2011-23695. Medicaid Program; Recovery Audit Contractors

AGENCY:

Centers for Medicare & Medicaid Services (CMS), HHS.

ACTION:

Final rule.

SUMMARY:

This final rule implements section 6411 of the Patient Protection and Affordable Care Act (the Affordable Care Act), and provides guidance to States related to Federal/State funding of State start-up, operation and maintenance costs of Medicaid Recovery Audit Contractors (Medicaid RACs) and the payment methodology for State payments to Medicaid RACs. This rule also directs States to assure that adequate appeal processes are in place for providers to dispute adverse determinations made by Medicaid RACs. Lastly, the rule directs States to coordinate with other contractors and entities auditing Medicaid providers and with State and Federal law enforcement agencies.

DATES:

Effective Date: These regulations are effective on January 1, 2012.

FOR FURTHER INFORMATION CONTACT:

Joanne Davis, [phone].

SUPPLEMENTARY INFORMATION:

I. Background

A. Current Law

The Medicaid program is a cooperative Federal/State program designed to allow States to receive matching funds from the Federal Government to finance medical assistance to eligible low income beneficiaries. Medicaid was enacted in 1965 by the passage of the Social Security Act Amendments of 1965 creating title XIX of the Social Security Act (the Act).

States may choose to participate in the Medicaid program by submitting a State Plan for medical assistance that is approved by the Secretary of the U.S. Department of Health and Human Services. While States are not required to participate in the Medicaid program, all States, the District of Columbia, and the territories do participate. Once a State elects to participate in the program, it is required to comply with its State Plan, as well as the requirements imposed by the Act and applicable Federal regulations.

CMS is the primary Federal agency providing oversight of State Medicaid activities and facilitating program integrity efforts. Our administration of the Medicaid program requires that we expend billions of dollars in Federal matching payments to States for Medicaid expenditures. We also have an obligation to prevent, identify, and recover improper payments to individuals, contractors, and organizations.

In November 2009, the President signed Executive Order (E.O.) 13520 in an effort to reduce improper payments by increasing transparency in government and holding agencies accountable for reducing improper payments. On March 22, 2010, the Office of Management and Budget (OMB) issued guidance for agencies regarding the implementation of E.O. 13520 entitled Part III to OMB Circular A-123, Appendix C (Appendix C). Appendix C outlines the responsibilities of agencies, determines the programs subject to E.O. 13520, defines supplemental measures and targets for high priority programs, and establishes reporting requirements under E.O. 13520 and procedures to identify entities with outstanding payments.

Section 6411 of the Patient Protection and Affordable Care Act (Pub. L. 111-148, enacted on March 23, 2010) (the Affordable Care Act) directs States to establish programs by December 31, 2010 in which they will contract with 1 or more Recovery Audit Contractors (Medicaid RACs). The Medicaid RACs will review Medicaid claims submitted by providers of services for which payment may be made under the State Plan or a waiver of the State Plan to identify overpayments and underpayments.

Section 6411(a)(1) of the Affordable Care Act amended section 1902(a)(42) of the Act to provide that “the State shall establish a program under which the State contracts (consistent with State law and in the same manner as the Secretary enters into contracts with recovery audit contractors under section 1893(h) * * *) with 1 or more recovery audit contractors for the purpose of identifying underpayments and overpayments and recouping overpayments * * *” To offer context for our approach to the Medicaid RAC program, we provide background discussion on the Medicare RAC program under section 1893(h) of the Act.

B. Medicare RACs

Medicare RACs are private entities with which CMS contracts to identify underpayments and overpayments as well as recoup overpayments, until recently, limited to Medicare's fee-for-service program. Initially authorized by the Congress as a 3-year demonstration program by the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (Pub. L. 108-173, enacted on December 8, 2003) (MMA), Medicare RACs were permanently authorized in the Tax Relief and Health Care Act of 2006 (Pub. L. 109-432, enacted on December 20, 2006)(TRHCA).

During the Medicare RAC demonstration period, CMS contracted with RACs to review claims from Medicare participating providers and suppliers in New York, Florida, California, Arizona, Massachusetts, and South Carolina. From 2005 through 2008, the Medicare RACs identified and corrected over $1 billion in improper payments. The majority, or 96 percent, of the improper payments were overpayments, while the remaining 4 percent were underpayments. As a result of the demonstrated cost effectiveness of the Medicare RACs, the TRHCA required CMS to implement a nationwide Medicare RAC program. The TRHCA directed CMS to expand the Medicare RAC program nationwide by January 1, 2010.

In our evaluation of the Medicare RAC demonstration, providers were surveyed and they identified to CMS a number of concerns and processes that needed to be improved. For example, Medicare RACs were reportedly inconsistent in documenting their “good cause” for reviewing a claim. In addition, providers complained that a lack of physician presence on Medicare RAC staffs contributed to Medicare claims incorrectly being denied. As a result, we met with stakeholders, including the provider community, and made a number of changes to improve the Medicare RAC program. In the permanent Medicare RAC program, CMS directed Medicare RACs to consistently document their “good cause” for reviewing a claim. In addition, CMS now requires each Medicare RAC to hire a minimum of 1.0 Full Time Equivalent (FTE) physician Medical Director to oversee the medical record review process; assist nurses, therapists, and certified coders upon request; manage quality assurance procedures; and maintain relationships with provider associations.

Both the MMA and the TRHCA required CMS to pay Medicare RACs on a contingency fee basis. Currently, CMS pays Medicare RACs a contingency fee rate ranging between 9 and 12.50 percent. These contingency fees were not fixed by CMS, but were established by the contractors through a bidding process with CMS. Providers may appeal Medicare RAC determinations through the established Medicare appeals process. During the demonstration period, Medicare RACs were required to return contingency fees if the claim determination was overturned on the first level appeal. However, Medicare RACs were entitled to retain contingency fees if the determination was overturned on subsequent levels of appeal. In the permanent Medicare RAC program, CMS requires Medicare RACs to return the contingency fee payment if the determination is overturned at any stage of the appeals process.

C. Existing State Contingency Fee Contracts

There is precedent for State Medicaid contingency fee contracts for purposes of recovering Medicaid overpayments subject to third party liability (TPL) requirements. Section 1902(a)(25) of the Act requires States to take all reasonable measures to determine the legal liability of third parties to pay for medical assistance furnished to a Medicaid recipient under the State Plan. Several States have elected to do so through the use of contingency fee arrangements with TPL contractors. In addition, several States currently contract with contingency fee contractors to recover Medicaid overpayments unrelated to TPL. In a memorandum to CMS Regional Administrators dated November 7, 2002, we revised our policy prohibiting Federal financial participation (FFP) for States to pay costs to contingency fee contractors, unrelated to TPL. The revised policy allowed contingency fee payments if the following conditions were met: (1) The intent of the contingency fee contract must be to produce savings or recoveries in the Medicaid program and (2) the savings upon which the contingency fee payment is based must be adequately defined and the determination of fee payments documented to CMS's satisfaction.

II. Provisions of the Proposed Medicaid RAC Rule

In the November 10, 2010 Federal Register (75 FR 69037), we published a proposed rule that set forth guidance to States related to Federal/State funding of Medicaid RACs and the payment methodology for State payments to Medicaid RACs in accordance with the Affordable Care Act. We proposed adding new regulatory provisions in 42 CFR part 455 subpart F governing Program Integrity—Medicaid.

Section 6411(a) of the Affordable Care Act amended and expanded section 1902(a)(42) of the Act to require States to establish Medicaid RAC programs by December 31, 2010, to contract with 1 or more contractors to audit Medicaid claims and to identify underpayments and overpayments and collect overpayments. While States were required to establish their Medicaid RAC programs by December 31, 2010, via the State Plan amendment (SPA) process, the Medicaid RAC programs were not required to be implemented by this date. In the November 10, 2010 proposed rule, we stated that, absent an exception, States were required to fully implement their Medicaid RAC programs by April 1, 2011.

The difference between establishing and implementing Medicaid RAC programs was clarified for States prior to the publication of the proposed rule. On October 1, 2010, we issued a State Medicaid Director (SMD) letter providing preliminary guidance to States on the implementation of their RAC programs. In the SMD letter, States were advised that they should attest that they would establish a Medicaid RAC program by submitting a SPA to CMS no later than December 31, 2010, or indicate that they would be seeking to be excepted from one or more of the proposed provisions, or indicate that they would be seeking a complete exception from establishing a Medicaid RAC program. Subsequently, on February 1, 2011, we issued an Informational Bulletin stating that the proposed April 1, 2011 implementation date would be delayed, in part, to ensure that States would be able to comply with the provisions of the final rule.

Section 1902(a)(42)(B) of the Act directs all States to establish Medicaid RAC programs, subject to the exceptions and requirements as the Secretary may require. This provision enables CMS to vary the Medicaid RAC program requirements, or except a State from establishing a Medicaid RAC program in certain circumstances, including where it would be inconsistent with State law. For example, the Secretary may exempt a State from the requirement to pay Medicaid RACs on a contingent basis for collecting overpayments when State law expressly prohibits contingency fee contracting. However, some other fee structure could be required under any exception.

Similarly, during the Medicaid RAC SPA process, some States advised CMS that they were required to enact legislation before amending their State plans. Because the establishment of a Medicaid RAC program is accomplished by a SPA, some State legislatures did not have the opportunity to convene and enact the amendment to their State plans prior to December 31, 2010. In this case, those States submitted requests to delay establishing Medicaid RAC programs until after those State legislatures met. CMS granted these requests.

Also, there were circumstances, unrelated to the examples above, where States sought exceptions from some or all of the requirements of the Medicaid RAC program. Accordingly, § 455.516 proposed that States seeking exceptions from contracting with Medicaid RACs must submit a written justification for the request to CMS. We anticipate granting complete Medicaid RAC program exceptions rarely, and only under the most compelling of circumstances.

Section 6411(a) of the Affordable Care Act amended section 1902(a)(42) of the Act, regarding States Medicaid RAC programs:

• Under section 1902(a)(42)(B)(ii)(I) of the Act, payments must be made to a Medicaid RAC under contract with a State only from amounts recovered. As discussed in the proposed rule, we interpret this to mean that payments to Medicaid RACs may not exceed the total amounts recovered. For example, if a Medicaid RAC's efforts result in the recovery of a total of $1 million, the fees paid to the RAC for its work regarding both overpayments and underpayments must not exceed $1 million. The intent of the statute is for States and the Federal government to reduce improper payments in the Medicaid program in order to realize savings. Additionally, we interpret this to mean that payments to contractors were not made based upon amounts merely identified but not recovered, or amounts that may initially be recovered but that subsequently must be repaid due to determinations made in appeals proceedings.

In the proposed rule, we stated that the payment methodology determinations for States, as well as the timing of payments to Medicaid RACs for their work, were separate but closely related issues. We stated that the distinction between amounts recovered and amounts identified had implications for how States structured and administered payment agreements with Medicaid RACs, as well as the timing of Medicaid RACs' receipt of payments. We offered two options illustrating ways that States could structure payments.

In option one, for example, State A paid RAC A its fee when RAC A identified and recovered an overpayment. If provider A appealed and prevailed at any stage, RAC A would be required to return any portion of the contingency fee that corresponded to the amount of an overpayment that was overturned at any level of appeal.

In the second option, State B determined it would pay RAC B its contingency fee at the point at which the recovery amount is fully adjudicated; that is, at the conclusion of any and all appeals available to provider B. At that point, State B would pay RAC B a contingency fee based on the amount recovered.

• Under section 1902(a)(42)(B)(ii)(II)(aa) of the Act, payments to a Medicaid RAC contractor must be made on a contingent basis for collecting overpayments from the amounts recovered. In the proposed rule, we noted that we were aware that the Medicaid RAC program, by virtue of the differences between the Medicare and Medicaid programs, would not operate identically to the Medicare RAC program. We recognized that each State must tailor its Medicaid RAC activities to the uniqueness of its own State, and indicated that we would not prescribe a set contingency fee rate for States. Instead, we would implement certain guidelines based upon section 1902(a)(42)(B) of the Act and our experience with the Medicare RAC program, but allow States the discretion to set their fees within those guidelines.

Medicaid RACs will contract with States and territories to identify and collect overpayments, and will be paid on a contingency fee basis by the States. In the Medicare RAC program, CMS contracts with Medicare RACs to identify and recover overpayments from Medicare providers, and are paid on a contingency fee basis by CMS. In the proposed rule, we recognized the differences among States and territories when coordinating the collection of overpayments with RACs. The statute requires Medicaid RACs to collect overpayments. However, some States may not be able to delegate the collection of overpayments to contractors, while other States may have other restrictions.

Currently, there are 4 Medicare regional RACs operating. Those RACs are paid an average contingency fee rate of 10.86 percent by CMS, with the highest rate being 12.50 percent. We interpret the statutory language that States must establish a Medicaid RAC program “in the same manner as the Secretary enters into contracts with” Medicare RACs to mean that some of the provisions of the Medicare RAC program, generally, should serve as a model for the proposed Medicaid RAC program, not that Medicaid RACs should be structured identically to Medicare RACs. Accordingly, in § 455.510(b)(3) and (b)(4), we stated that CMS would not provide FFP for any amount of a State's contingency fee in excess of the then highest Medicare RAC contingency fee rate unless a State requests an exception from CMS and provides an acceptable justification.

We proposed that, in the absence of an approved exception, a State may only pay a RAC from the overpayments collected, and may only receive FFP on a contingency fee up to the highest Medicare RAC contingency rate. Any additional payment from the State to the RAC must be made using State-only funds. FFP is not available for administrative expenditure claims for the marginal difference between the highest Medicare fee and the State's contingency fee. For example, unless an exception applies, if the highest Medicare RAC contingency fee is 12.50 percent and the State pays a Medicaid RAC 14 percent, we will not pay the Federal match on the 1.50 percent difference. In other words, the State must use State-only funds to make up the difference between the State's 14 percent contingency fee and the 12.50 percent contingency fee ceiling. Currently, the Medicare RAC contracts have an established period of performance of up to 5 years, beginning in calendar year 2009. Initially, the maximum contingency fee rate for which FFP will be available for States to pay Medicaid RACs will be the highest Medicare RAC contingency fee, which is 12.50 percent. We anticipate that fee will be the maximum rate when States implement their RAC programs. Subsequently, we will make States aware of any modifications to the payment methodology for contingency fees and Medicaid RAC maximum contingency rates for which FFP will be available by publishing in a Federal Register notice, by December 31, 2013, the maximum Medicare contingency fee rate, which will apply to FFP availability for any Medicaid RAC contracts covering the period of performance beginning on July 1, 2014. The established rate will be in place for 5 years, or until we publish a new maximum rate in the Federal Register.

The Medicare RAC program is still a relatively new program. In our early outreach campaign to provide technical support and assistance to States in the procurement of their RAC contracts, we studied many of the lessons learned from the Medicare RAC Demonstration, as well as the current provisions of the permanent Medicare RAC program and sought to incorporate many lessons learned in this final rule. For example, we proposed that States require their Medicaid RACs to employ trained medical professionals to review Medicaid claims, as we now require the Medicare RACs to do. We indicated that States should also be cognizant of potential organizational conflicts of interest and should take affirmative steps to identify and prevent any conflicts of interest.

In the proposed rule, we reported that the Office of Inspector General of the U.S. Department of Health and Human Services (HHS-OIG) had found that the Medicare RACs identified over $1 billion in improper payments, but referred only two cases of potential fraud to CMS. HHS-OIG opined that Medicare RACs had no incentive to make fraud referrals because the RACs did not receive contingency fees for those referrals. In the proposed rule, we cautioned States, in their design of Medicaid RAC programs, to ensure that the Medicaid RACs report instances of fraud and/or abuse in addition to the pursuit of overpayments. At § 455.508(b), we proposed that whenever RACs had reasonable grounds to believe that fraud and/or abuse had occurred, they must report it to the appropriate law enforcement officials. We solicited comments on these proposals, as well as other issues that States should consider in the design of their RAC programs. At § 455.508(c), we proposed that Medicaid RACs must meet the additional requirements that States may establish.

• Under section 1902(a)(42)(B)(ii)(II)(bb) of the Act, payment to a Medicaid RAC for identifying underpayments may be made in any amount as the State may specify. Currently, Medicare RACs are paid a contingency fee to identify underpayments, similar to the way in which they are paid to identify and recover overpayments. In the proposed rule, we stated that a State may elect to use a similar approach, or elect to establish a set fee or some other fee structure for the identification of underpayments. Consistent with a State's obligation to ensure that it pays the correct amount to the right provider for the appropriate service at the right time for the right beneficiary, whatever methodology a State chooses must adequately incentivize the detection of underpayments. At § 455.510(c), we proposed granting States the flexibility to specify the underpayment fee for Medicaid RACs. Additionally, we stated that CMS would monitor the methodologies and amounts paid by States to Medicaid RACs to identify underpayments, and may consider future additional regulation depending on what data reveal over time.

Section 1902(a)(42)(B)(ii)(I) of the Act requires that payments to a Medicaid RAC only come from amounts recovered. We proposed that Federal matching payments were not available for RAC contingency fees paid in excess of the overpayment amounts collected. The proposed rule stated that the total fees paid to a Medicaid RAC included both the amounts associated with: (1) Identifying and recovering overpayments; and (2) identifying underpayments. Due to the requirement in section 1902(a)(42)(B)(ii)(I) of the Act that contingency fees only come from amounts recovered, total fees must not exceed the amount of overpayments collected.

In the proposed rule, we cited data from the Medicare RAC Demonstration that overpayment recoveries by Medicare RACs exceeded underpayment identification by more than a 9:1 ratio. Therefore, we concluded that States would not need to maintain a reserve of recovered overpayments to fund Medicaid RAC costs associated with identifying underpayments. However, we proposed that States maintain an accounting of amounts recovered and paid.

We also proposed that States report overpayments to CMS based on the net amount remaining after all fees are paid to the Medicaid RAC. In the proposed rule, we linked the treatment of the fees and expenditures to the specific statutory language implementing the Medicaid RAC requirements and did not extend it to Medicaid overpayment recoveries in other contexts.

We stated, for example, RAC X's fee for overpayment identification is 10 percent of the recovery amount. The fee for identification of underpayments is 10 percent of the amount identified. If an overpayment recovery amount was $100, and the total amount of underpayment was $20, the total fees paid to the Medicaid RAC would be $12 ($10 for the identification and recovery of the overpayment and $2 for the identification of the underpayment). The State would report the recovery (collection) amount of $100 and the $10 RAC fee at the original match rate for the overpayment and the $2 RAC fee at the match rate for payment of the underpayment. If the State paid a provider based on the Medicaid RAC-identified underpayment, and that expenditure was claimed in accordance with timely filing requirements, we proposed, the $20 expenditure would be matched at the regular Federal Medical Assistance Percentage (FMAP), or the appropriate FFP rate.

Currently, § 433.312 directs States to refund the Federal share of overpayments, regardless of whether the State actually recovers the overpayments from the provider. In the proposed rule, we noted that this requirement, and all other requirements relating to overpayments, would apply to Medicaid RAC-identified overpayments. Therefore, if a Medicaid RAC identified an overpayment to a provider, the State would refund the Federal share of the overpayment amount to the Federal Government, regardless of whether the State collected the overpayment.

• Under section 1902(a)(42)(B)(ii)(III) of the Act, States must have an adequate appeals process for entities to challenge adverse Medicaid RAC determinations. We proposed at § 455.512 that States must provide appeal rights available under State law or administrative procedures to Medicaid providers that seek review of an adverse Medicaid RAC determination. We proposed two alternatives the State could use to achieve this. In alternative one, a State may utilize an existing appeals infrastructure to adjudicate Medicaid RAC appeals. The State would submit to CMS a proposal describing the appeals process, which would need to be approved prior to implementing its RAC program.

In alternative two, a State may elect to establish a separate appeals process for RAC determinations, which must also ensure providers adequate due process in pursuing an appeal. Accordingly, in § 455.512 we proposed to give States the flexibility to determine the appeals process that will be available to providers seeking review of adverse RAC determinations. However, through the State Plan amendment (SPA) process, each State has indicated that it already has in place an administrative appeals infrastructure they will use for a provider to appeal an adverse Medicaid RAC determination.

Finally, we also noted in the proposed rule that the potential length of a State's administrative appeals process may have an impact on the methodology or structure of the payment agreement between a State and a Medicaid RAC. For example, in a contract between State X and RAC X, where State X's administrative appeal process can extend for 2 years, RAC X may not receive payment for an extended period of time. Accordingly, RAC X's contingency fee rate will most likely reflect operating, maintenance and legal costs over that period. Alternatively, in State Y, completion of the administrative appeals process takes 9 months. A contract between State Y and RAC Y may reflect a different contingency fee rate.

• Under section 1902(a)(42)(B)(ii)(IV)(aa) of the Act, for purposes of section 1903(a)(7) of the Act, expenditures made by the State to carry out the Medicaid RAC program are necessary for the proper and efficient administration of the State Plan or waiver of the plan. We interpret this reference to section 1903(a)(7) of the Act to mean that amounts expended by a State to establish and operate the Medicaid RAC program (aside from fee payments, the treatment of which is discussed elsewhere in this preamble) are to be shared by the Federal Government at the 50 percent administrative rate. Therefore, we proposed at § 455.514(b), that FFP is available to States for administrative costs subject to reporting requirements.

We also proposed that States would report to CMS certain elements describing the effectiveness of their Medicaid RAC programs. These proposed elements included general program descriptors (for example, contract periods of performance, contractors' names) and program metrics (for example, number of audits conducted, recovery amounts, number of cases referred for potential fraud). These elements will be provided in sub-regulatory guidance specified by CMS.

• Sections 1902(a)(42)(B)(ii)(IV)(bb) and 1903(d) of the Act apply to amounts recovered (not merely identified) under the Medicaid RAC program. In the proposed rule, we indicated that a State would be required to refund the Federal share of the net amount of overpayment recoveries after deducting the contingency fees paid to a RAC (in conformance with the restrictions discussed above, including the maximum allowed RAC contingency fee and the exception process). In other words, a State would be required to take a RAC's contingency fee “off the top” before calculating the Federal share of the overpayment recovery to be returned to CMS. The amounts recovered would be subject to a State's quarterly expenditure estimates and the funding of the State's share.

Additionally, we noted in the proposed rule that the U.S. territories operate under a separate funding authority that is statutorily-capped. As a result of the limitations placed on FFP by section 1108(g) of the Act, territories would need to assess the feasibility of implementing and funding Medicaid RAC contractors in their jurisdictions. As of the date of this final rule, all of the territories requested and were granted exceptions from establishing RAC programs. These exceptions will not be reassessed. Should RAC programs become feasible due to a change in circumstances, the territories can amend their State Plans to establish RAC programs.

• Under section 1902(a)(42)(B)(ii)(IV)(cc) of the Act, States and their Medicaid RACs must coordinate their efforts with other contractors or entities performing audits of entities receiving payments under the State Plan or waiver in the State, including State and Federal law enforcement agencies. In the proposed rule, we emphasized that Medicaid RACs were not intended to, and would not, replace any State program integrity or audit initiatives or programs. We proposed under § 455.508(b) that an entity that wanted to enter into a contract with a State to perform the functions of a Medicaid RAC must agree to coordinate its audit recovery efforts with other entities.

In the proposed rule, we stated that although overlapping or multiple provider audits may be necessary, we hoped to minimize the likelihood of overlapping audits. Section 1902(a)(42)(B)(ii)(IV)(cc) of the Act directs States to assure CMS that they will coordinate Medicaid RAC audit activity with an array of other entities that also conduct audits of Medicaid providers. Providers are currently subject to audits by the States' routine program integrity audits, CMS' Medicaid Integrity Contractors' (MICs) audits, as well as audits conducted by other State and Federal entities. For example, the MICs perform audits of providers, on behalf of CMS, in order to identify overpayments. Payment Error Rate Measurement (PERM) audits are ongoing CMS audits that measure improper payments in the Medicaid and Children's Health Insurance Program and error rates for each program. As we stated in the proposed rule, we anticipate working both internally and with the States to minimize this administrative burden on Medicaid providers.

