possible misconduct within your organization or by pharmacies, other providers, PBMs, and beneficiaries?



Page 17 of 25

Element V: Enforcement of Disciplinary Standards 42 CFR §422.503(b)(4)(vi)(E) and 42 CFR §423.504(b)(4)(vi)(E)


or Action Required

85 Do you have disciplinary standards that include policies that articulate the obligation to report compliance issues and FWA?

86 Do your disciplinary standards include policies that articulate the obligation to assist in the resolution of compliance and FWA issues?

87 Do your disciplinary standards include policies that describe noncompliant or unethical behavior?

88 Do your disciplinary standards include policies that provide for timely, consistent and effective enforcement of the standards in the event of noncompliant or unethical behavior?

89 Are your disciplinary standards clear and specific in identifying the consequences for violation of the Standards of Conduct?

90 Are your disciplinary standards widely publicized to your employees? If “yes,” identify how they are publicized and identify documentation or other evidence of this conclusion.

91 Do you require your FDRs to take disciplinary action when noncompliant or unethical behavior is determined?



Page 18 of 25

Element VI: Auditing and Monitoring 42 CFR §422.503(b)(4)(vi)(F) and 42 CFR §423.504(b)(4)(vi)(F)


or Action Required

92 Do you conduct internal monitoring?

93 Does your internal monitoring test your organization’s compliance with Medicare Parts C and D regulations, sub-regulatory guidance, contractual agreements, applicable Federal and state laws and internal policies and procedures and standards of conduct?

94 Does your internal monitoring test for FWA in the Medicare program?

95 Do you conduct monitoring of your FDRs?

96 Does your monitoring of FDRs test their compliance with Part C & D regulations, sub-regulatory guidance, contractual agreements, applicable Federal and state laws and internal policies and procedures and Standards of Conduct?

97 Does your monitoring of FDRs test for FWA?

98 Do you monitor your FDRs’ activities in counties designated as high risk for FWA?

99 Do you audit your organization’s Medicare operations?



Page 19 of 25



or Action Required

100 Do your audits test your organization’s compliance with Parts C and D regulations, sub-regulatory guidance, contractual agreements, applicable Federal and state laws and internal policies and procedures and Standards of Conduct?

101 Do your audits test for FWA in the Medicare program?

102 Do you audit your FDRs?

103 Do your audits of FDRs test their compliance with Parts C and D regulations, sub-regulatory guidance, contractual agreements, applicable Federal and state laws and policies and procedures and Standards of Conduct?

104 Do your audits of FDRs test for FWA?

105 Do you audit your FDRs’ activities in counties designated as high risk for FWA?

106 Do you conduct a risk assessment of your Medicare Parts C and D operations at least annually?

107 If the answer to the above question is “yes”, briefly describe the process for conducting the risk assessment.



Page 20 of 25



or Action Required

108 Do you conduct a risk assessment of your FDRs’ operations at least annually?

109 If the answer to the above question is “yes”, briefly describe the process for conducting the risk assessment

110 Do your risk assessments evaluate your organization’s risk of noncompliance with Medicare Parts C and D requirements and applicable Federal and state laws?

111 Do your risk assessments evaluate the risks of FWA?

112 Briefly describe the processes, controls and other procedures used to mitigate FWA risk.

113 Do your risk assessments evaluate the risk of FWA specifically in the counties designated as high risk for FWA?

114 Do you prioritize your monitoring activities based upon your risk assessments?

115 Do you have a work plan for internal monitoring of your organization?

116 Do you have a work plan for monitoring your FDRs?



Page 21 of 25



or Action Required

117 Do you have a work plan for auditing within your organization?

118 Do you have a department devoted solely to auditing your Medicare Parts C and D operations?

119 If the answer to the above question above is “no,” describe who conducts your auditing of Medicare Parts C and D operations.

120 Do those who perform audits have expertise in the areas under review, such as pharmacists, nurses, physicians and CPAs?

121 Do those who perform audits of Medicare Parts C and D operations have expertise in Medicare Parts C and D requirements?

122 Do you prioritize your auditing activities within your organization based upon your risk assessments?

123 Do you have a work plan for auditing FDRs?

124 Do you prioritize your auditing activities of FDRs based upon your risk assessments?

125 Do you use dashboards, scorecards or other mechanisms to measure Medicare program compliance?



Page 22 of 25



or Action Required

126 Are the dashboards, scorecards or other measurements tracked by the highest level of management in each operational area?

127 Are the dashboards, scorecards or other measurements publicized to staff and employees?

128 Are the results on dashboards, scorecards or other measurements tied to staff, management, and executive performance evaluations and/or compensation?

129 Are the results on dashboards, scorecards or other measurements of FDR compliance tied to FDR compensation? If so, state whether this requirement is provided for in the FDR/ Sponsor contract.

130 Are the results on dashboards, scorecards or other measurements reported to the CEO and board of directors at least quarterly?

131 Do you evaluate the effectiveness of the Medicare compliance program at least annually?

132 Is your evaluation of the effectiveness of the Medicare compliance program reported to the board of directors and CEO?



Page 23 of 25



or Action Required

133 In order to avoid overutilization of prescription medication, as typically seen in fraudulent drug seeking behavior and diversion, do you require the use of point-of-sale safety edits (such as refill-too-soon, therapeutic duplication and maximum quantity exceeded edits) to prevent the payment of redundant prescriptions?



Page 24 of 25

Element VII: Prompt and Effective Response to Detected Offenses 42 CFR §422.503(b)(4)(vi)(G) and 42 CFR §423.504(b)(4)(vi)(G)


or Action Required

134 Do you have procedures for promptly responding to compliance and FWA issues as they are raised?

135 Do you investigate potential compliance and FWA problems that are identified through monitoring, auditing and self-evaluation?

136 Do you correct compliance and FWA problems promptly after they are identified?

137 Do you initiate investigation into evidence of misconduct related to payment or delivery of items or services within three business days of its discovery?

138 Do you conclude your investigation of potential misconduct related to payment or delivery of items or services within 60 calendar days, unless you can justify an extension?

139 If you do not have the time or resources to investigate the potential misconduct, do you have procedures requiring referral of the matter to the MEDIC within two weeks of the identification of the potential misconduct?

140 Do you implement appropriate corrective actions when violations are identified (such as repayment,



Page 25 of 25

Element VII: Prompt and Effective Response to Detected Offenses 42 CFR §422.503(b)(4)(vi)(G) and 42 CFR §423.504(b)(4)(vi)(G)


or Action Required

disciplinary actions against responsible employees and FDRs and the establishment of enhanced internal controls?)

141 Do you have procedures to voluntarily self-report to CMS or its designee, OIG or law enforcement significant Medicare program violations and potential FWA?

Compliance Program Effectiveness Self-Assessment Questionnaire Submitted By: [Name] [Title] [Company] [Address] [Phone Number] [Email Address] ________________________ __________________________ (Signature) (Date)

Documents

(ATTACHMENT VI) COMPLIANCE PROGRAM EFFECTIVENESS SELF ... · Directions for completing the self-assessment questionnaire: This document will assist your organization in evaluating