In addition to the obligation to coordinate auditing efforts to reduce the overburdening of Medicaid providers, we also wanted to ensure coordination between Medicaid RACs and law enforcement organizations so that suspected cases of fraud and abuse were processed through the appropriate channels. Law enforcement organizations may conduct audits or investigations of Medicaid providers in addition to Federal and State agencies. Those organizations include, but are not limited to, the HHS-OIG, the U.S. Department of Justice, including the Federal Bureau of Investigation, State Medicaid Fraud Control Units (MFCUs), other Federal and State law enforcement agencies, as appropriate, and CMS. We concluded that States are in the best position to coordinate audit activities.

We also proposed at § 455.508(b) that a Medicaid RAC must report fraud or criminal activity to the appropriate law enforcement officials whenever it has reasonable grounds to believe that such activity has occurred.

III. Analysis of and Responses to Public Comments

We received 76 timely comments on the November 10, 2010 proposed rule (75 FR 69037) from State associations, hospitals, medical associations, providers, managed care organizations, and contingency fee contractors. We reviewed each commenter's comments and grouped related comments. After associating like comments, we placed them in categories based on subject matter. Summaries of the public comments received and our responses to those comments are set forth below.

A. General

Comment: One commenter requested clarification and asked CMS to consider addressing the fundamental differences between Medicaid RACs and Medicare RACs.

Response: Medicaid RACs are State funded, designed, procured, operated and administered programs authorized by section 6411 of the Affordable Care Act to identify underpayments and overpayments and to recover overpayments to Medicaid providers, on a contingency fee basis. Medicare RACs are regionally operated contractors that are federally funded, procured, operated and administered programs authorized permanently by section 302 of the TRHCA to identify underpayments and overpayments and to recoup overpayments under parts A and B of the Medicare program. The Congress provided for payments to the Medicare RACs on a contingency fee basis for correcting overpayments and identifying underpayments. In constructing this final rule, we took into consideration these fundamental differences between the Medicaid and Medicare programs along with feedback from commenters on how these differences can be addressed as well as how best practices from the Medicare RAC program can be incorporated.

Comment: One commenter asserted that CMS should seek input from States concerning reporting metrics and that a cooperative approach to this requirement should provide CMS with the data needed for oversight of the program but not be overly burdensome to the States.

Response: We agree with the comment regarding reporting metrics. We anticipate working with States to develop performance metrics and will issue sub-regulatory guidance regarding specific reporting criteria when appropriate.

Comment: One commenter indicated that the Medicaid RAC program would be further enhanced by developing consistent objective criteria for States to follow and this information should be publicly available to establish a baseline for the community.

Response: We agree that the Medicaid RAC program should have consistent and objective criteria. As a result of comments from stakeholders, we considered and are finalizing the following provisions:

• State coordination of recovery audit efforts with other auditing entities (§ 455.506(c)).
• State reporting of fraud and/or abuse, as defined by § 455.2, to its MFCU or other appropriate law enforcement agency (§ 455.506(d)).
• State established limit on the number and frequency of medical records requested by a RAC (§ 455.506(e)).
• The entity must hire a minimum of 1.0 FTE Contractor Medical Director who is a Doctor of Medicine or Doctor of Osteopathy in good standing with the relevant State licensing authorities and has relevant work and educational experience. A State may seek to be excepted, in accordance with § 455.516, from requiring its RAC to hire a minimum of 1.0 FTE Contractor Medical Director by submitting to CMS a written request for CMS review and approval (§ 455.508(b)).
• A requirement that RACs hire certified coders unless the State determines that certified coders are not required for the effective review of Medicaid claims (§ 455.508(c)).
• The RAC must work with the State to develop an education and outreach program component, including notification of audit policies and audit protocols (§ 455.508(d)).
• Mandatory RAC customer service measures, including: Providing a toll-free customer service telephone number in all correspondence sent to providers and staffing the toll-free number during normal business hours from 8:00 a.m. to 4:30 p.m. in the applicable time zone (§ 455.508(e)(1)); compiling and maintaining provider approved addresses and points of contact (§ 455.508(e)(2)); mandatory acceptance of provider submissions of electronic medical records on CD/DVD or via facsimile at the providers' request (§ 455.508(e)(3)); and notifying providers of overpayment findings within 60 calendar days (§ 455.508(e)(4)).
• A three-year maximum claims look-back period (§ 455.508(f)).
• Timely referral of suspected cases of fraud and/or abuse by the Medicaid RAC to the State (§ 455.508(h)).
• Return of contingency fees within a reasonable timeframe as prescribed by the State if a Medicaid RAC determination is reversed at any level of appeal (§ 455.510(b)(3)).

Comment: One commenter indicated that parallel Medicare and Medicaid RAC standards are consistent with CMS' aim of harmonization of the anti-fraud activities of the Medicare and Medicaid programs under the Center for Program Integrity (CPI).

Response: We agree with the commenter. Medicaid RAC programs are, by statute, administered differently than Medicare RAC programs. However, we have concluded that many aspects of the Medicaid RAC program can operate in alignment with the Medicare RAC program including the following: Staffing requirements (§ 455.508(a), (b), and (c)); State and RAC development of an education and outreach program, including notification of audit policies and protocols (§ 455.508(d)); minimum customer service measures including: Providing a toll-free customer service telephone number in all correspondence sent to providers and staffing the toll-free number during normal business hours from 8:00 a.m. to 4:30 p.m. in the applicable time zone (§ 455.508(e)(1)); compiling and maintaining provider approved addresses and points of contact (§ 455.508(e)(2)); mandatory acceptance of provider submissions of electronic medical records on CD/DVD or via facsimile at the providers' request (§ 455.508(e)(3)); notifying providers of overpayment findings within 60 calendar days (§ 455.508(e)(4)); a 3 year maximum claims look-back period (§ 455.508(f)); and a State established limit on the number and frequency of medical records requested by a RAC (§ 455.506(e)).

Comment: Several commenters indicated that processes should be developed to minimize provider burden to the greatest extent possible in connection with the identification of improper payments. Additionally, the commenters stated that the final rule should incorporate increased accountability and transparency provisions which ultimately became part of the permanent Medicare RAC program.

Response: Again, we have concluded that many aspects of the Medicaid RAC program can operate in alignment with the Medicare RAC program, consistent with State law, thereby minimizing provider burden including the following: Staffing requirements (§ 455.508(a)), (b), and (c)); State and RAC development of an education and outreach program, including notification of audit policies and protocols (§ 455.508(d); minimum customer service measures including: Providing a toll-free customer service telephone number in all correspondence sent to providers and staffing the toll-free number during normal business hours from 8:00 a.m. to 4:30 p.m. in the applicable time zone (§ 455.508(e)(1)); compiling and maintaining provider approved addresses and points of contact (§ 455.508(e)(2)); mandatory acceptance of provider submissions of electronic medical records on CD/DVD or via facsimile at the providers' request (§ 455.508(e)(3)); notifying providers of overpayment findings within 60 calendar days (§ 455.508(e)(4)); a 3 year maximum claims look-back period (§ 455.508(f)); and a State established limit on the number and frequency of medical records requested by a Medicaid RAC (§ 455.506(e)). States are obligated to coordinate auditing efforts to reduce the overburdening of Medicaid providers.

Comment: One commenter expressed concern with the implementation of a “Medicare based audit program” due to budget deficits in the States and pressure to look for opportunities to find savings in the already underfunded Medicaid program.

Response: We understand the commenter's concerns. However, the Affordable Care Act requires the implementation of a Medicaid RAC program, with certain exceptions as permitted by the Secretary. Because the Affordable Care Act requires States to contract with RACs on a contingency fee basis, out-of-pocket expenses should be minimized. Therefore, the majority of the program costs will be offset by overpayment recoveries. Further, Medicaid RACs are part of a significant initiative to reduce waste and improper payments and recoup the improper payments. Accordingly, we believe that the Medicaid RAC program will lead to significant savings for States, as indicated in Section VI. of this final rule, titled “Regulatory Impact Analysis.”

Comment: One commenter urged CMS to balance the goal of recovery of funds improperly paid with the “respectful treatment of the overwhelming number of Medicaid providers who continue to provide healthcare services at substantially less than market rates and who diligently attempt to abide by all applicable regulations and payment policies.” Another commenter suggested that providers would no longer participate in Medicaid and its clients would no longer have access to care.

Response: We agree that Medicaid providers deserve to receive respectful treatment from CMS and we understand the commenters' concerns regarding the burden of additional audits on providers. In the proposed rule, we specifically emphasized that States and their RACs must undertake coordination efforts to reduce the potential overburdening of Medicaid providers, as well as ensuring that suspected cases of fraud and abuse are processed through the appropriate channels. We emphasized that it is the State's obligation to ensure that RACs do not duplicate or compromise the efforts of other entities performing audits. In the final rule, we require at § 455.506(c) that States must coordinate the recovery audit efforts of their RACs with other auditing entities.

Comment: One commenter stated that the Department of Health and Human Services (HHS) should better target program integrity dollars to efforts that have the most opportunity for success.

Response: We believe that the Medicare and Medicaid RAC programs are an investment in successful program integrity efforts. In FY 2010, Medicare RACs identified and corrected $92.3 million in combined overpayments and underpayments. Eighty-two percent of all RAC corrections were collected overpayments, and 18 percent were identified underpayments that were refunded to providers. We expect that States will realize a similar ratio of overpayments to underpayments in connection with the implementation of the Medicaid RAC program, and will examine the trends among the States over several years.

Comment: One commenter indicated that HHS should clarify whether it is considering or recommending to the Congress that it eliminate the Audit Medicaid Integrity Contractor (MIC) and Review of Provider MIC effort since it appears to be duplicative of the Medicaid RAC program.

Response: We disagree that the work of MICs, both Audit and Review of Provider, is duplicative of Medicaid RACs. As stated previously, Federal MICs are better positioned to address certain Medicaid program vulnerabilities than State-administered RACs.

Comment: One commenter recommended that CMS require States to provide transparency in coding/billing rules and guidelines, share screening guidelines for medical necessity determinations, and provider education. According to the commenter, this can ensure provider success as well as develop a framework for auditing bodies to follow. This commenter believes that existing State rules and guidelines are often vague or unwritten. Therefore, audits should not be allowed except where the State has promulgated clear criteria.

Response: We agree that States should be as transparent as possible with regard to their Medicaid RAC programs. While we are not requiring States to provide coding/billing guidelines, we are requiring RACs to work with the State to develop a provider education and outreach program, including notification of audit policies and protocols for auditing bodies and providers to have clearly defined roles and expectations (§ 455.508(d)).

Comment: One commenter indicated that allowing contingency fees to be based on actual recoveries puts a “tremendous strain on a company's cash flow.” The commenter indicated that a company has to prepare for a long lead time between providing the service of identifying a recovery and being paid after a governmental agency has made the effort to collect the recovery and then process the payment. This commenter further stated that the company providing the service has no input or control over the collection process and must rely on the good faith of the agency to process payments in a timely and efficient manner.

Response: We disagree with this comment because we do not believe that there is credible evidence to suggest that any State agency would intentionally withhold compensation from one of its contractors. As envisioned, a State and a RAC would voluntarily enter into a contractual agreement with provisions protecting both parties' interests. Thus, the agency would agree to pay the RAC according to the contractual agreement. As a general rule, contingency fee contractors should be aware of the financial risk of working on a contingency fee basis. In addition, States have an incentive to collect overpayments as soon as possible. Moreover, the RAC can recoup overpayments directly from providers if its contract with the State is structured to permit RAC collection of overpayments.

Comment: One commenter expressed concern that the proposed rule does not reflect the potential savings associated with the correction of repeated provider billing errors. Thus, the current rule does not incentivize a RAC to help a State stop systemic overpayments as that would eliminate the RAC's contingency fee. This commenter suggested that HHS consider some method to reward a RAC for identifying and reporting solutions to a State which would end overpayments that occur from system error or other administrative problems on an ongoing basis.

Response: While we encourage States to work with their RACs to identify potential State vulnerabilities or other similar problem areas, a RAC reward for the activities is outside the scope of the proposed and final rules. Generally, a Medicaid RAC is required to review post-payment claims for the purpose of identifying and collecting overpayments as well as identifying underpayments. Sections 1902(a)(42)(B)(i) and (ii)(I)(aa) of the Act require RACs to be compensated on a contingency fee basis for the identification and recovery of overpayments, to the extent it is consistent with State law. The statute does not require Medicaid RACs to identify State administrative issues. We encourage States to evaluate identified overpayments to determine if trends are apparent and whether solutions can be developed to address noted vulnerabilities.

Comment: Several commenters indicated that the final rule should require CMS, State Medicaid agencies (SMAs), and RACs to use program “fixes” to educate providers as well as implement payment system changes to avoid billing mistakes before they are made.

Response: We agree and have included, in this final rule, a requirement for States and their RACs to develop an education and outreach program at § 455.508(d), including notification to providers of audit policies and protocols. We believe that States should implement additional process improvements to their payment systems to the extent possible. Those improvements should not substitute for program integrity initiatives or programs to ensure that proper payments are made to providers.

Comment: One commenter suggested that CMS place oversight of the State Medicaid RAC programs and Medicare RAC contractors within the CMS CPI. Based on its core function and experience base, CPI is uniquely positioned to oversee the Medicare and Medicaid RACs because its duties are to perform Medicare and Medicaid program integrity activities.

Response: While we appreciate the commenter's suggestion, the Medicaid RACs will be procured, administered and operated by the States according to State laws and regulations. Additionally, there will be no privity of contract between CMS and the Medicaid RACs. We recently provided support and technical assistance to the States in the form of sub-regulatory guidance, all-State call forums, webinars, and a video entitled “Medicaid RACs: Are You Ready?” We will continue to provide technical support and assistance to States after publication of this final rule. The appropriate CMS component to oversee the Medicare RAC program is outside the scope of this final rule.

Comment: One commenter indicated that it was fundamentally opposed to contingency fees in Medicare and Medicaid auditing. According to the commenter, this type of behavior has the overwhelming tendency to push auditors “to take a chance” and inappropriately deny claims.

Response: We understand the concerns of the commenter. However, the statute requires Medicaid RACs to be paid on a contingency fee basis for the identification and recovery of overpayments. Contingency fee contracting is a type of payment methodology that has been a standard practice accepted among private healthcare payers for more than 20 years. In the final rule, we clarified that Medicaid RACs will only review post-payment claims for overpayments and underpayments. Accordingly, the Medicaid RACs will not deny claims.

Comment: One commenter expressed concern that the proposed rule does not indicate that CMS is aware of abuses to providers. As support, the commenter cited anecdotes experienced by providers during the Medicare RAC Demonstration period. According to the commenter, CMS was advised of the “horrific costs incurred by providers in fighting denials, particularly in California, and the extremely high percentage of denials overturned * * * but tremendous cost had been incurred and the damage was done in terms of reputation, reallocation of resources, etc.”

Response: We disagree with the comment. While we are aware of issues in California, we are not aware of explicit “abuses to providers.” We have attempted to address the concerns of providers and incorporate the lessons learned from the Medicare RAC Demonstration period into the permanent Medicare RAC program, including, but not limited to, requiring the Medicare RAC to document their “good cause” for reviewing a claim and requiring each Medicare RAC to hire a minimum of 1.0 Full Time Equivalent (FTE) physician Medical Director to oversee the program. In addition, we have attempted to incorporate those lessons learned in the Medicare RAC program to the development of the Medicaid RAC program.

Comment: One commenter expressed disappointment that the proposed rule does not contain best practices from the Medicare RAC Demonstration and recommends that CMS reconsider its proposed Medicaid RAC program policies in the final rule.

Response: We agree with the spirit of the comment. As a result of numerous comments from stakeholders, we are making modifications to the proposed Medicaid RAC program in this final rule. For example, we are requiring in this final rule that each Medicaid RAC hire a minimum of 1.0 FTE Contractor Medical Director who is a Doctor of Medicine or Doctor of Osteopathy. A State may request an exception, in accordance with § 455.516, from requiring its RAC to hire a minimum of 1.0 FTE Contractor Medical Director by submitting written justification and receiving approval from CMS. We finalize this provision at § 455.508(b). We are also requiring Medicaid RACs to hire certified coders unless the State determines that certified coders are not required for the effective review of Medicaid claims. We finalize this provision at § 455.508(c). Additionally, we are requiring State and RAC development of an education and outreach program for providers, including notification of audit policies and protocols (§ 455.508(d)); minimum customer service measures, including those measures found in the Medicare RAC program such as: Providing a toll-free customer service telephone number in all correspondence sent to providers and staffing the toll-free number during normal business hours from 8:00 a.m. to 4:30 p.m. in the applicable time zone (§ 455.508(e)(1)); compiling and maintaining provider approved addresses and points of contact (§ 455.508(e)(2)); mandatory acceptance of provider submissions of electronic medical records on CD/DVD or via facsimile at the providers' request (§ 455.508(e)(3)); notifying providers of overpayment findings within 60 calendar days (§ 455.508(e)(4)); a 3 year maximum claims look-back period (§ 455.508(f)); and a State-established limit on the number and frequency of medical records requested by a RAC (§ 455.506(e)). States may request exceptions to § 455.508(f) through the SPA process, and RACs may request from States, exceptions to § 455.506(e).

Comment: One commenter recommended that States should implement the RAC program, through the use of “regional RACs” to minimize provider burden and to maximize consistency and efficiency.

Response: We agree that regional Medicaid RACs can be an innovative strategy for States to share resources. There is nothing in the statute that would preclude a group of States from joining together to contract with a Medicaid RAC. There has been some State interest in forming/procuring a regional RAC. We encourage their efforts. However, we will not mandate that States adopt this strategy.

Comment: One commenter asserted that requiring close oversight of the RAC program will be challenging due to budget constraints.

Response: We understand the commenter's concerns. However, the Medicaid RACs are part of a significant initiative to reduce improper payments and recoup the overpayments that have occurred.

Comment: One commenter requested that CMS provide “extremely tight monitoring” of Medicaid RAC review, auditing behavior and denial patterns if CMS interprets section 6411 of the Affordable Care Act to mandate contingency fees regarding the identification and recoupment of overpayments.

Response: Section 1902(a)(42)(B)(ii)(II)(aa) of the Act mandates that RACs be paid on a contingency fee basis for the identification and recoupment of overpayments. We will oversee State implementation of Medicaid RAC programs to ensure compliance with the Act and these regulations, but do not anticipate the need to, as the commenter suggests, engage in “extremely tight monitoring” at this point. States have attested through their SPAs that they will implement a Medicaid RAC program consistent with this final rule (unless a State has been granted an exception).

Comment: Several commenters suggested that “[t]he audit should include all of Medicaid, and not be restricted to narrow areas. This will ensure the maximum benefit of program recoveries and preventive actions on the broadest scope possible.”

Response: We believe that States should have the ability to direct the audit targets, but that, so long as consistent with State direction, the RACs should have the ability to audit the entire Medicaid program.

Comment: Several commenters questioned CMS' authority to require States to continue existing program integrity efforts. Most of these commenters recommended that CMS exempt States that have Medicaid Integrity Programs or similar audit programs from the requirement to establish RAC programs. These commenters argued that there is no statutory authority for CMS to compel States to maintain levels of funding and activity for a duplicate program, and questioned the assertion that States have no option to choose to either be audited by a Federal MIC or establish a Medicaid RAC program. Several commenters also expressed concern that the continuation of existing program integrity efforts greatly reduces flexibility and creates duplicative audits and review processes which may ultimately impact provider participation and access to care. Finally, one commenter recommended that CMS remove the requirement to continue existing program integrity activities completely.

Response: Continuation of existing program integrity activities is important to ensure a comprehensive State program integrity program that includes more than a claims auditing program, such as the Medicaid RAC program. Other critical components of a Medicaid integrity program include Surveillance and Utilization Review (SUR) unit activities, MMIS system monitoring, and fraud prevention and detection activities, including coordination with law enforcement.

We disagree that the Medicaid RAC program is duplicative of the Federal national audit program, in which Federal MICs conduct audits of Medicaid providers. In particular, while RACs are an efficient way to identify payment errors, they are not the most effective approach to identify or prevent fraudulent practices. Federal MICs can focus on audit issues that may be less advantageous for a contingency-fee based contractor. In addition, fraudulent schemes may not lead to overpayment recoveries, which provide the source of RAC fees. Moreover, Medicaid RAC programs are poised to address State-specific issues stemming from the individual characteristics of each State's Medicaid program (for example, special payment structures under a Medicaid demonstration) and will focus on the needs and vulnerabilities associated with a particular State. In contrast, Federal MICs are poised to address vulnerabilities on a regional and national basis. These regional and national trends would likely go undetected by an individual Medicaid RAC. Accordingly, the national audit program is complementary to a State Medicaid RAC program.

We are not exempting States that have Medicaid integrity programs from establishing a Medicaid RAC program. Although there is no specific requirement in the Affordable Care Act regarding the continuation of program integrity efforts, the Congress directed CMS to promulgate regulations to carry out section 6411 of the Affordable Care Act with full awareness of the various program integrity initiatives for which it had given previous authority and that are currently in place in States. Congress did not relax any of those previously authorized program integrity activities in the Affordable Care Act. We take this to mean that Congress intended this policy to supplement previously authorized program integrity activities at both the State and Federal levels. We also believe that States should play a significant role in coordinating the audit activities of their respective integrity programs, RACs, and any other auditing entities under contract with the State. We are very concerned about provider participation and beneficiary access to care as well as minimizing the potential for multiple audits of the same provider. However, States should not supplant existing State program integrity initiatives with a Medicaid RAC program because of the fundamentally different and complementary approaches of the two audit programs.

B. Implementation Date

Comment: Several commenters expressed concern that “States must fully implement their Medicaid RAC programs by April 1, 2011.” While some commenters recommended specific alternative implementation dates ranging between July 1, 2011 and January 1, 2012, the majority of the commenters asserted that April 1, 2011, did not allow States enough time to complete the procurement process, or allow States that require legislative authority to obtain approval for contracting with RACs. One commenter requested clarification as to the meaning of “fully implement” by April 1, 2011. Another commenter suggested voluntary implementation, on the part of States, from the present date until January 1, 2012.

Response: Although we proposed an implementation date of April 1, 2011, the date was contingent upon the rule being finalized. We recognize the need to provide a reasonable period of time between publication of the final rule and the date for required implementation of the Medicaid RAC program to ensure States' compliance with the final rule. Accordingly, absent an exception, States will be required to implement their RAC programs by January 1, 2012.

Comment: One commenter asked if there will be a penalty if a State does not implement a RAC program.

Response: When a State elects to participate in the Medicaid program, it is required to comply with its State Plan, as well as the requirements imposed by the Act and applicable Federal regulations. Section 1902(a)(42)(B)(i) of the Act requires States to implement RAC programs, which is consistent with States' commitment to promote program integrity. Additionally, States are required by section 1903(a)(7) of the Act to administer funding necessary for the proper and efficient administration of the State Plan or waiver of the plan. If the Secretary deems that a Medicaid RAC program is necessary to ensure the integrity and the efficiency of a State's Medicaid program, a State's failure to implement the program may violate section 1903(a)(7) of the Act. A potential consequence of a State's failure to implement a RAC program is the loss of FFP. If a State is unable to implement a RAC program, then that State should request from CMS an exception either from a specific Medicaid RAC program requirement(s) or a complete exception from implementing the RAC program. However, as stated in the proposed rule, we will grant complete exceptions from the Medicaid RAC program or exceptions to RAC requirements only rarely and only under the most compelling of circumstances.

Comment: One commenter recommended that CMS adopt a phase-in strategy similar to the Medicare program to ensure that the provider community can actively participate in outreach programs.

Response: We provided early guidance for States with regard to the creation and implementation of a Medicaid RAC program. States already have the ability to request delayed implementation of RAC programs through the Medicaid SPA process. Additionally, we provided support and technical assistance to the States in the form of sub-regulatory guidance, all-State call forums, webinars and an informative video entitled “Medicaid RACs: Are You Ready?” We fully anticipate continuing to provide technical assistance after the publication of the final rule. Therefore, we are not adopting a global phase-in strategy.

C. Program Requirements

Comment: Numerous commenters inquired about the overall program approach of the Medicaid RAC program. One commenter indicated that it interpreted the Affordable Care Act to read that Medicaid RACs should be established in the same manner as CMS currently contracts with Medicare RACs, and with the same program requirements. Several commenters suggested that CMS should standardize program elements of the Medicare RACs into Medicaid RAC programs. Several commenters expressed their concerns that a variation in Medicaid RAC program requirements between bordering States would cause an undue burden on providers that operate nationally or in multiple States.

Response: Consistent with the flexibility afforded States in the design and operation of their Medicaid programs, we did not prescribe every element of the Medicaid RAC program in the proposed rule. We received many comments encouraging CMS to adopt measures in the Medicaid RAC program that could operate in alignment with Medicare RAC requirements. We considered the effect of aligning Medicare provisions upon individually State-run programs and existing State laws and regulations and balanced that with the spirit of the statute. Accordingly, in the final rule, we are requiring certain specific program elements that are consistent with the program elements established by the Medicare RAC program. These program elements include the following:

• Requiring the entity to hire a minimum of 1.0 FTE Contractor Medical Director who is a Doctor of Medicine or Doctor of Osteopathy in good standing with the relevant State licensing authorities and has relevant work and educational experience. A State may seek to be excepted, in accordance with § 455.516, from requiring its RAC to hire a minimum of 1.0 FTE Contractor Medical Director by submitting to CMS a written request for CMS review and approval (§ 455.508(b));
• Requiring the entity to hire certified coders unless the State determines that certified coders are not required for the effective review of Medicaid claims (§ 455.508(c));
• Requiring the development of an education and outreach program component, including notification to providers of audit policies and protocols (§ 455.508(d));
• Requiring RAC customer service measures including: Providing a toll-free customer service telephone number in all correspondence sent to providers and staffing the toll-free number during normal business hours from 8:00 a.m. to 4:30 p.m. in the applicable time zone (§ 455.508(e)(1)); compiling and maintaining provider approved addresses and points of contact (§ 455.508(e)(2)); mandatory acceptance of provider submissions of electronic medical records on CD/DVD or via facsimile at the providers' request (§ 455.508(e)(3)); notifying providers of overpayment findings within 60 calendar days (§ 455.508(e)(4));
• 3-year maximum claims look-back period (§ 455.508(f));
• State established limit on the number and frequency of medical records requested by a RAC (§ 455.506(e));
• State coordination of recovery audit efforts with other auditing entities (§ 455.506(c)); and
• Return of contingency fees within a reasonable timeframe as prescribed by the State, if a Medicaid RAC determination is overturned at any level of appeal (§ 455.510(b)(3)). As noted below, States will have flexibility as to timing of payment.

In addition, we strongly encourage States to adopt specific program elements that are part of the permanent Medicare RAC program within the flexibility States have to design and implement their RAC programs in the following areas:

• Medical necessity reviews;
• Extrapolation of audit findings;
• External validation of accuracy of RAC findings; and
• Types of claims audited.

For contingency fees, States maintain the flexibility of paying contingency fees either from amounts identified and recovered, but not fully adjudicated, or after the overpayment was fully adjudicated and all appeals available to the provider were exhausted. As noted above, the RAC will be required to return the contingency fee, within a reasonable timeframe as prescribed by the State that corresponds to the amount of the overpayment if an adverse determination is overturned at any level of appeal.

Program elements where we will grant States complete flexibility regarding the design, procurement, administration and operation of their RAC programs, largely because of the requirements of State laws, are as follows:

• Underpayment methodology;
• State appeals process;
• Contingency fee rates (States have complete flexibility in the contingency fee rates they pay, exclusive of FFP. However, we will provide FFP only for amounts that do not exceed the then-highest contingency fee rate paid to Medicare RACs);
• State exclusion of claims;
• Bundling of procurements; and
• Coordination of the collection of RAC overpayments.

With regard to the providers serving beneficiaries in multiple States that expressed concern about the variation among Medicaid RAC program elements, we believe that a strong education and outreach campaign developed by the States and RACs and required as a part of every Medicaid RAC program will help alleviate the concerns that were expressed.

As we described in more detail, in sections II. and III.G. of this final rule, we are granting States the flexibility to design their appeals processes, but States are required by section 1902(a)(42)(B)(ii)(III) of the Act to have an adequate process for entities to appeal adverse RAC determinations.

Comment: One commenter suggested that Medicaid RAC program goals be created based on the error rate established by the Payment Error Rate Measurement (PERM) program.

Response: PERM addresses specific error measures in the Medicaid program. Under section 1902(a)(42)(B)(i) of the Act, the Medicaid RACs shall identify underpayments and overpayments and shall recoup overpayments. Thus, there is no authority under Federal law for Medicaid RAC programs to apply any measure except to ensure that States make no improper payments to providers.

Comment: One commenter inquired whether existing patient identifiers can be used so that files can be readily retrieved by the provider.

Response: We do not intend for States to deviate from processes that are already in place to readily identify claims. We encourage States to work with their contractors to include the necessary fields to effectively identify overpayments and/or underpayments.

Comment: Several commenters stated that during the Medicare RAC Demonstration, many providers experienced inappropriate and arbitrary RAC denials. These commenters indicated that the RAC neither informed providers of the types of issues they were auditing, nor did they provide a rationale for adverse determinations. Additionally, commenters reported RACs audited claims using the wrong payment codes and audited claims from several years ago. According to commenters, this led to provider appeals, 64 percent of which were decided in the favor of the provider.

Response: As stated previously, we are applying numerous lessons learned from the Medicare RAC demonstration. We are requiring in this final rule that each Medicaid RAC must hire a minimum of 1.0 FTE Contractor Medical Director who is a Doctor of Medicine or Doctor of Osteopathy in good standing with the relevant State licensing authorities and has relevant work and educational experience. A State may seek to be excepted, in accordance with § 455.516, from requiring its RAC to hire a minimum of 1.0 FTE Contractor Medical Director by submitting to CMS a written request for CMS review and approval. We finalize this provision at § 455.508(b). We are also requiring Medicaid RACs in this final rule to hire certified coders unless the State determines that certified coders are not required for the effective review of Medicaid claims. We finalize this provision at § 455.508(c). Finally, we are requiring that there be a 3 year maximum claims look-back period. We finalize this provision at § 455.508(f).

Comment: One commenter inquired whether Medicaid RACs are required to comply with the reopening regulation located at § 405.980 similar to Medicare RACs, which requires a RAC to have good cause before it reopens a claim.

Response: Section 405.980 applies to administrative appeals under the Medicare program. States have different administrative appeal processes from the Medicare program. Accordingly, we did not require States to comply with the reopening regulation as set forth in the Medicare RAC program. As stated previously, States will retain the flexibility to design, procure, operate, and administer their RAC programs in accordance with State laws, regulations, and policies.

Comment: One commenter suggested that patients not receive a letter regarding a Medicaid RAC audit until the appeal process has ended and a determination is final, similar to the Medicare program.

Response: The Medicaid RAC program is designed to review claims submitted by providers of items and services or other individuals furnishing items and services for which payment has been made under section 1902(a) of the Act. Accordingly, States have the flexibility to decide the issue of patient notification of final claims resolution.

Comment: Several commenters stated that the best way to reduce common billing and coding mistakes is through targeted education and outreach, rather than onerous audits performed by outside contractors with incentives to deny claims. These commenters asserted that education and outreach efforts are insufficient across the Medicare and Medicaid programs.

Response: We agree that targeted education and outreach is one way of reducing common billing and coding mistakes. Accordingly, we have finalized at § 455.508(d), that States and their RACs are required to develop a education and outreach program as part of their Medicaid RAC programs. This includes, at a minimum, notification of audit policies and protocols.

Comment: Several commenters recommended the exclusion of medical necessity reviews from the Medicaid RAC program.

Response: We disagree with the commenters. Providers are required to furnish medically necessary services in State Medicaid plans and medical necessity reviews by Medicaid RACs are permitted to the extent they are consistent with State laws and regulations.

Comment: Several commenters suggested that if medical necessity reviews are permitted in Medicaid RAC programs, then CMS should issue key oversight provisions in the final rule to mitigate incentives for aggressive and/or inaccurate medical necessity review denials.

Response: We disagree that we should issue oversight provisions regarding medical necessity reviews in the Medicaid RAC program. Providers are required to furnish medically necessary services in accordance with State Medicaid plans, and thus medical necessity reviews by Medicaid RACs are permitted to the extent the reviews are consistent with State laws and regulations. In those cases, we encourage States to adopt measures reflected in the Medicare RAC program sub-regulatory guidance. We intend to continue providing technical assistance to States that will inform them of best practices from the Medicare RAC program. Accordingly, we decline to issue oversight provisions in the final rule regarding medical necessity reviews.

Comment: Several commenters recommended that if medical necessity reviews are permitted in the Medicaid RAC program and an improper payment is identified, providers should be allowed to re-bill for the lower appropriate claim amount.

Response: If a Medicaid RAC identifies an improper payment as a result of a medical necessity review, or any RAC review, the issue of whether a provider is permitted to re-bill a corrected claim is governed by State law, regulation, and policy which set time limits on the submission of providers' claims.

Comment: One commenter recommended increased physician involvement in medical necessity reviews.

Response: In the Medicare RAC program, no physician involvement is required in medical necessity reviews. We require that registered nurses (RNs) must be utilized, and that the Medicare RAC generally, employ a Medical Director. Similarly, we have finalized at § 455.508(b), that each RAC must hire a minimum of 1.0 FTE Contractor Medical Director who is a Doctor of Medicine or Doctor of Osteopathy in good standing with the relevant State licensing authorities and has relevant work and educational experience. A State may seek to be excepted, in accordance with § 455.516, from requiring its RAC to hire a minimum of 1.0 FTE Contractor Medical Director by submitting to CMS a written request for CMS review and approval. In addition, States that elect to permit medical necessity reviews in their Medicaid RAC programs should develop criteria consistent with their own State laws and regulations.

Comment: One commenter recommended that CMS establish reporting mechanisms to monitor contractor accuracy when reviewing claims for medical necessity in the Medicaid RAC program.

Response: If States elect to include medical necessity reviews in their Medicaid RAC program, we encourage the States to monitor the reviews for accuracy. We have finalized § 455.502(c) and § 455.514(b) which require State reporting. Additionally, we will issue sub-regulatory guidance, generally, on reporting and performance metrics for Medicaid RACs.

Comment: One commenter recommended that CMS should establish appropriate guidelines for Medicaid RAC medical necessity reviews, and require the RACs to have qualified personnel with both the clinical and regulatory experience to review medical necessity review claims.

Response: We disagree that CMS should establish guidelines for medical necessity reviews conducted by Medicaid RACs. States must follow the guidance that is provided in State Medicaid plans, State law, regulation, and policy. In the final rule at § 455.508(b), however, we are requiring that each RAC must hire a minimum of 1.0 FTE Contractor Medical Director who is a Doctor of Medicine or Doctor of Osteopathy in good standing with the relevant State licensing authorities and has relevant work and educational experience. A State may seek to be excepted, in accordance with § 455.516, from requiring its RAC to hire a minimum of 1.0 FTE Contractor Medical Director by submitting to CMS a written request for CMS review and approval.

Comment: Several commenters suggested that Medicaid RACs should conduct sample medical necessity audits to support the data identifying the pattern of errors that will be targeted through the audits.

Response: As previously stated, if States elect to include medical necessity reviews in their Medicaid RAC programs, we encourage the States to monitor the reviews for accuracy.

Comment: Several commenters recommended that final validation of medical necessity review denials should be signed off by a physician.

Response: In the Medicare RAC program, a physician's approval is not required in the validation of a medical necessity review denial. States have the flexibility to determine the parameters for medical necessity reviews. Therefore, we are not requiring final validation of medical necessity review by a physician.

Comment: Several commenters recommended that the RACs be required to submit a rationale for each medical necessity review to the SMA for review and approval.

Response: Similar to the Medicare RAC program in which the agency formed a “New Issue Review Board” which approves audit issues prior to widespread review, we encourage the formation of State review teams for Medicaid RACs that can approve new audit issues prior to review. We will provide technical assistance to States who decide to include medical necessity reviews in their Medicaid RAC programs.

Comment: One commenter recommended that the SMA be required to share training materials with providers that are used by Medicaid RACs to conduct a medical necessity review.

Response: Although we will not require States to share Medicaid RAC training materials with providers, we encourage States and SMAs, consistent with their laws, regulations, and policies, to make every effort to ensure transparency in the Medicaid RAC program. Additionally, we have finalized § 455.508(d), which requires an education and outreach component in every Medicaid RAC program including, at a minimum, notification to providers of audit policies and protocols.

Comment: One commenter recommended that CMS exclude medical necessity reviews in States where prior authorization programs require medical necessity reviews prior to payment approval.

Response: To the extent that medical necessity reviews are consistent with Medicaid State Plans, State laws or regulations, medical necessity reviews are permitted. Accordingly, we did not adopt the commenter's recommendation.

Comment: One commenter suggested that CMS and SMAs use RAC audit findings to educate providers and implement payment system fixes to avoid billing mistakes before they are made.

Response: We agree with the comment. If Medicaid RACs identify program vulnerabilities as a result of their findings, we encourage RACs to share this information with States so that they can implement corrective action, such as pre-payment edits or other similar system fixes. States can also use RAC findings to develop provider education in an attempt to prevent billing errors.

Comment: Several commenters expressed concern that all staff conducting automated or complex reviews must demonstrate knowledge of the State's published Medicaid guidelines and coding criteria for the dates and types of services.

Response: We believe that States should make the relevant Medicaid coverage guidelines and coding criteria available as part of the procurement process. This can be done in detail within the request for proposal or by providing the necessary links where guidelines and criteria are located for the various program types.

Comment: A commenter requested that the Medicaid RAC Statement of Work (SOW) exclude Evaluation and Management (E & M) Services from RAC review.

Response: States that contract with a RAC engage the RAC for the purpose of reviewing claims submitted by providers for items or services for which payment has been made under the Medicaid program. We expect that E & M Services, that is, those services provided by physicians and non-physician practitioners to evaluate patients and manage their care, will be included within the scope of Medicaid RAC review.

Comment: A commenter suggested having an internal State agency staff member review claims before auditing by the Medicaid RAC.

Response: We do not oppose States setting up processes to ensure the validity of claims before a determination is made as to whether a claim is an overpayment or underpayment. Because of the uniqueness of each State Medicaid program, the States should have the flexibility to design their Medicaid RAC programs specific to their individual program needs.

Comment: One commenter strongly recommended hiring professionally trained and certified coders, who have the appropriate skill sets that would facilitate improved reviews and reduce duplicative work in reviewing records correctly.

Response: We agree with the commenter. Accordingly, we have included § 455.508(c) in this final rule which requires Medicaid RACs to hire certified coders unless the State determines that certified coders are not required for the effective review of Medicaid claims.

Comment: Several commenters suggested that the final rule require each Medicaid RAC to have a minimum of 1.0 FTE physician Medical Director who is currently licensed; has relevant work experience in the health insurance industry; has extensive knowledge of Medicaid coverage and payment rules; and has appropriate clinical experience practicing medicine. Other commenters suggested that CMS not require Medicaid RACs to hire physician Medical Directors, but require that the appropriate level of medical expertise be staffed by the RAC to review medical records. The commenters also suggested that the medical personnel not have a record of adverse disciplinary actions.

Response: We agree with those commenters who suggested that the Medicaid RACs should each hire a Medical Director who is a Doctor of Medicine or a Doctor of Osteopathy and has relevant work and educational experience. Accordingly, we have finalized at § 455.508(b) that each Medicaid RAC must hire a minimum of 1.0 FTE Contractor Medical Director who is a Doctor of Medicine or Doctor of Osteopathy in good standing with the relevant State licensing authorities and has relevant work and educational experience. A State may seek to be excepted, in accordance with § 455.516, from requiring its RAC to hire a minimum of 1.0 FTE Contractor Medical Director by submitting to CMS a written request for CMS review and approval. We also require Medicaid RACs at § 455.508(a) to employ personnel who are trained medical professionals, as defined by the State, in good standing with the relevant State licensing authorities, where applicable, to review Medicaid claims.

Comment: One commenter requested that CMS consider clarifying the language in the final rule to include State policies and provider handbooks, where Medicaid RACs would review post-payment claims for overpayments and underpayments consistent with State laws and regulations.

Response: States have a certain amount of flexibility to design their Medicaid RAC program according to their needs. We believe that States' current practices regarding the processing of claims, including the use of policies and provider handbooks, should not differ in the Medicaid RAC program. Accordingly, each State should provide its RAC with all available resources to help facilitate claim review.

Comment: One commenter requested that CMS clarify the types of technical abilities that an entity wishing to perform as a Medicaid RAC must demonstrate, as referenced in proposed § 455.508 of the regulation, and incorporate other examples of technical abilities in addition to, trained medical professionals in the final rule.

Response: We expect that RACs will have the ability to review claims submitted by providers of items and services for which payment has been made under section 1902(a) of the Act as required by § 455.506(a). We have finalized § 455.508(a), which requires RACs to employ trained medical professionals, as defined by the State, to review Medicaid claims. These trained medical professionals could include, for example, nurses or physical therapists. States have the discretion to determine the types of medical professionals they require based upon their individual Medicaid RAC program needs.

Comment: One commenter requested that CMS recognize that not all recovery efforts require trained medical professionals; their experience with claims review includes the significant input of non-medical trained professionals, including CPAs, coding professionals, investigators, and accountants who are able to identify inappropriate payments that arise out of non-clinical issues.

Response: We appreciate the comment and recognize that the review of claims could involve a variety of disciplines to ensure the identification of inappropriate payments. However, we have finalized at § 455.508(a), (b), and (c) that Medicaid RACs must hire trained medical professionals, as defined by the State, to review Medicaid claims, each RAC must hire a minimum of 1.0 FTE Contractor Medical Director who is a Doctor of Medicine or Doctor of Osteopathy in good standing with the relevant State licensing authorities and has relevant work and educational experience. A State may seek to be excepted, in accordance with § 455.516, from requiring its RAC to hire a minimum of 1.0 FTE Contractor Medical Director by submitting to CMS a written request for CMS review and approval. In addition, the Medicaid RAC must hire certified coders (unless the State determines that certified coders are not required for the effective review of Medicaid claims).

Comment: A commenter suggested that CMS use the Medicare definition of “good cause” found in our regulation at § 405.986 as a floor in its final regulation for the Medicaid RAC program. This commenter also suggested that providers should have the right to challenge a lack of good cause to review a claim by the Medicaid RACs. Another commenter requested that CMS require Medicaid RACs to document good cause for claim review.

Response: RACs are required to review Medicaid claims. States will have the flexibility to establish requirements regarding the documentation of good cause to review a claim. Additionally, States may consider establishing requirements regarding the documentation of good cause to review a claim if they do not already have this requirement. In addition to those program elements specifically required, we encourage States to replicate the Medicare practices that would be beneficial to their Medicaid RAC programs, including, without limitation, documentation of good cause. However, we will not require States to document good cause because that requirement applies to the Medicare administrative appeals process. Each State has already assured CMS via the State Plan amendment process that it has in place an administrative appeals infrastructure whereby a provider may avail itself of its due process rights to appeal an adverse Medicaid RAC determination. States, therefore, must follow their own administrative appeals processes, which may or may not require documentation of good cause.

Comment: One commenter requested that CMS institute an issue approval process similar to the process now provided in the Medicare RAC program.

Response: In general, issues reviewed by the Medicare RACs are approved by CMS prior to widespread review. CMS uses a New Issue Review Board to provide oversight in conjunction with issues that are reviewed by the Medicare RACs. States may opt to establish an issue review board similar to the Medicare RAC program in which they consider topics for audit review. States will have the flexibility to determine the issues that are relevant to their respective Medicaid programs which will be subject to Medicaid RAC review.

Comment: One commenter suggested that CMS require Medicaid RACs to hold “meet and greet” forums.

Response: We recognize that each State has different considerations and must tailor its Medicaid RAC activities to the uniqueness of its own State. Accordingly, we will not require Medicaid RACs to hold “meet and greet” forums. However, we believe that States should promote transparency in their respective RAC programs. A “meet and greet” forum is an example of one way a State can promote transparency in its RAC program by allowing providers to interact with the contractor's personnel.

Comment: Several commenters asked that CMS require the following customer service measures that will assist providers in ensuring the timely submission of sufficient documentation to support the services billed and generally increase the efficiency of the process:

1. Implement timeframes for RAC determinations and notification of the same.

2. Require RACs to obtain correct provider addresses and points of contact.

3. Require RACs to give extensions to providers if RAC provider notices are sent to a wrong address or other extenuating circumstances.

4. Require RACs to maintain websites and post audit issues.

5. Require RACs to maintain provider portals of customer service information.

6. Require RACs to provide a toll-free phone number in case of questions.

7. Require RACs to respond to providers in a timely manner.

8. Require RACs to give providers a rationale for denials.

9. Require RACs to send correspondence to providers in clearly marked envelopes.

10. Implement deadlines for submission of medical records and clearly indicate those deadlines in an Additional Documentation Request (ADR) letter and indicate in that letter the suggested documentation that will assist RACs in adjudicating the claim.

11. Initiate contact with the provider who is the focus of the audit before issuing an overpayment determination for failure to submit documentation.

12. Accept provider submission of medical records on CD/DVD or via facsimile.

Response: After consideration of these numerous comments, we are requiring at § 455.508(e), that Medicaid RACs provide minimum customer service measures including: Providing a toll-free customer service telephone number in all correspondence sent to providers and staffing the toll-free number during normal business hours from 8:00 a.m. to 4:30 p.m. in the applicable time zone(§ 455.508(e)(1)); compiling and maintaining provider approved addresses and points of contact(§ 455.508(e)(2)); mandatory acceptance of provider submissions of electronic medical records on CD/DVD or via facsimile at the providers' request (§ 455.508(e)(3)); notifying providers of overpayment findings within 60 calendar days (§ 455.508(e)(4)). States should also rely upon internal processes and procedures for notification requirements and identify specific timeframes for required responses between the Medicaid RAC and providers, if possible.

Comment: Several commenters asked that the proposed rule require each Medicaid RAC to include a toll-free customer service telephone number in all correspondence sent to providers.

Response: We agree and have finalized at § 455.508(e) the requirement that Medicaid RACs must provide minimum customer service measures including: Providing a toll-free customer service telephone number in all correspondence sent to providers and staffing the toll-free number during normal business hours from 8:00 a.m. to 4:30 p.m. in the applicable time zone (§ 455.508(e)(1)).

Comment: One commenter asked if the notification of findings of overpayments or underpayments would include information on how overpayments may be repaid/offset, time limits for repayment without interest, and information on timeliness of additional payments and methods of additional payments.

Response: We have finalized at § 455.508(e)(4), that RACs must notify providers of overpayment findings within 60 calendar days. Also, at § 455.510(c)(3), we require States to notify providers of underpayments that are identified by the RACs. Each State will have the discretion to determine any additional information that it wants to include in provider notifications.

Comment: One commenter asked CMS to require States and their RACs to give advance notice to providers of audit focus areas in preparation for reviews, as occurs in the Medicare RAC program.

Response: States have a certain degree of flexibility to design their Medicaid RAC programs to fit their individual needs. We believe that States should promote transparency in their RAC programs. States requiring RACs to give advanced notice to providers of audit areas in preparation of a review is an example of how States can facilitate transparency.

Comment: One commenter asked CMS to require States to be transparent with regard to their coding/billing rules and guidelines as well as the screening guidelines that are used for making medical necessity determinations.

Response: We encourage States to make coding/billing rules and guidelines available to the extent possible to promote transparency.

Comment: Some commenters recommended that CMS develop a Medicaid RAC national SOW, similar to the Medicare RAC program.

Response: We disagree with the comment. The proposed Medicaid RAC program will not be one national program, like Medicare; rather it will be more than 50 State-specific programs. In this context, it would be nearly impossible to standardize the SOW for the Medicaid RAC program, as Medicare does. We have previously stated that as a result of comments, we have reconsidered the proposal to allow States complete flexibility regarding most aspects of their RAC programs, and have finalized at § 455.506 and § 455.508 certain requirements for States and their RACs to better align with Medicare RACs. With regard to Medicaid RAC program elements where we encourage States to adopt those measures that were incorporated into the permanent Medicare RAC program, we will continue to provide technical assistance after the publication of the final rule.

Comment: Several commenters expressed concern about allowing the RAC to develop or apply its own coverage, payment, or billing policies.

Response: States establish Medicaid coverage, payment and billing policies. The contract established with the RAC should address how the RAC will audit claims based on those established policies. Whether or not RACs develop or apply their own coverage, payment or billing policies is a contract issue resolved between States and their RACs.

Comment: Commenters expressed concern that small and solo practice physicians are already overwhelmed as a result of requests for records by other audit programs. Other commenters suggested that CMS require the RACs to assume the cost of copying and mailing, as well as allow for the electronic submission of records.

Response: We agree with the commenters with regard to limiting the number of medical records that may be requested by a Medicaid RAC. Accordingly, we have finalized at § 455.506(e) that States must set limits on the number and frequency of medical records to be reviewed by the RACs, subject to requests for exceptions from RACs. With regard to the costs of copying and mailing, as well as the electronic submission of records, we require at § 455.508(e)(3) mandatory acceptance of provider submissions of electronic medical records on CD/DVD or via facsimile at the provider's request.

Comment: One commenter requested guidance regarding the parameters associated with potential conflicts of interests that may develop as a result of the same contractor performing services on behalf of providers, for example, coding and billing as well as seeking to perform RAC audits of these same providers in which they acted as consultants.

Response: We indicated in the proposed rule that States should be cognizant of the potential for conflicts of interest, and should take steps to identify and prevent conflicts of interest. These conflicts of interest may arise among contractors or their subcontractors that perform audit related services for providers and then seek to perform audit recovery services on behalf of the State.

Comment: One commenter requested that the Medicaid RAC obtain approval from CMS to audit new issues and to post CMS-approved issues on the Medicaid RAC's website prior to the claims review similar to the current Medicare RAC process.

Response: The Medicaid RAC program differs from the Medicare RAC program in that it is a State-run program. Accordingly, specific areas of RAC review should be determined by the State in conjunction with its RAC. We recognize that there could be issues that are unique to a particular State in terms of areas that should be the focus of an audit. Therefore, we believe States are in the best position to make this determination.

Comment: One commenter requested that CMS clarify whether RAC contracts must be for a period of 5 years, similar to the term for Medicare RAC contracts.

Response: As stated earlier, States will have the flexibility to set periods of performance in their respective Medicaid RAC contracts that fit their program needs and are consistent with State law.

Comment: One commenter requested that CMS require States to use a validation contractor to independently examine Medicaid RAC vulnerability and claim determinations, and to issue annual accuracy scores.

Response: While we will not require States to engage a validation contractor, we believe that States should set targets for validation of the accuracy of RAC determinations and measure those targets accordingly. In addition, we plan on developing performance metrics in conjunction with the States to assist with determining the accuracy of RAC reviews.

Comment: One commenter requested that CMS require Medicaid RACs to accept electronic documentation submission in response to RAC audits.

Response: As part of the customer service measures, we are requiring Medicaid RACs at § 455.508(e)(3) to accept electronic submissions of medical record documentation to facilitate provider response in connection with RAC audit requests, without compromising the security and privacy of that data, unless the State requests and receives an exception from CMS.

Comment: One commenter suggested that CMS include additional provisions in the final rule that will serve to protect independent community pharmacies against abusive auditors and audit practices by requiring RACs to accept the records of a hospital, physician, or other authorized practitioner that are made available by the pharmacy to validate pharmacy records and prescriptions for confirming the accuracy of Medicaid claims filed by the pharmacy.

Response: We disagree that it is necessary to include additional provisions to protect independent pharmacies against abusive audit practices. States will have the flexibility to design their Medicaid RAC programs consistent with their laws, regulations, and policies.

Comment: One commenter requested that CMS include licensed pharmacists or a company representative in the RAC auditing process.

Response: We decline to require Medicaid RACs to hire licensed pharmacists or company representatives. However, States have the flexibility to require Medicaid RACs to hire licensed pharmacists or company representatives if they so choose. We are finalizing staffing requirements at § 455.508 (a), (b) and (c).

Comment: One commenter suggested that CMS require Medicaid RACs to form panels comprised of practicing physicians representing various specialties, which can advise RACs on medical issues.

Response: We do not oppose States requiring Medicaid RACs to form panels of practicing physicians who represent various specialties that can advise them on medical issues. We encourage States to adopt measures that will promote transparency and improved communication among States, Medicaid agencies, Medicaid RACs, and providers.

Comment: One commenter suggested that CMS require each Medicaid RAC auditor to be trained on Medicaid payment and coverage policy relating to all target areas approved by the State, billing and re-billing protocols, and the Medicaid appeals process. Each RAC auditor should also be required to demonstrate proficiency in these areas prior to conducting audits.

Response: We understand the concerns of the commenter regarding the need to have highly trained personnel. At § 455.508(a), we require that Medicaid RACs hire trained medical professionals, as defined by the State, to review Medicaid claims.

Comment: One commenter urged CMS to designate a percentage of recovered program dollars to improve education, increase pre-payment claim edits to eliminate payment of duplicate claims and those obviously submitted in error (for example, age-specific services provided to a patient outside the designated age range), and to provide continuous outreach with information on newly discovered and commonly occurring billing errors in both the Medicare and Medicaid programs.

Response: We agree with the commenter that education and outreach is a necessary element to Medicaid RAC programs. Accordingly, we include in this final rule at § 455.508(d), the requirement that States and RACs develop an education and outreach program, including notification to providers of audit policies and protocols. We will not require States to designate a percentage of recovered program dollars to improve education and increase pre-payment claim edits.

Comment: A commenter recommended that CMS consider relief in the presence of a disaster, whether widespread or in an individual location, in the way of an extension of the deadline for receipt of records or refund, acceptance of reconstructed records or exemption from review for records that were completely destroyed, and/or delay of reviews for up to 6 months.

Response: States should already have policies and procedures in place for handling unanticipated events when they occur, including provisions for requests of records.

Comment: Several commenters requested CMS to exclude payments made to disproportionate share hospitals (DSH) or special hospital payments from the scope of Medicaid RAC review in the final rule.

Response: We do not believe that DSH payments or special hospital payments should be excluded in the final rule. States have the flexibility to determine whether those payments should be the focus of RAC review.

Comment: One commenter suggested that CMS require States to publish Medicaid and Medicare RAC audit reports for public viewing.

Response: We believe that States should be as transparent as possible with regard to their Medicaid RAC programs. While we will not require States to publish Medicaid audit reports, we encourage States to consider making those reports available for public viewing.

D. Definitions

Comment: One commenter requested that CMS offer a definition of “overpayment.”

Response: For purposes of the Medicaid RAC program, we believe that States should define “overpayment” consistent with 42 CFR 433.304 which defines “overpayment” as “the amount paid by a Medicaid agency to a provider which is in excess of the amount that is allowable for services furnished under section 1902 of the Act and which is required to be refunded under section 1903 of the Act.”

Comment: One commenter indicated that the proposed rule does not include a definition of “underpayment.” In addition, this commenter suggested that the definition of underpayment could range from: (a) Broad and include a service that was never billed by a provider, to (b) narrow and reflect an error that was made in the reimbursement calculation.

Response: For purposes of the Medicaid RAC program, we believe that States should define “underpayment” consistent with their State law and/or plans. In the Medicare RAC program, an “underpayment” is generally defined as an amount paid to a provider or supplier for items or services furnished to a Medicare beneficiary at a lesser amount due and payable under the Act, implementing regulations, and policies.

E. Contingency Fees

Comment: One commenter inquired whether RAC determinations include cost-based adjustments or cost-based settlements. This commenter also wanted to know whether contingency fees would be paid to a Medicaid RAC for those determinations.

Response: We understand that certain States use cost reports for reimbursement of Medicaid claims. Accordingly, States need the flexibility to structure their RAC programs to permit review of cost-based services to identify and recover potential overpayments as well as identify underpayments. Therefore, contingency fees are payable to a Medicaid RAC for the identification and recovery of overpayments from cost-based service providers. With regard to whether a RAC determination can include cost-based settlements, we believe the State has the authority to make adjustments to a provider's cost report and/or cost-based settlements based upon a RAC determination.

Comment: One commenter indicated that the proposed rule fails to require RACs to return their contingency fee if a denial is overturned at any stage of the appeals process. Another commenter suggested that allowing States to determine at what stage in the Medicaid RAC process, post-recovery, that the RACs will receive contingency fees preserves an unacceptable risk of improper incentives which might otherwise encourage a Medicaid RAC to prematurely or even improperly identify and recover funds from a provider. Another commenter suggested that RACs should be paid upon recovery rather than after adjudication.

Response: With regard to the timing of RAC payments, we are finalizing the requirement at § 455.510(b)(2) that States must have the flexibility to determine at what stage of the audit process their RACs may receive contingency fees for the collection of overpayments from Medicaid providers. In addition, if the provider appeals the overpayment determination and the determination is reversed at any level of the appeals process, we are also requiring Medicaid RACs to return their contingency fees within a reasonable timeframe as prescribed by the State, as reflected in this final rule at § 455.510(b)(3). For example, a State should specify in its contract with the Medicaid RAC the timeframe in which the State expects the RAC to return the contingency fee, that is, repayment will occur on the next applicable invoice. As we indicated in the proposed rule, payments to RACs may not be made based upon amounts merely identified but not recovered or amounts initially recovered from providers but that are subsequently repaid due to determinations made in appeals proceedings. Accordingly, if a State pays a contingency fee to a RAC based upon amounts recovered prior to the conclusion of the appeals process that is available to a provider, then the RAC must return the portion of the contingency fee that corresponds to the amount of the overpayment that is reversed at any level of appeal. We do not believe that this improperly incentivizes a RAC to identify and recover funds from a provider.

Comment: One commenter suggested that CMS' illustration regarding the timing of payment to the RAC that would permit payment to the RAC when it recovers an overpayment but would subsequently require reimbursement by the RAC if the recovery is overturned on appeal, is directly contrary to CMS' interpretation of “payments to contractors may not be made based upon amounts merely identified but not recovered, or amounts that may initially be recovered but that subsequently must be repaid due to determinations made in appeals proceedings.”

Response: We disagree with the comment. The illustration mentioned by the commenter is consistent with the Act which requires the amount paid to a RAC to be from the overpayment amount recovered. If a State pays a RAC prior to the adjudication of the appeals process, then the RAC must refund the amount paid by the State within a reasonable timeframe as prescribed by the State, in connection with the overpayment in the event the overpayment is reversed at any level of appeal. For example, a State should specify in its contract with the Medicaid RAC the timeframe in which the State expects the RAC to return the contingency fee, that is, repayment will occur on the next applicable invoice.

Comment: One commenter indicated that the cap on contingency fees creates an unnecessary administrative burden on States with smaller Medicaid programs which may not be able to attract qualified contractors at the rate provided for in the proposed rule. Specifically, the commenter stated that it is administratively burdensome to pay for the excess with State only funds or request and receive an exception to the cap. Commenters further indicated that the market should determine an equitable contingency fee rate on a State by State basis. Another commenter indicated that limiting contingency rates will create the unintended consequence of limiting recoveries. This commenter was concerned that artificial rate caps would preclude an auditing firm from uncovering complex improper payments because it will not be able to do so profitably. Alternatively, another commenter suggested raising the cap to 18 percent but CMS should continue to have an exception process. Finally, other commenters indicated that strict limits should be set on the amount of contingency fees.

Response: We believe that the contingency fee rates for identifying and collecting overpayments should be reasonable and determined by each State, taking into account factors, for example, the level of effort to be performed by the RAC and the size of the State's Medicaid population. We recognize that each State has different considerations and must tailor its Medicaid RAC activities to the unique factors of its own State. Nevertheless, based upon our experience with the Medicare RACs, we believe that the contingency fee paid to a State Medicaid RAC should not be in excess of the highest fee paid to a Medicare RAC unless the State can provide sufficient justification. The Medicaid RAC contingency fee limit may be adjusted periodically to maintain parity with the Medicare RAC contingency fee cap.

Comment: One commenter requested that CMS use guidance as reflected in the Medicare RAC SOW to pay contingency fees to identify underpayments.

Response: We disagree with the commenter. Section 1902(a)(42)(B)(ii)(II) of the Act requires States to pay Medicaid RACs for the identification of underpayments from amounts recovered and “in such amounts as the State may specify.” Therefore, States have discretion to pay RACs for the identification of underpayments so long as the payments are from amounts recovered. In FY 2010, the Medicare RACs identified and corrected $92.3 million in combined overpayments and underpayments. Eighty-two percent of all RAC corrections were collected overpayments, and 18 percent were identified underpayments that were refunded to providers. We expect that States will realize a similar ratio of overpayments to underpayments in connection with the implementation of the Medicaid RAC program. That is, CMS requires at § 455.510(c)(2) that States must “adequately” incentivize the detection of underpayments identified by the RACs. We will evaluate individual States' indicators of adequacy, using the Medicare RAC benchmark, and will examine the trends among the States over several years.

Comment: One commenter requested clarification regarding whether the contingency fee percentage may vary according to a specific Medicaid RAC focus area of review.

Response: We do not object to a State using a tiered structure for contingency fee payments to its Medicaid RAC, so long as the maximum fee percentage does not exceed the highest fee we pay to the Medicare RACs. We will not pay FFP for amounts paid to RACs above the highest fee paid to Medicare RACs, unless the State requests and is granted an exception to that maximum rate. Any tiered structure must also ensure that the Medicaid RACs are incentivized to identify underpayments as well as overpayments.

Comment: One commenter requested clarification of CMS' expectations with regard to fees paid for the identification of underpayments when a State lacks the legal authority to pay fees for the action. This commenter recommended that CMS consider including alternatives that achieve the goal to incentivize the identification of underpayments.

Response: If a State is legally prohibited from requiring a RAC to identify underpayments, then a State may submit to CMS a written request for an exception related to this requirement.

Comment: One commenter opposed any exception to an increase in the FFP limit as a result of an exception to pay a Medicaid RAC a contingency fee that is higher than the Medicare RAC contingency fee. The commenter maintains that the contingency fee structure is inappropriate for any RAC program because it “perversely incentivizes RACs to engage in bounty hunting, which leads to increased expenses and administrative burdens for providers.” In addition, this commenter stated that allowing the State to obtain exceptions for the maximum FFP is needless and exacerbates the predatory nature of RAC audits.

Response: The statute requires Medicaid RACs to be paid on a contingency basis for the identification of overpayments. Thus, States do not have an option with regard to the method of payment for the identification of overpayments for their RACs unless State law prohibits the arrangement. We also recognize that certain States may need an exception to the contingency fee cap. For example, States with small Medicaid populations may need to pay a much larger contingency fee rate to attract RAC contractors to work in their State. Accordingly, under certain circumstances, a State may request authorization to pay a RAC a higher contingency fee than the maximum amount for which FFP is paid. Therefore, we disagree that exceptions to pay a RAC a higher contingency than the Medicare RAC contingency fee rate of 12.5 percent are never justified.

Comment: Several commenters suggested that the proposed contingency fee structure imposes no disincentive on RACs for pursuing situations where there is little or no solid evidence of an overpayment. The commenters recommended that payments to RACs should: (1) Be made only upon conclusion of all provider appeals; and (2) not compensate RACs for the time required for appeals to be exhausted. A few commenters also suggested that RACs should be required to pay a penalty to compensate providers for claims ultimately determined to be unfounded or falsely identified.

Response: As previously stated, we have surveyed States that have RAC-like programs which utilize a contingency fee payment structure and have not learned of any circumstances in which RACs were improperly incentivized to recover overpayments from Medicaid providers. In addition, our evaluation of the Medicare RAC program provides a basis for contingency payments to RACs for the identification and recovery of overpayments. Therefore, we will not compel States to require RACs to pay a penalty to providers for claims ultimately determined to be unfounded. With regard to the timing of payments to RACs, States need the flexibility to determine the most appropriate payment methodology given the uniqueness of its own State. Accordingly, States should decide when it is most appropriate to pay Medicaid RACs for their work.

Comment: Several commenters suggested that because the law provides a strong financial incentive for RACs to focus on overpayments and not the identification of underpayments, CMS should require States to apply the same contingency fee schedule for overpayments to underpayments. One commenter stated that the “small, flat fee” for underpayments is unacceptable. This commenter also suggested that CMS should require States to increase their underpayment fee when RACS are not applying a balanced approach to identifying underpayments and overpayments.

Response: With regard to underpayments, we have proposed that a State may choose to pay its RAC a contingency fee for the identification of underpayments, similar to Medicare RACs, or a State may opt to establish a set fee or some other structure for the identification of underpayments. We believe that States should have the flexibility to determine the best payment structure consistent with their State Plans. We also included language in the final rule at § 455.10(c)(2) indicating that States must adequately incentivize their RACs to identify underpayments. In FY 2010, 82 percent of all Medicare RAC corrections were collected overpayments, and 18 percent were identified underpayments that were refunded to providers. We expect that States will realize a similar ratio of overpayments to underpayments in connection with the implementation of the Medicaid RAC program. We will evaluate individual States' indicators of adequacy, using the Medicare RAC benchmark, and will examine the trends among the States over several years.

Comment: One commenter suggested that CMS clarify that underpayments discovered through RAC audits are only payable if claims are filed by the provider within prescribed timeframes.

Response: Generally, RACs are required to review post-payment claims. If a Medicaid claim is not timely filed by a provider, then it would seem that the claim is not payable. Accordingly, these claims should not be subject to RAC review. If a RAC identifies an underpayment and the time for re-filing a claim has passed in accordance with State law, we believe the State has the discretion to determine whether the provider may re-file the claims with the correct information.

Comment: One State commenter indicated that the proposed rule does not state that underpayments must be reimbursed. This commenter stated that providers are responsible for reviewing their remittance advice to determine if they were paid correctly. Further, any adjustments must be made within specific timeframes. This commenter stated that requiring States to reimburse providers for underpayments outside of existing timeliness rules is not appropriate.

Response: The Act mandates that RACs be compensated for the identification of underpayments to providers. While the statute is silent regarding the remittance of underpayments to providers as a result of RAC identification of the underpayments, we are concerned about provider participation in the Medicaid program as well as States making proper payments to providers. Accordingly, we believe that States should compensate all providers for any identified underpayments to the extent possible and consistent with State law. States must notify providers of underpayments that are identified by their Medicaid RACs. We have included this requirement in this final rule at § 455.510(c)(3).

Comment: One commenter appreciated the flexibility extended to States regarding the fees paid to RACs for the identification of underpayments. The commenter, however, disagreed with CMS' approach with regard to the possibility of additional rulemaking should CMS deem it necessary as a result of future CMS review of data, indicating that RACs are not appropriately incentivized to identify underpayments. This commenter believes any further Federal regulation of underpayment identification will create an undue burden on the States and requested that it be removed from consideration.

Response: We appreciate the comment. However, the burden of potential future rulemaking is outside the scope of this final rule. Nevertheless, further rulemaking may be necessary to achieve the statutory mandate for Medicaid RACs to identify underpayments. Accordingly, we have maintained this language in this final rule.

Comment: Several commenters suggested that CMS should require SMAs to: (1) Monitor the volume of underpayment audits conducted by the RACs; (2) increase the underpayment fee if a RAC is not applying a balanced approach to identifying underpayments and overpayments; and (3) include information on the general methods used to identify Medicaid underpayments in the RAC annual report as well as the steps taken to ensure a balance between underpayment and overpayment review. Another commenter recommended that the Medicaid RAC be required to submit annual reports that include information on methods used to identify underpayments, the number of underpayments identified, and any steps taken to ensure that underpayments are addressed.

Response: As stated in the proposed rule, we expect to monitor the methodologies and amounts paid by States to Medicaid RACs to identify underpayments. We may consider future rulemaking depending on the data we review regarding RAC incentive to pursue underpayments. At this time, we are not requiring States to submit annual reports. However, we plan to issue sub-regulatory guidance on future reporting requirements. Accordingly, we will consider the commenters' suggestions regarding the data elements for an annual report. At this time, we will not require States to increase the fee paid to RACs for the detection of underpayments.

Comment: One commenter requested clarification as to whether States can choose to issue payments only to certain providers based upon underpayments that are identified by the RAC versus identified underpayments of all providers. This commenter also mistakenly asserted that Medicaid RACs are only paid for dollars recovered on overpayments and suggested that RACs also be paid for the identification of underpayments.

Response: States are required to pay RACs for the identification of overpayments as well as the identification of underpayments. Although the statute is silent regarding actual payments to providers as a result of RAC identification of underpayments, we believe that States should compensate all providers for any identified underpayments consistent with State law.

Comment: One commenter suggested that Medicaid RACs should be required to identify underpayment determinations and ensure that the underpayments are remitted to providers in a timely fashion. In addition, this commenter suggested that the States and/or CMS should ensure that Medicaid RACs have the system capability to identify underpayments before they begin auditing claims.

Response: The Act requires States to establish programs to contract with a Medicaid RAC for the purpose of, in relevant part, identifying underpayments. Accordingly, the task of identifying underpayments should be included in the SOW that is part of the contract between a State and its RAC. Therefore, we will assume that a State has verified that its RAC has the capability to identify underpayments even before a RAC has begun auditing claims. With regard to remittance of underpayments, it is the State that is responsible for the payment, not the RAC. The RAC is required to identify, not remit, an underpayment. Although we recognize that the State has discretion with regard to timing of the remittance of underpayments, we encourage States to remit identified underpayments to providers within a reasonable timeframe.

Comment: One commenter pointed out that the proposed rule indicates that “CMS contracts with Medicare RACs to identify and recover overpayments from Medicare providers, and to identify and pay underpayments to Medicare providers.” (Emphasis added). This commenter requested that CMS clarify this statement given that he has not found any other reference to RACs making payments to Medicare providers for identified underpayments.

Response: We agree with the commenter. Medicare RACs do not pay underpayments to Medicare providers. The Medicare program pays underpayments to providers.

Comment: One commenter disagrees with CMS' proposed approach to publishing the maximum Medicaid RAC contingency fee consistent with the schedule of publishing the maximum Medicare RAC contingency fee every 5 years. The next update is scheduled for 2013. Specifically, the commenter stated that because fee structures can change over the life of a contract, CMS should publish any modifications to the Medicare RAC payment methodology and contingency rates within 30 days of the modification as opposed to the existing 5-year schedule. In addition, another commenter suggested not requiring the States to conform to the Medicare timetable because Medicaid RACs will be tailored to each State's needs and States need the ability to set rates and increases that are not restricted by Medicare requirements.

Response: While we proposed to publish the maximum Medicaid RAC contingency fee consistent with the highest Medicare RAC fee, a State is not precluded from increasing the rate paid to its RAC outside of that schedule if necessary. To the extent that a State needs to increase the rate paid to its RAC before the expiration of the scheduled 5-year Medicare RAC contingency fee, the State can submit a SPA describing that an increase is required to reflect whether the State is paying the amount above the Medicare rate with State-only funds, or is requesting matching FFP.

Comment: One commenter suggested removing the contingency fee cap because it will allow States to pursue individualized RAC programs that align the fees with the complexity and scale of the workload and allow smaller States to garner a larger field of bidders from which to choose. Another commenter indicated that States need the flexibility to establish contingency fees separately from Medicare due to the difficulty States will have in reacting to the changes associated with the implementation of a RAC program in light of various State budgeting and contracting/procurement constraints. In addition, a commenter suggested that States need the ability to set rates and increases that are not restricted by Medicare requirements because the Medicaid RAC program needs to be tailored to each State's needs. Therefore, commenters suggested not requiring the States to conform to the higher Medicare contingency fee rate cap.

Response: Based upon our experience with the Medicare RACs, we believe that the contingency fee paid to a State Medicaid RAC should not be in excess of the highest fee paid to a Medicare RAC unless the State can provide sufficient justification. We recognize that States with small Medicaid populations may need to pay a much larger contingency fee rate to attract the RAC contractors to work in their State. For example, if a State receives a proposal from a prospective contractor for a contingency fee that is higher than the maximum contingency fee set by CMS for Medicare RACs but it accurately reflects the scope of work to be performed in that particular State, then the State should submit a request for an exception to CMS for consideration.

Comment: One commenter believes that the Affordable Care Act does not specifically mandate that a State Medicaid RAC contingency fee be linked to the Medicare RAC maximum contingency fee. One commenter stated that the contingency fee cap is not in the best interests of the Federal Government, the State or the taxpayer, and is not consistent with the law. Commenters suggested letting the competitive procurement process define the contingency fee percentage limit for Medicaid, as was done for the Medicare RAC program at its inception. One commenter requested that State contingency-based recovery contracts competitively procured at a higher percentage rate be “grandfathered” in at those higher rates with a State commitment to transition to the lower percentage limit with the next procurement cycle.

Response: Section 1902(a)(42)(B)(i) of the Act requires States to “establish a program under which the State contracts (consistent with State law and in the same manner as the Secretary enters into contracts with recovery audit contractors under section 1893(h) [of the Act], subject to such exceptions or requirements as the Secretary may require . * * *” Although the Act does not specifically set the State Medicaid RAC contingency fee, we believe that the contingency fee paid to a State Medicaid RAC should not be in excess of the highest fee paid to a Medicare RAC unless the State can provide sufficient justification that it is consistent with the statute. If a State cannot procure a contractor at the 12.5 percent rate, then a State can request an exception from CMS. For those States that may already have a RAC-like program in place in which the contingency fee is higher than the Medicare rate, we will work with these States to establish an acceptable resolution, which may or may not include “grandfathering” in the higher rate.

Comment: One commenter requested clarification with regard to the process associated with State requests for approval to pay a RAC a contingency fee that is higher than the 12.5 percent cap set by CMS. This commenter questioned how CMS will assure nationwide consistency on contingency rate approval decisions if States have to submit their requests for approval to the appropriate CMS Regional Office(s). Other commenters wanted clarification regarding the general exception process.

Response: Generally, State requests for approval for exceptions from the requirements of the RAC program, including higher contingency fees, are made using the SPA process and are determined by the Secretary, through delegated authority provided to CMS. CMS, through partnerships between CPI, the Center for Medicaid, CHIP and Survey & Certification (CMCS), and individual CMS Regional Offices, reviews and considers requests for exceptions. CMS strives to ensure consistency to the extent possible with regard to responses to State exception requests. We will review all relevant facts and circumstances surrounding requests for an exception. If a State's request for a higher contingency fee is denied, the decision is appealable to the Departmental Appeals Board. State commenters with additional questions regarding the process associated with exceptions to the RAC program, including questions about the SPA process, should contact their CMS Regional Office.

Comment: One commenter expressed concern that CMS will be injecting itself into a State's decision-making process on a Federal mandate by denying a State's request for using a higher contingency rate and the associated FFP.

Response: Generally, when a State completes a new State Plan preprint page or SPA because of changes in its Medicaid program, it must be approved by CMS in order for the State to receive Federal matching funds. This holds true for the majority of changes to a Medicaid program when FFP is at issue, not just with regard to the Medicaid RAC program. We have the authority to approve a SPA when FFP is at issue. If we deny a SPA or elements thereof, then the State has the right to appeal the decision.

Comment: One commenter recommended that States be given the flexibility to deploy the most appropriate procurement process for their individual State so long as they are within the legal confines of State and Federal procurements laws and regulations, including bundling Medicaid RAC procurements with other services or combining multiple States with one RAC vendor. Another commenter requested that the bundling of RAC services with other recovery services—such as a TPL contractor—should not be permitted because it will limit competition by excluding the most qualified Medicaid RAC firms. This commenter suggested that TPL contractors may not have the skill set to effectively handle complex reviews.

Response: We expect that all States will procure a RAC contractor. If a State feels that its unique situation may preclude it from meeting this expectation, a State must submit a request for an exception to CMS. However, if a State is interested in “bundling” its RAC procurement with other services performed by an existing contractor, then the State must execute a separate task order outlining the requirements of the RAC program with the existing contractor. If a number of States are interested in combining resources and utilize one contractor for their respective RAC programs, we do not object if there are no conflicts of interest and the arrangement comports with Federal and State law.

Comment: One commenter suggested that States should be permitted to apply for an exception from the RAC program to the extent that a State is unable to attract and acquire a RAC vendor.

Response: States are required to procure a RAC contractor. To the extent that a State is having difficulty procuring that contractor, then that State should contact CMS to discuss a potential resolution, which may include additional time to procure a qualified contractor. It is unlikely that we will grant an exception from the entire RAC program as a result of a State needing additional time to procure a RAC vendor.

Comment: One commenter requested public access to the payment rates furnished to Medicaid RACs, similar to the public availability of Medicare RAC payment rates.

Response: We decline to require States to publicly post their Medicaid RAC payment rates. However, we encourage States to make this information available to the extent possible to promote transparency.

Comment: One commenter requested that CMS allow States to engage in contractual agreements with RACs that limit RAC reimbursements to an amount less than the total amount recovered, but to grant States flexibility in meeting this requirement. This would include allowing States to recover from the provider both the amount of the overpayment and the contingency fee when overpayments have been identified.

Response: Section 1902(a)(42)(B)(i) of the Act mandates that payments made to RACs “shall be made to such contractor only from amounts recovered” and that the payments “shall be made on a contingent basis.” Allowing States to recover the contingency fee for the RAC from the provider is inconsistent with the language in the statute. To the extent that State law prohibits it from complying with the statute, then the State should submit a request for an exception to CMS for consideration.

Comment: One commenter indicated that a large number of pharmacy claims being audited include those claims that are questionable due to administrative or clerical errors. This commenter suggested that providers should only be expected to pay the part of the claim that is determined to be an overpayment, not the “clean” portion of the claim or those resulting portions of the claim that are the result of technical or administrative errors.

Response: Medicaid RACs are statutorily mandated to audit Medicaid claims for the purpose of identifying and recouping overpayments as well as identifying underpayments. We would expect a provider to return any identified overpayment to the State Medicaid program. To the extent there are additional errors associated with the claim that do not relate to the RAC's required purpose, the issue is outside the scope of the proposed rule.

Comment: One commenter requested clarification about the following statement in the proposed rule: “States must ensure that they do not pay in total RAC fees more than the total amount of overpayments collected.” Specifically, the commenter inquired whether this is in the aggregate across all audits during a particular time period or if it applies to one particular audit.

Response: States must track the aggregate of claims that are identified as overpayments to appropriately calculate the contingency fees owed to the RAC. States must also account for the costs associated with the identification of underpayments. States must ensure that they do not pay in total RAC fees more than the total amount of overpayments collected.

F. Coordination

Comment: Several commenters expressed concern regarding the duplication of audits. These commenters suggested that CMS should prohibit Medicaid RACs from conducting audits on claims that are already under review by a Medicaid Integrity Contractor or other entity in the final regulation. Commenters also suggested that Medicaid RACs should be required to use a RAC data warehouse to identify any claims that are being reviewed by the RAC or other Medicaid audit program. In addition, the commenters suggested that the final regulation should exclude from RAC review, claims in which payment has been denied and/or withdrawn.

Response: We are concerned about minimizing the potential for multiple audits of the same provider. We recognize the need to minimize the burden on providers associated with responding to multiple audit requests, to the extent possible. States and their RACs are statutorily mandated to coordinate auditing efforts with those of other entities conducting audits of providers receiving payments for Medicaid claims. We have finalized this requirement at § 455.506(c). Under certain limited instances, overlapping audits may be necessary or otherwise unavoidable. For example, if a claim has been reviewed by a Medicaid RAC, and it suspects fraud, then that claim must be referred to law enforcement for review. However, in an effort to limit duplicate audit activity, we have included language in this final rule at § 455.508(g) indicating that Medicaid RACs should not audit a claim that has already been audited or is currently being audited by another entity, including the Medicare RACs. However, we decline to require States to create or use a data warehouse at this time. First, we are not aware of the existence of a data warehouse containing State Medicaid claims data. We are aware that States that have existing RAC-like programs have systems in place to achieve coordination. For example, one SMA reviews a list of claims to ensure that there are no open audits or referrals, whereas another SMA screens cases and meets monthly with its MFCU in an effort to achieve coordination. Second, we are aware that States have limited resources and cannot mandate the creation of a data warehouse. Ultimately, we believe that States need the flexibility to determine the best method of achieving coordination with the resources available to them. With regard to the review of denied claims, the Act requires Medicaid RACs to review Medicaid claims for overpayments. Accordingly, we do not see the need to change the regulation to incorporate denied claims in the final rule. With regard to claims that have been filed and subsequently withdrawn by the provider, we believe that the claims, to the extent that no payment has been made, should not be the subject of RAC review.

Comment: One commenter suggested that CMS should provide centralized access to claims data or State policies to limit the burden on States.

Response: There is no centralized repository of Medicaid claims data. We have and will continue to work with States to provide technical assistance to help States comply with implementation requirements and lessen the burden on States.

Comment: One commenter recommended coordination between vendors when requesting records from hospitals.

Response: We are aware of the potential for overlapping audits of the same provider by multiple auditing entities and are concerned about minimizing the potential for multiple audits of the same provider. States have the flexibility to achieve coordination within a reasonable timeframe. Coordination among auditing entities in a State is achievable. We have learned that States that already have RAC-like programs have systems in place to coordinate the efforts of auditing entities to minimize provider burden. In addition, we are working to assist States with coordination of their auditing efforts with those of other entities.

Comment: In anticipation of the proposed implementation date of April 1, 2011, one commenter suggested that CMS should allow States additional time to accomplish certain tasks to ensure effective implementation of RAC contracts, including coordination of audit activity. Specifically, this commenter indicated that there must be time for careful consideration of how duplicate audit activity will be avoided.

Response: We are aware of the potential for overlapping audits of the same provider by multiple auditing entities and are concerned about minimizing the potential for multiple audits of the same provider. In response to several commenters, we have delayed implementation of this final rule until January 1, 2012. Therefore, States have an opportunity to achieve coordination within a reasonable timeframe. Coordination among auditing entities in a State is achievable. Indeed, we have learned that States that already have RAC-like programs have systems in place to coordinate the efforts of auditing entities to minimize provider burden.

Comment: One commenter inquired whether RACs are required to coordinate their auditing efforts with other entities that conduct cost-based audits for settlement.

Response: The statute requires a State and any contractors under contract with the State to coordinate their recovery audit efforts with other contractors or entities performing audits of entities receiving payments under the State Plan or waiver in the State. Accordingly, at the direction of the State, a RAC is required to coordinate its auditing efforts with those of other auditing entities, including those performing cost-based audits of Medicaid claims.

Comment: One commenter suggested that CMS should include a provision in the final rule requiring CMS and the State to monitor the coordination efforts of States and their RACs to ensure that the coordination is taking place.

Response: We have already surveyed the coordination efforts of States that have a RAC-like program in place. We are very interested in learning about the different methods of coordination that will be utilized by the States. Although we decline to put a monitoring requirement in the final rule, we plan to do this on an informal basis. In addition, as discussed in our responses to other comments, we expect the State to play a vital role with regard to coordination of entities seeking to audit providers who receive payments under the State Medicaid Plan or waiver in the State. We have included language in this final rule requiring States to coordinate the recovery audit efforts of their RACs with other auditing entities at § 455.506(c).

Comment: Several commenters suggested that proposed § 455.508 lack specificity with regard to oversight of RAC eligibility requirements. These commenters also expressed concern about the administrative burden associated with having to respond to multiple requests for the same documentation from different auditors in a given period of time.

Response: The State, not CMS, determines whether its RAC has the ability to perform the requirements outlined in § 455.508. CMS is not involved in the RAC selection process. With regard to the coordination of audits, we are concerned about minimizing the potential for multiple audits of the same provider. We recognize the need to minimize the burden on providers associated with responding to multiple audit requests, to the extent possible. States and their RACs are required to coordinate auditing efforts with other entities conducting audits of Medicaid claims. We finalize this requirement at § 455.506(c). However, we have also included language in this final rule at § 455.508(g) indicating that Medicaid RACs should not audit claims that have already been subject to audit or that are currently being audited by another entity. We recognize that subsequent reviews of claims by other auditing entities may be necessary or otherwise unavoidable. Finally, we hope to develop a system to facilitate State coordination among auditing entities.

Comment: One commenter suggested that once a claim has been reviewed by an auditing entity, that claim should not be subject to review by another auditing entity. For example, if a claim is selected for review by a Medicaid RAC contractor and the claim has previously been reviewed by a State's internal audit department or fraud unit, then the claim should be exempt from any RAC review. Similarly, if a RAC reviews a claim, then a State internal audit department should not subsequently review that claim or include it in a universe of claims that are part of any audit extrapolation.

Response: Generally, if a claim is already subject to review and an overpayment is collected as a result of the audit process, then the claim should not be subsequently reviewed by another auditing entity for the same purpose. We have included language in the final rule at § 455.508(g). However, there are circumstances in which claims may be the subject of multiple reviews, including, but not limited to, potential fraud. Accordingly, the claims at issue may be subject to subsequent review.

Comment: One commenter agreed with CMS' approach to allow States the flexibility to coordinate the collection of overpayments identified by the RAC rather than the RAC itself collecting the overpayment. The commenter currently collects the overpayments from providers and requested CMS approval to continue to collect the overpayments.

Response: We appreciate the commenter's support and inquiry. Generally, States utilize the SPA process to seek our approval regarding any change to their Medicaid programs. States interested in the changes should contact CMS directly with regard to its SPA.

Comment: One commenter recommended that CMS allow States to contract with RACs to only identify overpayments and underpayments and not require the collection of any identified overpayments.

Response: RACs are not required to collect identified overpayments. We specified in the proposed rule at § 455.506(b) that States have the discretion to coordinate the recoupment of overpayments with their RACs. We recognized that States may not be able to delegate the collection of overpayments to contractors and, therefore, granted States the flexibility of coordinating the collection of overpayments. We are finalizing § 455.506(b) as proposed.

Comment: One commenter requested guidance from CMS with regard to the role of Medicare RACs and Medicaid RACs in reviewing claims for dually eligible beneficiaries, those enrolled in both the Medicare and Medicaid programs.

Response: Medicaid RACs are not prohibited from reviewing claims for dually eligible beneficiaries. However, to the extent possible we want to minimize provider burden and if the claims were already reviewed by a Medicare RAC, then the Medicaid RAC should not review the claims. We note that there is little financial incentive for Medicaid RACs to review claims involving dually eligible beneficiaries since Medicare is the primary payer on claims for dual eligibles. Additionally, many States already use TPL contractors to identify overpayments involving eligibility issues.

Comment: One commenter suggested that States should have the flexibility to coordinate with other State and Federal agencies performing audits of providers who receive payment in connection with services furnished to Medicaid beneficiaries. Other commenters suggested coordination between auditing companies when requesting records from hospitals.

Response: States and their RACs are required to coordinate their auditing efforts with other entities that perform audits of providers that receive payments under the State Medicaid Plan. We believe that States have a significant role in coordinating the auditing efforts of their respective integrity programs, RACs, and any other auditing entities under contract with the State as well as any Federal agency seeking to audit a State's Medicaid providers. To the extent a State plays an active role in coordinating the efforts of the various entities seeking to review Medicaid claims, we believe that this will help to minimize the potential for multiple requests for records from different auditing entities.

Comment: One commenter requested that CMS delay implementation of the final rule until coordination issues are resolved.

Response: We disagree with the comment. Implementation of the final rule is not contingent on coordination of auditing entities. As previously discussed, we are very concerned about minimizing provider burden associated with responding to multiple audits and are working to develop a system for States to help facilitate coordination. Additionally, we note that the new effective date for the rule will be January 1, 2012, due in part, to the additional time it will take for States to be prepared for implementation.

Comment: One commenter inquired whether States are required to exclude Payment Error Rate Measurement (PERM) claims from Medicaid RAC review.

Response: Section 1902(a)(42)(B)(i) of the Act mandates that States and their RACs coordinate their “recovery audit efforts with other contractors or entities performing audits of entities receiving payments under the State plan or waiver in the State * * * .” The Act requires the State and its RAC to coordinate with the PERM contractor. PERM uses a random sample of claims to develop the error rates. Accordingly, if certain claims have already been audited by the PERM contractor, then the State, to the extent possible, should not subject the same claims to a subsequent audit by its Medicaid RAC. However, we recognize that the PERM contractor may in fact include claims in its sample that were previously audited by the Medicaid RAC since the PERM is measuring the error rate of payments that do not meet statutory, regulatory or administrative requirements.

Comment: One commenter who participated in the CMS Webinar “Contract Template: Statements of Work,” in which coordination with other entities such as CMS and OGC was discussed, inquired about the meaning of “OGC” and what the State is supposed to coordinate with those entities.

Response: “OGC” is an acronym for the Office of the General Counsel, which is the legal advisor to the Department of Health and Human Services. Coordination with OGC is not necessary, as OGC does not conduct audits of Medicaid claims. With regard to coordination, States and their RACs are required to coordinate their auditing efforts with other entities that perform audits of providers that receive payments under the State Medicaid plan. We believe that States have a significant role in coordinating the auditing efforts of their respective integrity programs, RACs, and any other auditing entities under contract with the State as well as any Federal agency that is conducting potential fraud reviews or seeking to review State Medicaid providers.

Comment: One commenter asked if an Audit Medicaid Integrity Contractor already requested records from a provider for certain claims but did not complete the review at CMS direction, whether the claims should be suppressed from review by a Medicaid RAC.

Response: Generally, if there were no audit findings associated with the review of certain claims, then the claims may be subject to additional review unless the State determines that there is no basis for the audit of the claims.

Comment: One commenter noted that allowing States to contract with more than one RAC poses the risk of duplicate audits of the same provider. This commenter, therefore, suggested that the proposed rule should be modified to ensure that when a State contracts with more than one RAC, the State and its RACs should be required to coordinate their efforts to prevent duplication of audits.

Response: We agree with the comment and are making this change in this final rule at § 455.506(c).

Comment: Several commenters recommended that States be allowed to manage the reporting and referral of potential fraud to law enforcement. They proposed that RACs would report suspected fraud to States and the States would then refer it to the appropriate law enforcement entities such as the “MFCUs, SMA, Federal OIG and local law enforcement.” The States would be able to provide a more comprehensive referral to law enforcement by providing information on past interaction with or conduct by the provider in question. They indicated that State coordination of fraud and/or abuse is consistent with Federal and State laws and regulations.

Response: We agree that States are in the best position to know of potentially fraudulent activities by providers in their States. Accordingly, we have specified in this final rule at § 455.506(d) that States, not RACs, have the responsibility to make referrals of suspected fraud to the MFCU or other appropriate law enforcement agency.

Comment: Several commenters requested that CMS reconsider the scope of work and/or expertise of the Medicaid RAC to distinguish fraud or criminal activity from erroneous billing. These commenters believe that suspicion of fraud and criminal activity should be referred for further investigation by other MICs with expertise to determine whether or not a referral to law enforcement is appropriate.

Response: We understand the concerns of commenters. We believe that States should determine whether there is a sufficient basis for a fraud referral to their State MFCUs or other appropriate law enforcement agency. Accordingly, we are making this change in this final rule at § 455.506(d).

Comment: One commenter indicated that CMS' proposed standard of “reasonable grounds” concerning law enforcement referrals in proposed § 455.508 of the regulation, is subject to variable interpretation and could result in inappropriate referrals. This commenter stated that CMS must clearly define the term “reasonable grounds” and include examples of same.

Response: Based upon the comments received, we have changed the responsibility of making fraud referrals to law enforcement from the Medicaid RACs to the States. We have reflected this change in this final rule at § 455.506(d). We believe that this is consistent with existing Federal regulations that govern State referrals of fraud and abuse, as defined by § 455.2, to the appropriate law enforcement agency as well as require the State to adhere to certain fraud referral standards. In addition, we have removed the language regarding “reasonable grounds” from this final rule. We have also included in this final rule at § 455.508(h) that Medicaid RACs must refer suspected cases of fraud and/or abuse to the State in a timely manner. We expect States to provide clear definitions of timely referrals in its contract with the RAC or other applicable guidance.

Comment: One commenter recommended that CMS adopt the recommendations in the OIG Medicare RAC Referral Report. That report outlined a number of recommendations including requiring Medicare RACs to receive mandatory training on the identification and referral of fraud.

Response: We disagree with the commenter. In the permanent Medicare RAC program, we provided RACs with a presentation about fraud in Medicare, the definition of fraud, and examples of potential Medicare fraud. The OIG stated in its report that because Medicare RACs do not receive their contingency fee for cases they refer and are determined to be fraud, there may be a disincentive for RACs to refer to cases of potential fraud. Medicaid RACs are a State operated program, whereas the Medicare RACs are a national program. Accordingly, the responsibility of making fraud referrals should belong to the State instead of the Medicaid RAC, as initially proposed. We have finalized this change at § 455.506(d).

Comment: One commenter requested the removal of the requirement of immediate referral for suspicion of fraud to law enforcement from the final rule. The commenter suggested the requirement exceeds the authority of the statute. The commenter continued that he/she did not believe that the determination of what may constitute reasonable grounds for referral is within the purview of Medicaid RACs, or that RACs should be required to make the referrals.

Response: We agree that the Medicaid RACs should not have the responsibility to make fraud referrals and that the responsibility belongs to the State. Accordingly, we have made the change in this final rule by adding new subparagraph § 455.506(d). In addition, we have included in this final rule at § 455.508(h) that the Medicaid RAC must refer suspected cases of fraud and/or abuse to the State in a timely manner, as defined by the State. We expect States to provide clear definitions of timely referrals in the contract with its RAC or other applicable guidance.

Comment: One commenter requested clarification on how States and Medicaid RACs will be notified of efforts initiated by the OIG or criminal investigations to facilitate coordination of efforts. The commenter expressed concern that routine RAC activities such as record requests may alert providers and subsequently jeopardize investigations.

Response: We have finalized that States are required to make referrals of suspected fraud and/or abuse to the MFCU or other appropriate law enforcement agency at § 455.506(d). We believe the States play a significant role with regard to coordination generally, and should share information regarding investigative activities or other auditing efforts in the States with their RACs to the extent possible. However, nothing in this final rule requires the Office of Inspector General or other law enforcement authorities to disclose investigative information to Medicaid RACs.

G. Appeals Process

Comment: One commenter asked about the error rate associated with the RACs finding improper payments that ultimately are reversed on appeal. Another commenter asked about the frequency with which an organization believes a RAC has made an error but does not want to go through the appeal process.

Response: We presume that the commenter was inquiring about data from the Medicare RAC program. In the Medicare RAC program, we have contracted with a validation contractor that does an accuracy review for CMS. That contractor reviews a sample of claims each month (overpayments and no findings) to determine if the Medicare RAC was making accurate decisions. In the Medicare RAC Demonstration, only 8.2% of all claims with an improper payment were overturned on appeal. We do not have specific data with regard to providers that decline to appeal Medicare RAC determinations or that believe that a RAC determination was made in error.

Comment: One commenter asked who bears the cost of the appeal if an adverse Medicaid RAC determination is appealed. Specifically, the commenter inquired as to whether the State would be able to claim FFP for the cost of the appeal if the appeal reversed the RAC determination. The commenter also wanted to know if the determination is upheld, whether the provider could include the costs in its cost report.

Response: The cost of a State's appeal would be an allowable administrative cost under the State's Cost Allocation Plan. If a State is establishing a new appeals process for RAC determinations, the State may have to amend its Cost Allocation Plan to cover the new appeals process. A provider's appeal costs are administrative costs that are not allowable under Medicaid.

Comment: One commenter asked how long the appeal process would take an organization to go through.

Response: We are not mandating a single appeals process that all States must use for RAC appeals, therefore the length of time for a provider's appeal in a given State will differ, based on the nature of the State's appeals process and the issues on appeal. However, under section 1902(a)(42)(B)(ii)(III) of the Act, all States must have an appeals process in place for providers to appeal adverse RAC determinations.

Comment: A few commenters asked whether they must seek CMS approval if they intend to use their existing appeals process, or if the requirement to submit to CMS a proposal describing the appeals process which must be approved prior to implementation of the RAC programs applied only when the State intended to establish a separate RAC appeals process or when the State did not currently have an appeals process in place.

Response: The proposed rule provided States with 2 options for their appeals process from which States may choose as they deem appropriate: (1) Either take advantage of an existing appeals process, or (2) establish a separate appeals process for RAC determinations. The proposed rule also required States to submit a proposal describing the appeals process, which we would approve prior to the State implementing its RAC program. In this final rule, we now clarify that we will only require a description and prior approval of any new RAC appeals process that a State will use, not any existing appeals process.

Comment: One commenter encouraged CMS to prohibit any ability for States to establish a new appeals process. The commenter believed a new appeals process would be problematic for those providers that have entities in more than one State, as each would have to comply with more than one process to submit appeals on a timely basis.

Response: We are not mandating a single appeals process that all States must use for RAC appeals. Given that each State has provided us with assurances through the SPA process that it will comply with the statutory requirement to provide an adequate appeals process for entities to appeal adverse RAC determinations, it would be unreasonably burdensome on the States for us to impose a single appeals process for RAC appeals. We are not prohibiting States from establishing a new appeals process for RAC appeals. States will have the flexibility to determine what form of appeals process best suits their respective RAC programs. We are aware that responding to multiple States' processes could be a challenge for providers that are enrolled in multiple States' Medicaid programs. However, the providers would have been involved with the RACs' overpayment determination processes and should have received notice of appeals timeframes.

Comment: One commenter noted that the language of the preamble to the proposed rule refers to “ensuring providers adequate due process rights” while the proposed regulation at § 455.512 only provides for general appeal rights with no mention of due process. The commenter recommends strengthening the rule by changing § 455.512 to read “States shall provide appeal rights that ensure adequate due process under State law or administrative procedures to Medicaid providers that seek review of an adverse Medicaid RAC determination.”

Response: We appreciate the commenter's concerns, however we note that section 1902(a)(42)(B)(ii)(III) of the Act only refers to “an adequate process for entities to appeal any adverse determination.” To allow the States maximum flexibility and to accommodate differences in State laws regarding due process, we are not prescribing specific requirements for an appeals process for adverse RAC determinations. Instead, consistent with the statutory language, we are requiring States to provide an adequate appeals process. Therefore, we decline to revise § 455.512 in accordance with the commenter's request.

Comment: A commenter asked whether the RAC program contractor activities may include legal defense of an appealed overpayment determination, or, in other words, whether the State may contractually obligate the RAC to defend its findings in the administrative appeal. The commenter also asked whether the State specific requirements must be articulated in the SPA.

Response: When designing their RAC programs, States have the discretion to require their RACs by contract to appear in the State's administrative or judicial appeals hearings to defend the RACs' overpayment findings. The Medicaid SPA does not require a detailed description of the State's RAC program. However, in this final rule, we are finalizing at § 455.502(c) the requirement that the State report to CMS elements describing the effectiveness of the State's RAC program, including, but not limited to, general program descriptors (for example, contract periods of performance, contractors' names) and metrics (for example, number of audits conducted, recovery amounts, number of cases referred for potential fraud). CMS will provide sub regulatory guidance to States related to performance metrics, State reporting requirements and other milestones contained in the RAC program.

Comment: A commenter asked CMS to add clarifying language in 42 CFR part 455 subpart F that the SMA and not the RAC is the final arbiter of whether an overpayment or underpayment has been discovered.

Response: When an overpayment is discovered it is governed by § 433.316 of the regulation. To the extent that an overpayment discovered in the course of a RAC audit is not the result of fraud, it would be subject to § 433.316(c). The issue is not which party is the final arbiter of the overpayment, but which party has taken the action that results in the overpayment being discovered. The party that discovered the overpayment would depend upon the process established in the State's RAC contract and which action occurs first in time: From whom communications with providers are initiated, that is SMA or the RAC, and whether the RAC initiates recoupment proceedings.

Comment: One commenter requested that CMS reconsider its position that States could share a part of recovery from a civil or criminal fraud proceeding with a RAC. The commenter was concerned that CMS might unintentionally create strong incentives (through the prospect for multiple damages) that RACs would presume potential fraud where unfounded. The commenter suggested that even without an incentive under the Medicare RAC demonstration, RACs often inaccurately determined the existence of overpayments, with 64 percent of contested cases overturned on appeal, and cited the June 2010, “CMS Update to the RAC Demonstration Report.”

Response: We proposed that nothing would preclude a State from agreeing to pay a RAC a contingency fee from funds recovered and returned to the State as the State share of an overpayment (or restitution) at the close of the civil or criminal proceeding. It would be within the State's discretion to design a RAC program that paid a contingency fee to a RAC on this basis, that is, if the RAC contributed to the recovery and the recovery was fully adjudicated. We are sensitive to the potential for creating an incentive for contingency fees for fraud recoveries. However, given that a fully adjudicated fraud recovery could take several years, we believe the potential pay-off for the RAC would be outweighed by the delay in the payment. We recognize that the Medicare RAC Demonstration program experienced a moderate overturn rate and are hopeful that States will be able to design programs that take the Medicare RAC experience, including overturn rate, into consideration to reduce the burden on the providers and State Medicaid programs.

Comment: One commenter urges CMS to modify the proposed rule to permit only the second option that CMS proposed for structuring payments to RACs in which a State pays a RAC only when the recovery amount is fully adjudicated and all appeals available to the provider have been concluded. Adoption of the second option, the commenter argues, is not only consistent with the expressed interpretation of the statute by CMS, it is also sound policy, as it would incentivize Medicaid RACs to conduct their audits with greater care to avoid errors that would generate appeals. The commenter believes the first option in which a State pays a RAC when the RAC recovers an overpayment and the State requires reimbursement by the RAC if the recovery is overturned on appeal is inconsistent with the language of section 1902(a)(42)(B)(ii)(I) of the Act, which requires that payment must be made only from amounts recovered.

Response: As we stated in the proposed rule, we interpret the statute to mean that (a) payments may not exceed the total amounts recovered, and (b) payments may not be made based upon amounts merely identified but not recovered, or amounts that may initially be recovered but that subsequently must be repaid due to determinations made in appeals proceedings. Therefore, under (a), because the payment is a contingency fee it is relative to the amounts recovered; and under (b), the identified amounts must be recovered for the contingency fee to be paid to the RAC, or the contingency fee must be recouped from the RAC if a recovered overpayment is found at any level of appeal to not have been overpaid by the provider. While some RACs may find the second contingency fee option to be a disincentive to committing errors when performing audits, we think that a delay of as long as two years to be paid the contingency fee would act as a disincentive to contracting with the States at all. We are permitting the States the most flexibility in designing their RAC programs, which includes the timing of payment to their RACs.

Comment: One commenter noted that the level of provider appeals related to RAC determinations could, according to the commenter, “drive substantial program costs.” The commenter asked for clarification as to whether the expenses related to the additional appeals will be subtracted from the Federal share to be refunded.

Response: As stated above, a State's appeal costs would be an allowable administrative cost under the State's Cost Allocation Plan. A provider's appeal costs are administrative costs that are not allowable under Medicaid.

Comment: Several commenters recommended a discussion period between RACs and the providers prior to the commencement of the right to appeal to avoid inaccurate determinations of overpayments. During the discussion period, the providers could provide RACs with information necessary to make an accurate determination. The commenters noted that when the discussion period was implemented in the Medicare RAC program, providers and RACs avoided the time and expense of going through the appeals process. The commenters suggested that SMAs would participate when issues arose regarding RACs' interpretation of the State Plan and other Medicaid payment policies. One commenter recommended a discussion period of 25 days. Another commenter suggested that CMS and the States should monitor how Medicaid RACs observe the discussion period so that it is not treated as a mere formality but, rather, a meaningful opportunity for the parties to address any errors in the determination.

Response: We appreciate the commenters' suggestions and are cognizant of the lessons we might learn from the Medicare RAC program, as well as other audit programs. Providers that submit additional information to auditors during the discussion or comment period may avoid subsequent appeals or they may find that the auditor's findings will stand. Section 1902(a)(42)(B) of the Act establishes a State RAC program, which we are interpreting to grant States the flexibility to design programs, consistent with their State laws and that meet the needs of their States. We will not mandate that States use discussion periods, either at all or of any specified duration. However, we encourage States to require a discussion or comment period prior to a RAC's audit becoming final, as is commonplace in audits. If a State chooses to implement a discussion or comment period in its RAC program, we recommend but do not require that the State monitor the RAC's compliance with that discussion or comment period requirement.

Comment: Several commenters suggested that we should require each State to prescribe a clear appeals process that is robust and provides for multiple levels of appeal. Some commenters urged us to prescribe specific requirements for Medicaid appeals.

Response: We are not mandating a single appeals process that all States must use for RAC appeals nor dictating the manner of the appeals processes that the States must implement for RAC appeals. In the event that, through the SPA process, a State proposed a process that did not provide entities with an adequate opportunity to appeal adverse RAC determinations, we would engage in discussions with the State about its appeals process until the State was able to provide assurances that its appeals process was compliant with section 1902(A)(42)(B)(ii)(III) of the Act. Given that each State has provided us with assurances that it will comply with the statutory requirement to provide an adequate appeals process for entities to appeal adverse RAC determinations, it would be unreasonably burdensome on the States for us to impose a single appeals process for RAC appeals.

Comment: Several commenters objected that our proposed rule failed to prevent RACs from recouping funds associated with denials under appeal. The commenters also objected that the proposal failed to require RACs to return their contingency fee if a denial is overturned at any stage of the appeals process. The commenters believe that CMS' silence on these important issues in the proposed rule will result in overzealous and inappropriate denials on the part of the Medicaid RACs, and urge that RACs must not be able to recoup funds until the appeals process is exhausted and must not receive their contingency fee in cases where the denial is overturned.

Response: We proposed 2 payment options to provide States with the most flexibility in designing their RAC programs: (1) States may pay RACs from amounts identified and recovered, but not fully adjudicated, but the RAC would be required to return any contingency fee that corresponded to the amount of an overpayment overturned on appeal; or, (2) States could pay the RAC after the overpayment was fully adjudicated, that is after the exhaustion of all appeals available to the provider. We disagree that we failed to require RACs to return their contingency fee if a denial is overturned during the appeals process. In the first option as we described it in our proposal, the RAC would be required to return any portion of the contingency fee that corresponded to the amount of the overpayment overturned at any level of appeal.

The commenters are concerned that the opportunity for a contingency fee will act as an incentive to the RACs to find overpayments, even if those are later overturned on appeal and the RACs must return the contingency fee. We believe that the possibility of a contingency fee being overturned would be outweighed by the likelihood that the State would not be able to attract a RAC for its RAC program, were the State limited to payment of the contingency fee after exhaustion of appeals. The appeals process can take years and a RAC would go unpaid for all its cases in the initial years while providers exhausted their appeal rights.

Comment: Several commenters noted that the proposed rule does not require the Medicaid RAC to provide any data on the number of claims appealed and the number of denials overturned during the appeals process. The commenters recommend that these data be captured on a timely basis and urge that the data be used to hold RACs accountable for inappropriate denials. The commenters also urge that information on appeal turnover rates be shared with the public. Two of the commenters also suggested that RACs with a turnover rate of 25 percent or greater per year should be subject to a monetary penalty.

Response: Whether States should require RACs to provide any data on the number of claims appealed or the number of denials overturned during the appeals process, or any penalty to be assessed for high appeal turnover rates is within the discretion of the States when designing their RAC programs. Whether to release Medicaid RAC appeal turnover rates is subject to each State's laws and rules. We proposed that the States provide us with elements describing the effectiveness of the RAC programs, including general program descriptors (contract periods of performance, contractors' names, etc.) and program metrics (number of audits conducted, recovery amounts, number of cases referred for potential fraud, etc.). We will issue sub-regulatory guidance to the States regarding the data to be provided.

Comment: One commenter suggested that CMS set minimum appeal rights that all States must incorporate into their appeals processes. The commenter suggested that a standardized Medicaid RAC appeals process include the following minimum elements:

1. A clearly defined appeals process describing the providers' rights and responsibilities, including the right to submit documentary evidence and to be heard in person.

2. A minimum discussion period, such as 120 days, to rebut the RAC response.

3. A multi-tiered appeals process which provides for an independent review.

4. A process by which recoupment is delayed until the appeals process is finished or has reached a certain stage.

5. A description of how interest will be applied to overpayment determinations.

6. Timeframes regarding appeal deadlines, providing supporting documentation, and issuing review decisions.

7. Detailed decisions describing the basis for upholding the overpayment determination and informing the provider of further appeal rights and deadlines.

8. Agreements between the State, the Medicaid RAC, and any other entities involved in the Medicaid RAC process to ensure the timely and accurate flow of information.

9. Penalties for noncompliance with time frames that should apply to both the provider and the entity adjudicating the RAC appeal.

Response: States will have the flexibility to design their RAC programs, including the content of and signatories to agreements regarding the States' RAC programs, as well as whether there will be a discussion or comment period, and what interest will apply to overpayments. We are finalizing that States have two options to pay contingency fees to RACs: States may pay RACs from amounts identified and recovered, but not fully adjudicated, but the RAC would be required to return any contingency fee that corresponded to the amount of an overpayment overturned at any level of appeal within a reasonable timeframe as prescribed by the State; alternatively, the State may pay the RAC after the overpayment is fully adjudicated, that is after the exhaustion of all appeals available to the provider. We leave the States with the flexibility to select the option that works better for their programs.

Comment: One commenter suggested specific recommendations that if the current State appeals process is at the Administrative Law Judge level only, CMS should impose requirements on the States to implement a tiered appeals process to allow review by an independent, non-government entity as a first or second level of appeal. In addition, CMS should require establishment of timeframes both for providers to submit their appeals, prior to recoupment, and for those entities reviewing the appeals to conclude their work and report the outcome to the providers.

Response: We are neither mandating a single appeals process that all States must use for RAC appeals, nor are we dictating the manner of the appeals processes that the States must implement for RAC appeals, including details as timeframes for any part of the appeals process.

Comment: One commenter appreciated our proposed requirement that State Medicaid RACs must use trained medical professionals, and that the RAC programs must have an adequate appeals process and coordinate with other auditors and law enforcement.

Response: We appreciate the comment. We are finalizing the following requirements: States must require their RACs to employ trained medical professionals, as defined by the State, to review Medicaid claims at § 455.508(a); States must provide appeal rights under State law or administrative procedures to Medicaid providers that seek review of an adverse Medicaid RAC determination at § 455.512; and that States must make referrals of suspected fraud and/or abuse to the MFCU or other appropriate law enforcement agency at § 455.506(d).

Comment: One commenter recommended that we develop a robust and consistent infrastructure to support the Medicaid RAC appeals process, including publishing information about the process online, to reduce confusion and ambiguity experienced by providers.

Response: While we are sensitive to the challenges of multiple States' audits and appeals for providers serving in multiple States' Medicaid programs, we have no plans at this time to establish or implement any online data repository regarding State Medicaid RAC appeals processes.

Comment: One commenter encouraged States to utilize their existing appeals processes rather than to establish new Medicaid RAC appeals processes that would require a learning curve. The commenter also encouraged CMS to establish timeframes for the RACs to respond to providers during the appeals processes. The commenter believed that the RACs should be held accountable in their response period to ensure timeliness in addressing denials.

Response: The States have the flexibility either to take advantage of an existing appeals process or to establish a separate appeals process for RAC determinations. It is within the States' discretion which option they choose. We are not dictating the manner of the appeals processes, including timeframes for RAC responses during the appeals process.

Comment: One commenter noted that Medicare RACs demonstrated a lack of sufficient review of claims, understanding, and due diligence to take the appropriate amount of time and ensure their information is accurate before submitting a denial letter to the provider. Therefore, the commenter suggested that CMS hold RACs accountable and require them to conduct due diligence, ensuring accurate and timely denial letters are submitted to providers under audit.

Response: We are applying the lessons we have learned in the Medicare RAC program; however, the States have a certain degree of flexibility to design their RAC programs, including the development of RAC audit protocols and the content of its findings. However, we agree with the commenter that the RAC should timely notify providers of its overpayment findings. We have finalized at § 455.508(e)(4) that RACs must notify providers of its overpayment findings within 60 calendar days.

Comment: One commenter suggested that patients not receive a letter regarding an audit until the appeals process has ended and the determination is final. The commenter also recommended that CMS publish written policies and procedures of all processes to promote consistency and provider knowledge, as well as proper understanding of these processes.

Response: In the course of routine Medicaid provider audits, Medicaid beneficiaries are contacted to verify receipt of services. Accordingly, we decline to restrict SMAs in the ordinary conduct of audits. Additionally, Medicaid RACs are individually State operated, administered and procured programs. Therefore, CMS will not publish written policies and procedures about State processes.

Comment: A few commenters supported our proposed approach to allow States to use existing appeals structures.

Response: We appreciate the commenters' support.

Comment: One commenter had several recommendations for the audit and appeals process regarding notices to providers during the audit; notifications of findings of overpayments or underpayments; time limits for repayment; and information on the right to rebut the findings and the right to appeal. The commenter specifically recommended that the notice to providers should explain the right to appeal, specific requirements for appealing, and the effect of an appeal on the timing of repayment or offset and applicable interest; and that contact information should be provided for both rebuttal and appeal inquiries.

Response: Each State has a certain degree of flexibility with regard to the design of its RAC program, including whether to use an existing appeals process or to establish an alternate appeals process for RAC determinations. We are not mandating those details as part of the content of the RAC's findings. However, we believe that the RAC should timely notify providers of its overpayment findings. We have finalized at § 455.508(e)(4) that RACs must notify providers of its overpayment findings within 60 calendar days.

Comment: One commenter requested that CMS require the Medicaid RAC process mirror the Medicare RAC program to alleviate the stress of managing audits in multiple States and ensure the process is more seamless for providers. The commenter also requested that CMS require an independent decision maker such as an Administrative Law Judge at some level of the appeal process to protect providers and the Medicaid program, providing oversight and an unbiased opinion.

Response: We are sensitive to the challenge that audits in multiple States can present to providers that serve multiple States' Medicaid programs. Nevertheless, we are neither mandating a single appeals process that all States must use for RAC appeals, nor are we dictating the manner of the appeals processes that the States must implement for RAC appeals, including who will be the decision makers in their appeals processes. Given that each State has provided us with assurances through the SPA process that it will comply with the statutory requirement to provide an adequate appeals process for entities to appeal adverse RAC determinations, it would be unreasonably burdensome on the States for us to impose a single appeals process for RAC appeals.

Comment: One commenter recommended that CMS conduct a thorough review of State appeals processes and establish some level of consistency across States, and include provisions that will require adequate documentation of those processes including establishing time frames in which documentation should be provided by RACs to providers who are interested in filing an appeal. The commenter also recommended that CMS include provisions that would require States to keep appeal processes independent of RAC activities. The commenter was concerned that because RAC fees are based on the amount of the overpayment collected, RACs have an added incentive to avoid potential provider appeals. The commenter suggested that all appeals processes should be done by the State and not the RAC or other entities that may have an interest in the outcome of the appeal.

Response: Each State has a certain degree of flexibility in the design of its RAC program, and we are not mandating a single appeals process that all States must use for RAC appeals, nor are we dictating the manner of the appeals processes, including timeframes for providing documentation to providers for filing an appeal and how the appeals process would be structured. We are requiring that the States operate a RAC program that meets the requirements of the statute, including providing an adequate appeals process: section 1902(a)(42)(B)(ii)(III) of the Act requires an adequate appeals process for providers to appeal any adverse Medicaid RAC determinations. While we appreciate the commenter's concerns that RAC activities be separate from the appeals process, we are not mandating the structure of each State's RAC program.

Comment: One commenter recommended clarification of the rule describing providers' rights to appeal and that we require peer review of overpayments.

Response: Each State has a certain degree of flexibility to design its RAC program, including whether to use an existing appeals process or to establish an alternate appeals process for RAC determinations and how the appeals process will function in that State. While we are requiring that States require their RACs to employ trained medical professionals, as defined by the State, to review medical claims, it is within the States' discretion to determine whether to use medical professionals to review Medicaid RACs' findings prior to the recoupment of overpayments.

Comment: One commenter recommended that due to an already overburdened system, we should require the establishment of a concrete timeframe for the record requests, the actual audit, and the appeals process.

Response: We are sensitive to the demands of audits on States' and providers' time. However, States have the flexibility with regard to the design of its Medicaid RAC appeals processes. Therefore, we are not mandating those details as timeframes for records requests, the duration of the audit, or the appeals process.

Comment: One commenter noted that the State would have a disincentive to establish a vigorous, unbiased appeals process because it is required to return the Federal share under § 433.312 even if the State is unable to recover the overpayment from the provider.

Response: Under section 1903(d)(2)(C) of the Act and § 433.312, the State will have a year to attempt to recover an overpayment from a provider, except in cases of fraud where the time period may be longer. Then, the State must return the Federal share regardless of whether it does in fact recover the overpayment. However, if a determination is overturned on appeal, the State can request a refund of the Federal share through processes outlined in § 433.320. Thus, we disagree with the commenter that there is a disincentive for States to establish a vigorous, unbiased appeals process. States are required under section 1902(a)(42)(B)(ii)(III) of the Act to establish an adequate process for providers to appeal adverse RAC determinations. We are confident that States will afford providers vigorous and unbiased appeals processes.

Comment: One commenter suggested that CMS review each State's appeals process to determine its reasonableness. The commenter recommended that timeframes for filing appeals and making decisions on the appeals should allow providers to more easily keep track of all the levels of reconsideration and review as well as timely filing dates for all the appeal levels. CMS should very closely monitor the different appeals systems and remain alert to the concerns of providers if unreasonableness, inconsistency and unnecessary complexity overwhelm provider efforts to be compliant.

Response: Each State has the flexibility to design its Medicaid RAC appeals process, including whether to use an existing appeals process or to establish an alternate appeals process for RAC determinations. While we are requiring States to submit a description and obtain prior approval of any new RAC appeals process that a State will use (not any existing appeals process), we are not dictating the manner of the appeals process that the States must implement for RAC appeals.

H. Payment—General/Federal Share/Administrative Match

Comment: One commenter asserted that CMS should require States to implement automatic positive payment adjustments to providers through the “X12 835 transaction process.”

Response: This comment is outside of the scope of the proposed regulation. Therefore, we decline to accept this suggestion.

Comment: One commenter asked for clarification regarding what activities are eligible for administrative matching.

Response: Section 1903(a) of the Act directs payment of FFP, at different matching rates, for amounts “found necessary by the Secretary for the proper and efficient administration of the State plan.” The Secretary is the final arbiter of which activities fall under this definition. Claims held under this authority must be directly related to the administration of the Medicaid program.

Comment: A few commenters requested and/or recommended an enhanced FFP rate for implementing the Medicaid RAC program. Other commenters recommended an enhanced FFP match of 90 percent, and one commenter recommended a rate of 75 percent.

Response: Because enhanced Federal match was not specifically authorized by the Affordable Care Act, activities associated with the procurement, operation and administration of a Medicaid RAC do not qualify for enhanced Federal match.

Comment: One commenter requested that CMS clarify whether a State's statute allows the State to directly receive the overpayment instead of delegating the collection responsibility to the RAC.

Response: In the proposed rule, we acknowledged the differences among the States and territories regarding the issue of coordinating with Medicaid RACs for the collection of overpayments. We stated that the statute requires Medicaid RACs to collect overpayments, but some States may not be legally able to delegate the collection of overpayments to contractors. Accordingly, we finalize at § 455.506(b) that States will have the discretion to coordinate the collection of overpayments with their Medicaid RACs.

Comment: One commenter suggested that there is a need for a standard traceable recovery identifier to be used from beginning to end to allow for reconciliation.

Response: We recommend that States explore efficient and innovative processes to detect and/or prevent improper payments. However, we do not require States to implement uniform processing systems for payments to providers.

Comment: One commenter requested that CMS clarify the budget and accounting standards that States must comply with when accounting for transactions with Medicaid RACs.

Response: Estimates of Federal funds on overpayments should be included in the Form CMS-37 reports, following the requirements for reporting of collections and overpayments, not collected within one year, as required by § 433.312. States should already have an accounting process in place to record overpayments when discovered, as well as the Federal share received, and for recording collections and reporting collections on the Form CMS-64 as they occur, and reporting outstanding overpayments at the end of the one-year period. States should follow those same accounting standards and procedures to account for Medicaid RAC overpayments and collections and the required reporting as indicated above, although they should be identified as RAC overpayments and collections to facilitate determination and reporting of RAC fees.

Comment: One commenter requested that CMS clarify when CMS expects repayment of the Federal share of overpayments. The commenter stated that CMS should give States up to one year to remit the Federal share of the funds recovered. Providing States with up to one year to remit funds will allow States the opportunity to recoup funds from future payments.

Response: Under section 1903(d)(2) of the Act, States have up to one year to recover overpayments before an adjustment is made in the Federal payment to the State to account for that overpayment. The Federal share of collections should be reported when received, if collected within the one-year period. At the end of that period, the Federal share of the uncollected overpayment amount must be refunded to the Federal government.

Comment: One commenter requested clarification regarding proposed language provided at sections 1902(a)(42)(B)(ii)(IV)(bb) and 1903(d) of the Act as it applies to amounts recovered under the Medicaid RAC program. There, the commenter noted that “[w]e propose that a State must refund the Federal share of the net amount of overpayment recoveries after deducting a RAC's fee payments.” The commenter wanted CMS to assure that there is no potential conflict with interpretation of language from page 75 FR 69041 of the proposed rule discussing repayment of the Federal portion. Additionally, the commenter wanted clarification that the Federal share should be refunded from overpayments or amounts actually recovered.

Response: The reporting will identify the overpayment recoveries received and the RAC fees paid, which will ensure that the fees do not exceed the recoveries. Additionally, overpayments for which the one-year period for collection has expired will be reported to repay the Federal share.

The reporting on the recoveries (collections) will distinguish between recoveries reported within the one-year period to collect (refunded on the current report) and collections for overpayments previously refunded due to the expiration of the one-year period (not refunded on the current report as the amount was previously refunded). The Federal share of overpayment amounts collected within one year from discovery is to be refunded when collected (recovered); the Federal share of overpayment amounts not collected at the end of the one-year period must be refunded at that time.

Comment: One commenter indicated that § 433.312 requires States to refund the Federal share of overpayments, regardless of whether the State actually recovers the overpayments from providers. This commenter sought clarification that there was no conflict with other sections of the proposed rule which stated that RACs are paid from amounts “actually recovered from the provider after all appeals and negotiations are finalized, and not on amounts identified.”

Response: We do not believe that these provisions are in conflict. One concept involves the return of FFP to the Federal Government, whereas the other pertains to the timing of payment to a RAC by a State. In the proposed rule, we indicated that the requirement for States to refund the Federal share of overpayments applied to overpayments that are identified by the RAC. Therefore, if a Medicaid RAC identifies an overpayment, the State is required to refund the Federal share of the overpayment amount if not collected by the expiration of the one-year period. The State's obligation to return FFP is independent of its obligation to compensate a RAC for the work it performs. That occurs when an overpayment is collected and a corresponding contingency fee is paid to the RAC.

Comment: One commenter indicated that the initial identification of overpayment amounts may be subject to change because findings are often reversed or revised after additional information is obtained, and some findings are thrown out through the appeals process. If the RAC contractor is not paid until overpayments are actually recovered, it makes sense that the Federal portion of those recovered funds would be repaid to the Federal government after an appeals process is completed.

Response: The refunding of the Federal share is governed by the overpayment regulation at § 433.312, as discussed above. If the appeals process changes the overpayment amount after the expiration of the one-year period for collection and the State reported that overpayment, the overpayment amount can then be adjusted on the Form CMS-64.9ORAC for reporting RAC overpayments that have not been collected at the end of the one-year period.

Comment: One commenter recommended that the final rule should be updated to reflect how recoveries are handled via a payment plan.

Response: If a State provides a payment plan which recovers the total overpayment within one year from discovery, the recoveries are reported as received. If the payment plan exceeds the one-year period, the recoveries are refunded as collected during the one-year period and then the balance is refunded on the overpayments schedule. Subsequent recoveries of that balance would be reported for the purpose of showing that fees paid do not exceed recoveries, but would not be refunded as it would have already been refunded through the reporting on the overpayment schedule.

Comment: One commenter recommended that CMS remove reference to payment when addressing RAC fees in proposed section 1902(a)(42)(B)(ii)(IV)(bb) of the Act: “We propose that a State must refund the Federal share of the net amount of overpayment recoveries after deducting a RAC's fee payments . * * * In other words, a State would take the RAC's fee `off the top' before calculating the Federal share of the overpayment recovery to be returned to CMS.”

Response: We are uncertain what the commenter is suggesting regarding removing the reference to payment when addressing the RAC fee. The statute requires that the RAC “program is carried out in accordance with such requirements as the Secretary shall specify including * * * that section 1903(d) [of the Act] shall apply to amounts recovered under the program.” In the proposed rule we indicated that the “State would take a RAC's fee payment `off the top' before calculating the Federal share of the overpayment recovery to be returned to CMS”. We clarify the reporting in this final rule. In order to adequately identify recoveries and fees paid, States must report both the overpayment recoveries and associated fees using the same Federal share (FMAP rate) that is applicable to the overpayments. Similarly, the fees paid for identifying underpayments will be reported at the same FMAP rate appropriate to the payment of that underpayment amount, or the current FMAP rate if the underpayment is not paid.

Comment: One commenter recommended that the reconciliation process with historical data should be visible to both the RAC and the provider.

Response: States have certain flexibilities in which to design, procure, administer, and operate their RAC programs. While we decline to adopt the commenter's recommendation, we encourage States to adopt measures that will promote transparency and efficiency in the Medicaid RAC program.

Comment: One commenter suggested that CMS revise its proposed methodology for RAC payment to permit State flexibility, allowing States the option to claim contingency fees for RACs consistent with current administrative FFP claiming protocols for existing TPL and non-TPL overpayment recovery contracts. The State believes that requiring States to run an accounting process for RAC contingency fees that may differ from existing non-RAC overpayment recovery contingency fee claiming processes is administratively burdensome and invites opportunity for error.

Response: In the proposed rule, we considered requiring States to treat RAC contingency fees at the administrative rate of 50 percent. However, we determined that the language in the legislation supported treating the fees at the FMAP rate applicable to the recovery. This provides a higher benefit for States than treating the fees at the administrative rate.

Comment: One commenter indicated that the proposed rule does not specify that providers must request reimbursement for underpayments. The commenter further indicated that providers must be responsible and accountable for their claims and the State should not be required to make payments without the provider submitting a claim.

Response: As previously stated, we are concerned about provider participation in the Medicaid program as well as States making proper payments to providers. We believe that States should compensate providers for identified underpayments, consistent with State law. We are requiring States, in this final rule at § 455.510(c)(3), to inform providers about underpayments that are identified by their Medicaid RACs.

Comment: One commenter indicated that its Medicaid Management Information System (MMIS) only retains claims available for adjustment for two years. Additionally, it asserted that adjudicating claims or adjustments outside of the regulated time frames creates technical accounting and recording problems.

Response: We understand the commenter's concerns. However, consistent with § 433.322, States are required to maintain a separate record of all overpayment activities for each provider in a manner that satisfies the retention and access requirements of 45 CFR part 74, subpart D. However, we are finalizing at § 455.508(f) that the maximum look-back period for claims review is three years. If a State's MMIS system only retains adjustable claims data for only two years, a State may request an exception from CMS through the SPA process. We believe this flexibility also enables States to address concerns pertaining to adjudication and adjustments.

I. Exceptions

Comment: Several commenters recommended that CMS clarify its position on whether Medicaid RACs will review Medicaid managed care claims. Most, if not all, of these commenters recommended that CMS provide guidance exempting Medicaid managed care claims from review by Medicaid RACs, and focus only on fee-for-service claims. However, one commenter indicated that it interpreted the proposed rule to include Medicaid managed care claims within the scope of Medicaid RAC review. The commenter made several recommendations, including restating previous recommendations for Parts C and D of the Medicare program.

Response: While the proposed rule was silent on the issue of whether managed care claims would be included in the scope of review by the Medicaid RACs, we clarify in the final rule that States may exclude Medicaid managed care claims from review by Medicaid RACs. We are finalizing at § 455.506(a)(1) that Medicaid RACs will only be required to review fee-for-service claims until that time as a permanent Medicare managed care RAC program is fully operational or a viable State Medicaid model is identified, at which point, we may engage in future rulemaking with regard to the review of managed care claims by Medicaid RACs.

Comment: One commenter suggested that CMS include an exemption for Medicaid payments made from the “CMMI or other delivery system reform programs.”

Response: We appreciate the commenter's suggestion regarding the Center for Medicare and Medicaid Innovation (CMMI) and other delivery reform programs CMS is implementing. States have the discretion to exclude review of claims that are submitted in connection with payment or delivery system reform programs until the time a viable RAC model is identified.

Comment: One State recommended that CMS' final rule should exempt Medicaid RAC programs in States with less than 125,000 enrolled Medicaid beneficiaries. Additionally, other commenters suggested that States with low PERM error rates will experience limited recoveries from the RAC program. Therefore, the States should be exempt from establishing Medicaid RAC programs. Another commenter requested an exception to proposed § 455.510(b)(3) and § 455.510(b)(4) for States with low numbers of Medicaid providers and beneficiaries and/or expenditures. Finally, one commenter expressed its concern about repetitive audits leading to diminished provider access. The commenter continued that it will not be able to attract a RAC for less than 12.5 percent, the contingency fee cap.

Response: The Secretary has discretionary authority to grant exceptions from program requirements and complete exemptions from establishing a Medicaid RAC program, to a State, upon a State's submission of justification for its request. States were advised that they may request exceptions through the SPA process. We emphasize that complete exceptions will be granted rarely and under exceptional circumstances. States are timely notified as to whether their requests will be granted prior to the expiration of the 90 day clock.

J. ICR Comments

Comment: One commenter anticipated that the appeals process will consume 100-200 hours per case at a minimum, rather than the 60 hours that we estimated.

Response: We appreciated the comment, but each State's appeals process will vary, as will individual cases. Therefore, we have provided estimates in our analysis to capture this variance.

Comment: One commenter asked for details on the elements that must be reported to CMS, and also for clarification on how and when the elements must be reported.

Response: Section 455.502(c) of the final rule requires States to report to CMS certain elements regarding the effectiveness of their RAC programs. These elements include, but are not limited to, general program descriptors and program metrics to evaluate the effectiveness of their Medicaid RAC programs. We are currently developing these elements, and will share them with States via sub-regulatory guidance.

Comment: One commenter estimated the full reporting requirement to take each State 10 through 15 hours per month to query, aggregate, and submit the data to CMS.

Response: We understand the burden associated with this requirement includes the time and effort put forth by the State to aggregate data to report on the effectiveness of its RAC program.

K. RIA Comments

Comment: Several commenters disagreed with our assertion in the proposed rule that most providers will experience limited financial impact from the Medicaid RAC program. The commenters stated that their member organizations have expended significant resources responding to RAC requests and many have hired additional staff to meet the demands of the Medicare RAC program. They anticipate that their costs will be exacerbated if the Medicaid RAC rule is not revised to incorporate policies necessary to avoid aggressive and overzealous RAC denials.

Response: CMS has closely examined many of the lessons learned from the Medicare RAC demonstration in parallel with the current provisions of the permanent Medicare RAC program, and incorporated those best practices into this final rule. As a result, we believe this will limit the burden and associated financial impact on providers. We also clarify that Medicaid RACs will conduct audits of Medicaid providers for overpayments and underpayments, and not deny payments. In addition, we finalize a number of provisions that address providers' concerns, including those related to overzealous RAC auditors. For example, at § 455.506(c), we finalize that States must coordinate the recovery audit efforts of their RACs with other auditing entities. At § 455.506(e), we require States to set limits on the number and frequency of medical records to be reviewed by the RACs, subject to requests for exceptions from RACs. At § 455.508 (a), (b) and (c), we prescribe mandatory staffing requirements for RACs. At § 455.508(d), we require States and their RACs to develop an education and outreach program which includes notification to providers of audit policies and protocols. At § 455.508(e), we require RACs to provide several mandatory customer service measures in their programs. At § 455.508(f), we prescribe a maximum look back period of 3 years from the date of the claim. At § 455.508(g), we prohibit RACs from auditing claims that have already been audited or that are currently being audited by another entity. At § 455.510(b)(3), we finalize that if a provider appeals a RAC overpayment determination and that determination is reversed, at any level, the RAC must return the contingency fees associated with that payment. We expect that these provisions will encourage RACs to perform their work with diligence and restraint. At § 455.510(c)(2) and (c)(3), we require States to adequately incentivize RACs to detect underpayments and notify providers about underpayments that are identified by RACs, respectively. Lastly, we finalize at § 455.512, the requirement for States to provide an adequate appeals process for providers. We are sensitive to the challenge that responding to audits and appeals in multiple States can present to providers that participate in multiple States' Medicaid programs.

Comment: One commenter requested that CMS reconsider its statement that the proposed rule will have no significant impact on Medicaid providers and consider the resources and time that providers must devote to Medicaid RAC requests for medical records, appeals, etc. The commenter noted that CMS should also consider the exponential impact of this program when combined with other audit programs. The commenter urged CMS to take steps in the final rule to minimize these costs.

Response: We are aware of the challenge of responding to multiple requests for audits for providers that serve in State Medicaid programs. Under section 1902(a)(42)(B)(ii)(IV)(cc) of the Act, States must coordinate their audit efforts with other contractors and entities performing audits or providers, including efforts with law enforcement. In an effort to minimize provider burden, we have included in this final rule at § 455.508(g) that Medicaid RACs should not audit claims that have already been audited or are currently being audited by another entity as well as a provision at § 455.506(e) requiring the State to set limits on the number and frequency of medical records to be reviewed by its RAC (subject to RAC requests for an exception to this requirement). Lastly, as detailed in the previous response, this final rule modeled several requirements on RACs based on the lessons learned from providers' past experience with the Medicare RAC demonstration. As a result, we believe this will limit the financial impact on providers.

IV. Provisions of the Final Regulations

After consideration of the comments reviewed and further analysis of specific issues, we are adopting the provisions of the proposed rule as final with several revisions. Those provisions of the final rule that differ from the proposed rule are as follows:

• States may exclude Medicaid managed care claims from review by Medicaid RACs (§ 455.506(a)(1)).
• States must coordinate the recovery audit efforts of their Medicaid RACs with other auditing entities (§ 455.506(c)).
• States must make referrals of suspected fraud and/or abuse to the MFCU or other appropriate law enforcement agency (§ 455.506(d)).
• States must set limits on the number and frequency of medical records to be reviewed by the Medicaid RACs subject to requests for exceptions made by the RACs (§ 455.506(e)).
• Each RAC must hire a minimum of 1.0 FTE Contractor Medical Director who is a Doctor of Medicine or Doctor of Osteopathy in good standing with the relevant State licensing authorities and has relevant work and educational experience. A State may seek to be excepted, in accordance with § 455.516, from requiring its RAC to hire a minimum of 1.0 FTE Contractor Medical Director by submitting to CMS a written request for CMS review and approval (§ 455.508(b)).
• RACs must hire certified coders unless the State determines that certified coders are not required for the effective review of Medicaid claims (§ 455.508(c)).
• RACs must work with the State to develop an education and outreach program (including notification of audit policies and protocols) (§ 455.508(d)).
• RACs must provide minimum customer service measures including: Providing a toll-free customer service telephone number in all correspondence sent to providers, and staffing the toll-free number during normal business hours from 8:00 a.m. to 4:30 p.m. in the applicable time zone (§ 455.508(e)(1)); compiling and maintaining provider approved addresses and points of contact (§ 455.508(e)(2)); mandatory acceptance of provider submissions of electronic medical records on CD/DVD or via facsimile at the providers' request (§ 455.508(e)(3)); notifying providers of overpayment findings within 60 calendar days (§ 455.508(e)(4)).
• RACs must not review claims that are older than 3 years from the date of the claim, unless it receives approval from the State (§ 455.508(f)).
• RACs should not audit claims that have already been audited or that are currently being audited by another entity (§ 455.508(g)).
• If a provider appeals a Medicaid RAC overpayment determination and the determination is reversed, at any level, then the Medicaid RAC must return its contingency within a reasonable timeframe as prescribed by the State (§ 455.510(b)(3)).
• States must adequately incentivize the detection of underpayments (§ 455.510(c)(2)).
• States must notify providers of underpayments that are identified by the Medicaid RACs (§ 455.510(c)(3)).
• States must provide appeal rights under State law or administrative procedures to Medicaid providers that seek review of an adverse Medicaid RAC determination (§ 455.512).

In addition to the inclusion of provisions in the final rule that differ from the proposed rule, we are retaining the following provisions, described below, as published in the proposed rule.

We have retained proposed “Subpart F—Medicaid Recovery Audit Contractors Program” that will implement section 1902(a)(42)(B) of the Act, which sets forth provisions relating to States establishing recovery audit contractor programs in which States will contract with 1 or more Medicaid RACs to audit Medicaid claims and to identify underpayments and identify and recover overpayments. We are also retaining the following sections:

A. Purpose (§ 455.500)

In § 455.500, we set forth the purpose of the new subpart F. The regulations will implement section 1902(a)(42)(B) of the Act that establishes the Medicaid RAC program.

B. Establishment of Program (§ 455.502)

In § 455.502(a), we establish the Medicaid RAC program as a measure for States to promote the integrity of the Medicaid program. At § 455.502(b), we require that States enter into contracts with one or more RACs to carry out the activities described in § 455.506. At § 455.502(c), we require that States report on certain elements describing the effectiveness of their Medicaid RAC program.

C. Definitions (§ 455.504)

In § 455.504(a), we define the Medicaid RAC program as a recovery audit contractor administered by a State to identify overpayments and underpayments and recoup overpayments. At § 455.504(b), we define the Medicare RAC program as a recovery audit contractor program administered by CMS to identify overpayments and underpayments and recoup overpayments.

D. Activities to be Conducted by Medicaid RACs and States (§ 455.506)

At § 455.506(b), States will have discretion over the manner in which they coordinate with Medicaid RACs' for the recoupment of overpayments.

E. Eligibility Requirements for Medicaid RACs (§ 455.508)

At § 455.508(a), we provide that an entity must have the technical capability to carry out the activities described in § 455.506, including employing trained medical professionals to review Medicaid claims. At § 455.508(i), we provide that RACs must meet other requirements as the State may require.

F. Payments to RACs (§ 455.510)

At § 455.510(a), fees paid to RACs must be made only from amounts recovered. At § 455.510(b), we require the State to determine the contingency fee rate paid to a Medicaid RAC for the identification and recovery of overpayments. At § 455.510(b)(1), we require that the contingency fee paid to Medicaid RACs be based on a percentage of the recovered overpayment amount. At § 455.510(b)(2), States must determine at what stage of the audit process Medicaid RACs will receive their contingency fee. At § 455.510(b)(4), except as provided in paragraph (b)(5), we will not provide FFP for any amount of contingency fee that exceeds the then highest contingency fee rate paid to a Medicare RAC. At § 455.510(b)(5), on a case-by-case basis, we will review and consider substantially justified requests from States to pay Medicaid RAC(s) a contingency fee higher than the highest Medicare RAC contingency fee. At § 455.510(c)(1), we require that States determine the fee paid to Medicaid RACs to identify underpayments.

G. Federal Share of State Expense for the Medicaid RAC Program (§ 455.514)

At § 455.514(a), funds expended by States to carry out the Medicaid RAC program must be considered necessary for the proper and efficient administration of the States Plan or waivers of the Plan. Additionally, in § 455.514(a), the Federal share of State expenses does not include fees paid. At § 455.514(b), FFP is available to States for administrative costs of operation and maintenance of Medicaid RACs, subject to CMS' reporting requirements.

H. Exceptions From Medicaid RAC Programs (§ 455.516)

At § 455.516, States that seek to be excepted from any of the requirements of the Medicaid RAC program must submit to CMS a written justification for the request and obtain CMS approval.

I. Applicability to the Territories (§ 455.518)

At § 455.518, the provisions in § 455.500 through § 455.516 are applicable to Guam, Puerto Rico, U.S. Virgin Islands, American Samoa and the Commonwealth of the Northern Mariana Islands.

V. Collection of Information Requirements

Under the Paperwork Reduction Act of 1995, we are required to provide 30-day notice in the Federal Register and solicit public comment before a collection of information requirement is submitted to the OMB for review and approval. To fairly evaluate whether an information collection should be approved by OMB, section 3506(c)(2)(A) of the Paperwork Reduction Act of 1995 requires that we solicit comment on the following issues:

• The need for the information collection and its usefulness in carrying out the proper functions of our agency.
• The accuracy of our estimate of the information collection burden.
• The quality, utility, and clarity of the information to be collected.
• Recommendations to minimize the information collection burden on the affected public, including automated collection techniques.

We solicited public comment on each of these issues for the following sections of this document that contain information collection requirements (ICRs):

A. ICRs Regarding State Submission of Certain Elements Describing the Effectiveness of Their Medicaid RAC Programs (§ 455.502)

Section 455.502(c) requires States to submit certain elements describing the effectiveness of their Medicaid RAC programs. These elements include, but are not limited to general program descriptors and program metrics that will evaluate effectiveness. The burden associated with this requirement will be the time and effort put forth by the State to aggregate data to report on the effectiveness of its RAC program. We estimate it will take each State 2 hours to perform this task. The estimated annual burden for this requirement is 112 hours (56 States × 2 hours) at an estimated cost of $3,778.88 ($33.74/hr labor × 112 hours). The work will be performed by a mid-level analyst whose salary is the average hourly salary as determined by the Bureau of Labor Statistics as of December 2010, not seasonally adjusted. This hourly wage reflects 48 percent fringe benefits and overhead costs.

B. ICRs Regarding State Justifications to Pay Higher Contingency Fees (§ 455.510)

Section 455.510(b)(5) requires States to submit justifications to CMS to pay Medicaid RACs a contingency fee higher than the highest Medicare RAC. The burden associated with this requirement is the time and effort put forth by the State to prepare and submit a justification. We estimate it will take each State 60 hours to perform this task if they submit the justification. The estimated annual burden for this requirement is 3,360 hours (56 States × 60 hours) at an estimated total cost of $113,366.40 ($33.74/hr labor × 3,360 hours). The work will be performed by a mid-level analyst whose salary is the average hourly salary as determined by the United States Bureau of Labor Statistics as of December 2010, not seasonally adjusted. This hourly wage reflects 48 percent fringe benefits and overhead costs.

C. ICRs Regarding Medicaid RAC Provider Appeals (§ 455.512)

Section 455.512 requires States to provide administrative appeal procedures for Medicaid providers that seek review of an adverse Medicaid RAC determination. The burden associated with this requirement is the time and effort put forth by the State to prepare and provide administrative appeal procedures. We estimate it will take each State 60 hours to perform these tasks. The estimated annual burden for this requirement is 3,360 hours (56 States × 60 hours) at a cost of $192,696 ($57.35/hr labor × 3,360 hours). The work will be performed by an attorney whose salary is the average hourly salary as determined by the United States Bureau of Labor Statistics as of December 2010, not seasonally adjusted. This hourly wage reflects 48 percent fringe benefits and overhead costs.

D. ICRs Regarding Federal Share of State Expense for the Medicaid RAC Program (§ 455.514)

Section 455.514(b) provides that FFP will be available to States for the Federal share of State expenses for the Medicaid RAC program, subject to CMS' reporting requirements. The burden associated with a State reporting quarterly expenditure estimates is currently approved under OMB control number 0938-0067 with an expiration date of August 31, 2011. CMS recently submitted its request for a 3-year extension of the August expiration date. This rule will not significantly affect the requirements under OMB # 0938-0067. The Form CMS-64 is a collection of forms in which States are already required to report routine Medicaid recoveries to CMS on a quarterly basis. This task is accomplished electronically. The final rule requires States to account for, separately, Medicaid RAC overpayment recoveries and the corresponding contingency fees associated with the recoveries. We estimate that it will take each State 4 hours/quarterly to meet this requirement; therefore, the total annual burden associated with this requirement is 896 hours(56 States × 4 hours × 4 quarters) at an annual total estimated cost of $43,285.76($48.31/hour labor × 896 hours). The work will be performed by a computer systems analyst whose salary is the average hourly salary as determined by the United States Bureau of Labor Statistics as of December 2010, not seasonally adjusted. This hourly wage reflects 48 percent fringe benefits and overhead costs.

E. ICRs Regarding Exceptions From Medicaid RAC Programs (§ 455.516)

Section 455.516 requires a State that is seeking an exception from any of the requirements of the Medicaid RAC program to submit a written justification to CMS. The burden associated with this requirement is the time and effort put forth by the State to prepare and submit a written justification for the request. We estimate it will take each State 20 hours to meet this requirement. During the SPA process, we received exception requests from 14 States. Therefore, the total annual burden associated with this requirement is 280 hours (14 responses × 20 hours) at a cost of $9,447.20 ($33.74/hr labor × 280 hours). We estimate that the work was performed by a mid-level analyst whose salary is the average hourly salary as determined by the United States Bureau of Labor Statistics as of December 2010, not seasonally adjusted. This hourly wage reflects 48 percent fringe benefits and overhead costs.

If you comment on these information collection and recordkeeping requirements, please do either of the following:

1. Submit your comments electronically as specified in the ADDRESSES section of this final rule; or

2. Submit your comments to the Office of Information and Regulatory Affairs, Office of Management and Budget, Attention: CMS Desk Officer, [CMS-6034-F] Fax: [phone]; or E-mail: [e-mail].

VI. Regulatory Impact Analysis

A. Introduction

We have examined the impacts of this rule as required by Executive Orders 12866 on Regulatory Planning and Review (September 30, 1993) and 13563 on Improving Regulation and Regulatory Review (January 18, 2011). Executive Orders 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). Executive Order 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. A regulatory impact analysis (RIA) must be prepared for major rules with economically significant effects ($100 million or more in any one year). This final rule has been designated an “economically significant” rule under section 3(f)(1) of Executive Order 12866. In addition, this is a major rule under the Congressional Review Act (5 U.S.C. 804(2)). Accordingly, the rule has been reviewed by the Office of Management and Budget.

B. Statement of Need

Section 6411(a) of the Affordable Care Act amended and expanded section 1902(a)(42) of the Act to require States to establish Medicaid RAC programs by December 31, 2010, to contract with 1 or more contractors to audit Medicaid claims, and to identify underpayments and overpayments and collect overpayments. Section 1902(a)(42)(B) of the Act requires all States to establish Medicaid RAC programs, subject to the exceptions and requirements as the Secretary may require.

Medicaid RACs are State programs designed to produce savings in State Medicaid expenditures by detecting improper payments to Medicaid providers. The majority of State expenditures will be derived from the contingency fee payments to Medicaid RACs.

This final rule will: (1) Implements section 6411 of the Affordable Care Act and provides guidance to States related to Federal/State funding of State start-up, operation and maintenance costs of Medicaid RACs and the payment methodology for State payments to Medicaid RACs; (2) requires States to assure that adequate appeal processes are in place for providers to dispute adverse determinations made by Medicaid RACs; and (3) requires States to coordinate with other contractors and entities auditing Medicaid providers, as well as with State and Federal law enforcement agencies.

C. Overall Impact

This final rule applies to States' requirement to contract with Medicaid RACs to perform audits of Medicaid providers on a contingency fee basis. The majority of anticipated savings, as a result of the provisions in this rule, are related to improper payments. However, as seen in the Medicare RAC Demonstration period, we expect a limited financial impact on most providers, as significant improper payments are relatively rare. The CMS Office of the Actuary (OACT) estimated the potential impact on Federal Medicaid costs and savings. OACT used the historical experience from the Medicare program to estimate potential savings to Medicaid. The estimates in the final rule differ from those in the proposed rule primarily as a result of the new implementation date of January 1, 2012, versus that of April 1, 2011, in the proposed rule. These estimates are highly uncertain, and as a result we offer estimates for FYs 2012 through 2016 to illustrate the potential effects of this program. As a result, OACT's estimates for FYs 2012 through 2016 are presented in Table 2.

TABLE 2—Estimated Medicaid Impact Resulting From the Expansion of the Recovery Audit Contractor Program

[FYs 2012-2016]

	Estimated savings ($Millions) FYs 2012-2016
	2012	2013	2014	2015	2016	2012-2016
Federal share	$60	$190	$280	$330	$360	$1,220
State share	50	140	200	250	270	910
Total	110	330	480	580	630	2,130

D. Detailed Impacts

The Medicaid RACs are part of a significant initiative to reduce waste and improper payments and recoup the improper payments. The estimated impact on the Medicaid program, as presented in Table 2, reflects an aggregate net savings of $2.13 billion for FYs 2012 through 2016. This includes an estimated net savings of $1.22 billion to the Federal Medicaid program and a net savings of $910 million to the State Medicaid program, for the same time period of FYs 2012 through 2016. Because the Affordable Care Act requires States to contract with RACs on a contingency fee basis, out-of-pocket expenses should be minimized. Therefore, the majority of the program costs will be offset by overpayment recoveries.

CMS experience from the Medicare RAC demonstration has shown that overpayment recoveries by Medicare RACs represented over 96 percent of the improper payments, while underpayments accounted for the remaining 4 percent of the improper payments. (Medicare RAC Program: An Evaluation of the 3-Year Demonstration, January 2008). As a result, we continue to believe that States would not need to maintain a reserve of recovered overpayments to fund Medicaid RAC costs associated with identifying underpayments. We do, however, require States to maintain an accounting of amounts recovered and paid. States must report overpayments to CMS based on the net amount remaining after all fees are paid to the Medicaid RAC. As discussed earlier, Medicaid RACs may only receive payments through the contingency fee arrangement made in accordance with these requirements and the limitations relating to the maximum contingency fee amount, unless a State receives an exception from CMS. No additional FFP is available for any other State payment made to the RACs. The treatment of the fees and expenditures are linked to specific statutory language implementing the Medicaid RAC requirements and not extended to Medicaid overpayment recoveries in other contexts.

Regarding appeal costs, a State's appeal costs would be an allowable administrative cost under the State's Cost Allocation Plan. A provider's appeal costs are administrative costs that are not allowable under Medicaid. With regard to the impact upon providers, as discussed earlier in the preamble, we closely examined many of the lessons learned from the Medicare RAC demonstration, in parallel with the current provisions of the permanent Medicare RAC program and incorporated those best practices into this final rule. As a result, we believe this will limit the burden and associated financial impact on providers. Furthermore, we finalize a number of measures that address providers' concerns of overzealous RAC auditors. For example, at § 455.506(c), we finalize that States must coordinate the recovery audit efforts of their RACs with other auditing entities. At § 455.506(e), we require States to set limits on the number and frequency of medical records to be reviewed by the RACs, subject to requests for exceptions from RACs. At § 455.508 (a), (b) and (c), we prescribe mandatory staffing requirements for RACs. At § 455.508(d), we require States and their RACs to develop an education and outreach program which includes notification to providers of audit policies and protocols. At § 455.508(e), we require RACs to provide several mandatory customer service measures. At § 455.508(f), we prescribe a maximum look back period of 3 years from the date of the claim. At § 455.508(g), we prohibit RACs from auditing claims that have already been audited or that are currently being audited by another entity. At § 455.510(b)(3), we finalize that if a provider appeals a RAC overpayment determination and that determination is reversed, at any level, the RAC must return the contingency fees associated with that payment. At § 455.510(c)(2) and (c)(3), we require States to adequately incentivize RACs to detect underpayments and notify underpayments that are identified by RACs, respectively. Lastly, we finalize at § 455.512, the requirement for States to provide an adequate appeals process for providers.

E. Alternatives Considered

In the proposed rule, we stated that States would have complete flexibility with regard to most, if not all, of the Medicaid program elements. We wanted to account for differences in the size of the State, Medicaid population, amount of expenditures, and other State-specific characteristics, for example, allowing smaller States the flexibility to vary the requirements that would otherwise overburden them financially.

For example, North Dakota, Wyoming, Rhode Island and Connecticut may not have the volume of Medicaid expenditures that a State such as California would have. Requiring a Connecticut RAC to hire 1.0 FTE Medical Director, we believe, would increase the labor costs to a RAC, and subsequently to the State. Initially, we considered allowing States to determine the appropriate personnel for RACs to hire. However, we received a number of comments regarding the need for 1.0 FTE Medical Director to oversee the review of claims in the RAC program due to the high overturn rates found in the Medicare RAC Demonstration period and numerous provider complaints. Accordingly, we decided to include the requirement of a minimum of 1.0 FTE Contractor Medical Director who is a Doctor of Medicine or Doctor of Osteopathy in good standing with the relevant State licensing authorities and has relevant work and educational experience. A State may seek to be excepted, in accordance with § 455.516, from requiring its RAC to hire a minimum of 1.0 FTE Contractor Medical Director by submitting to CMS a written request for CMS review and approval.

In addition, we considered giving States complete flexibility with regard to setting their own claims look-back periods based upon State specific laws and regulations regarding their claims look-back periods, which varied from three to seven years. As a result of many stakeholder comments, we reconsidered and now include a 3-year maximum look back period, similar to the Medicare RAC program. States will have the option of requesting exceptions to this provision.

F. Accounting Statement

As required by OMB Circular A-4 available at http://www.whitehouse.gov/​omb/​circulars_​a004_​a-4, in Table 3, we have prepared an accounting statement table showing the classification of the impacts associated with the implementation of section 6411 in this final rule.

Table 3—Accounting Statement: Classification of Estimated Net Savings, From FY 2012 to FY 2016

[in $Millions]

Category	Transfers
Annualized monetized transfers	Year dollar	Units discount rate		Period covered
	2010	7%	3%	FYs 2012-2016
	Primary Estimate	−$233.9	−$239.6
From	Federal Government to providers
	Primary Estimate	−$174.5	−$178.7
From	State Governments to providers

VII. Regulatory Flexibility Act Analysis

The Regulatory Flexibility Act (RFA) (15 U.S.C. 604), as modified by the Small Business Regulatory Enforcement Fairness Act of 1996 (SBREFA) (Pub. L. 104-121), requires agencies to determine whether proposed or final rules would have a significant economic impact on a substantial number of small entities and, if so, to prepare a Regulatory Flexibility Analysis and to identify in the notice of proposed rulemaking or final rulemaking any regulatory options that could mitigate the impact of the proposed regulation on small businesses. For purposes of the RFA, small entities include businesses that are small as determined by size standards issued by the Small Business Administration, nonprofit organizations, and small governmental jurisdictions). Individuals and States are not included in the definition of a small business entity.

For purposes of the RFA, we assume that approximately 75 percent of Medicaid providers are considered small businesses according to the Small Business Administration's size standards (with total revenues of $35 million or less in any one year), and 80 percent are nonprofit organizations. Medicaid providers are required, as a matter of course, to follow the guidelines and procedures as specified in State and Federal laws and regulations. The Medicaid providers must retain accurate billing records for the requisite period of time. Additionally, Medicaid providers must cooperate in audits conducted by the State and/or Federal Governments and their agents. Lastly, the majority of the economic impacts associated with this final rule are a direct result of the recovery of improper payments. Therefore, the Secretary has determined that this final rule will not have a significant economic impact on a substantial number of small entities.

In addition, section 1102(b) of the Act requires us to prepare a regulatory impact analysis if a rule may have a significant impact on the operations of a substantial number of small rural hospitals. This analysis must conform to the provisions of section 604 of the RFA. For purposes of section 1102(b) of the Act, we define a small rural hospital as a hospital that is located outside of a metropolitan statistical area and has fewer than 100 beds. For the same reason as Stated above, the Secretary has determined that this final rule will not have a significant impact on the operations of a substantial number of small rural hospitals.

VIII. Unfunded Mandates Reform Act Analysis

Section 202 of the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4) requires that agencies assess anticipated costs and benefits before issuing any rule whose mandates require spending in any one year of $100 million in 1995 dollars, updated annually for inflation. In 2011, that threshold is approximately $136 million. This final rule applies to the States' requirement to procure Medicaid RACs to perform audits of Medicaid providers on a contingency fee basis. State expenditures associated with this final rule will initially involve directing or allocating personnel resources to procurement activities. Per the terms of the contracts, States will not be expending funds over $136 million for RACs to perform the contracts. Associated costs that may include the operation of RAC programs, collateral State personnel costs, and maintenance of records are not expected to exceed the $136 million threshold. Therefore, this final rule is not anticipated to have an effect on State, local, or tribal governments in the aggregate, or by the private sector of $136 million or more.

IX. Federalism Analysis

Executive Order 13132 establishes certain requirements that an agency must meet when it promulgates a final rule (and subsequent final rule) that imposes substantial direct requirement costs on State and local governments, preempts State law, or otherwise has Federalism implications. We have reviewed this final rule under the threshold criteria of Executive Order 13132, Federalism, and have determined that it will not have substantial direct effects on the rights, roles, and responsibilities of States, local or tribal governments.

List of Subjects in 42 CFR Part 455

• Fraud
• Grant programs-health
• Health facilities
• Health professions
• Investigations
• Medicaid
• Reporting and recordkeeping requirements

For the reasons set forth in the preamble, the Centers for Medicare & Medicaid Services proposes to amend 42 CFR chapter IV as set forth below:

PART 455—PROGRAM INTEGRITY—MEDICAID

1. The authority citation for part 455 continues to read as follows:

Authority: Section 1102 of the Social Security Act (42 U.S.C. 1302), section 1902(a)(42)(B) (42 U.S.C. 1396a (a)(42(B)).

2. New subpart F is added to part 455 to read as follows:

Subpart F—Medicaid Recovery Audit Contractors Program

455.500

Purpose.

455.502

Establishment of program.

455.504

Definitions.

455.506

Activities to be conducted by Medicaid RACs and States.

455.508

Eligibility requirements for Medicaid RACs.

455.510

Payments to RACs.

455.512

Medicaid RAC provider appeals.

455.514

Federal share of State expense for the Medicaid RAC program.

455.516

Exceptions from Medicaid RAC programs.

455.518

Applicability to the territories.

Subpart F—Medicaid Recovery Audit Contractors Program

§ 455.500

Purpose.

This subpart implements section 1902(a)(42)(B) of the Act that establishes the Medicaid Recovery Audit Contractor (RAC) program.

§ 455.502

Establishment of program.

(a) The Medicaid Recovery Audit Contractor program (Medicaid RAC program) is established as a measure for States to promote the integrity of the Medicaid program.

(b) States must enter into contracts, consistent with State law and in accordance with this section, with one or more eligible Medicaid RACs to carry out the activities described in § 455.506 of this subpart.

(c) States must comply with reporting requirements describing the effectiveness of their Medicaid RAC programs as specified by CMS.

§ 455.504

Definitions.

As used in this subpart—

Medicaid RAC program means a recovery audit contractor program administered by a State to identify overpayments and underpayments and recoup overpayments.

Medicare RAC program means a recovery audit contractor program administered by CMS to identify underpayments and overpayments and recoup overpayments, established under the authority of section 1893(h) of the Act.

§ 455.506

Activities to be conducted by Medicaid RACs and States.

(a) Medicaid RACs will review claims submitted by providers of items and services or other individuals furnishing items and services for which payment has been made under section 1902(a) of the Act or under any waiver of the State Plan to identify underpayments and overpayments and recoup overpayments for the States.

(1) States may exclude Medicaid managed care claims from review by Medicaid RACs.

(b) States may coordinate with Medicaid RACs regarding the recoupment of overpayments.

(c) States must coordinate the recovery audit efforts of their RACs with other auditing entities.

(d) States must make referrals of suspected fraud and/or abuse, as defined in 42 CFR 455.2, to the MFCU or other appropriate law enforcement agency.

(e) States must set limits on the number and frequency of medical records to be reviewed by the RACs, subject to requests for exception from RACs to States.

§ 455.508

Eligibility requirements for Medicaid RACs.

An entity that wishes to perform the functions of a Medicaid RAC must enter into a contract with a State to carry out any of the activities described in § 455.506 under the following conditions:

(a) The entity must demonstrate to a State that it has the technical capability to carry out the activities described in § 455.506 of this subpart. Evaluation of technical capability must include the employment of trained medical professionals, as defined by the State, who are in good standing with the relevant State licensing authorities, where applicable, to review Medicaid claims.

(b) The entity must hire a minimum of 1.0 FTE Contractor Medical Director who is a Doctor of Medicine or Doctor of Osteopathy in good standing with the relevant State licensing authorities and has relevant work and educational experience. A State may seek to be excepted, in accordance with § 455.516, from requiring its RAC to hire a minimum of 1.0 FTE Contractor Medical Director by submitting to CMS a written request for CMS review and approval.

(c) The entity must hire certified coders unless the State determines that certified coders are not required for the effective review of Medicaid claims.

(d) The entity must work with the State to develop an education and outreach program, which includes notification to providers of audit policies and protocols.

(e) The entity must provide minimum customer service measures including:

(1) Providing a toll-free customer service telephone number in all correspondence sent to providers and staffing the toll-free number during normal business hours from 8:00 a.m. to 4:30 p.m. in the applicable time zone.

(2) Compiling and maintaining provider approved addresses and points of contact.

(3) Mandatory acceptance of provider submissions of electronic medical records on CD/DVD or via facsimile at the providers' request.

(4) Notifying providers of overpayment findings within 60 calendar days.

(f) The entity must not review claims that are older than 3 years from the date of the claim, unless it receives approval from the State.

(g) The entity should not audit claims that have already been audited or that are currently being audited by another entity.

(h) The entity must refer suspected cases of fraud and/or abuse to the State in a timely manner, as defined by the State.

(i) The entity meets other requirements as the State may require.

§ 455.510

Payments to RACs.

(a) General. Fees paid to RACs must be made only from amounts recovered.

(b) Overpayments. States must determine the contingency fee rate to be paid to Medicaid RACs for the identification and recovery of Medicaid provider overpayments.

(1) The contingency fees paid to Medicaid RACs must be based on a percentage of the overpayment recovered.

(2) States must determine at what stage in the Medicaid RAC audit process, after an overpayment has been recovered, Medicaid RACs will receive contingency fee payments.

(3) If a provider appeals a Medicaid RAC overpayment determination and the determination is reversed, at any level, then the Medicaid RAC must return the contingency fees associated with that payment within a reasonable timeframe, as prescribed by the State.

(4) Except as provided in paragraph (5) of this section, the contingency fee may not exceed that of the highest Medicare RAC, as specified by CMS in the Federal Register, unless the State submits, and CMS approves, a waiver of the specified maximum rate. If a State does not obtain a waiver of the specified maximum rate, any amount exceeding the specified maximum rate is not eligible for FFP, either from the collected overpayment amounts, or in the form of any other administrative or medical assistance claimed expenditure.

(5) CMS will review and consider, on a case-by-case basis, a State's well-justified request that CMS provide FFP in paying a Medicaid RAC(s) a contingency fee in excess of the then-highest contingency fee paid to a Medicare RAC.

(c) Underpayments. (1) States must determine the fee paid to a Medicaid RAC to identify underpayments.

(2) States must adequately incentivize the detection of underpayments.

(3) States must notify providers of underpayments that are identified by the RACs.

§ 455.512

Medicaid RAC provider appeals.

States must provide appeal rights under State law or administrative procedures to Medicaid providers that seek review of an adverse Medicaid RAC determination.

§ 455.514

Federal share of State expense of the Medicaid RAC program.

(a) Funds expended by States for the operation and maintenance of a Medicaid RAC program, not including fees paid to RACs, are considered necessary for the proper and efficient administration of the States' plan or waivers of the plan.

(b) FFP is available to States for administrative costs of operation and maintenance of Medicaid RACs subject to CMS' reporting requirements.

§ 455.516

Exceptions from Medicaid RAC programs.

A State may seek to be excepted from some or all Medicaid RAC contracting requirements by submitting to CMS a written justification for the request for CMS review and approval through the State Plan amendment process.

§ 455.518

Applicability to the territories.

The aforementioned provisions in § 455.500 through § 455.516 of this subpart are applicable to Guam, Puerto Rico, U.S. Virgin Islands, American Samoa, and the Commonwealth of the Northern Mariana Islands.

Authority: (Catalog of Federal Domestic Assistance Program No. 93.778, Medical Assistance Program)

Dated: May 6, 2011.

Marilyn Tavenner,

Principal Deputy Administrator and Chief Operating Officer, Centers for Medicare & Medicaid Services.

Approved: August 9, 2011.

Kathleen Sebelius,

Secretary, Health and Human Services.