On January 31, 2023, the New York State Office of the Medicaid Inspector General (OMIG) released three guidance documents to assist Medicaid providers in meeting the requirements of recently adopted regulations governing (i) the implementation and maintenance of an effective compliance program for certain providers; (ii) Medicaid managed care fraud, waste and abuse prevention programs; and (iii) OMIG’s Self-Disclosure Program for overpayments.

New Subpart 521-1: Compliance Programs

The adopted regulations represent substantial changes to 18 N.Y.C.R.R. Part 521 governing the implementation and operation of effective compliance programs for certain “required providers,” including, now for the first time, Medicaid managed care organizations (MMCOs).^[1] Although the regulations were adopted on December 28, 2022, and became effective immediately, OMIG announced in the Compliance Program Guidance that required providers will have until March 28, 2023, to adopt and implement the necessary changes to their compliance programs.

OMIG’s new Compliance Program Guidance outlines several best practices and provides examples of documentation that OMIG believes Medicaid required providers should maintain to demonstrate that the they have adopted, implemented and maintain effective compliance programs that meet each of the 7 elements specified in the regulations.

OMIG’s Compliance Program Guidance also outlines the steps that it will follow in conducting its reviews of provider compliance programs. These steps include:

• Written notification of the review to the required provider;

• Requiring the provider to download a module from OMIG’s website, complete the module and submit supporting documentation to OMIG within 30 days for OMIG’s review; and

• OMIG’s written compliance program assessment, recommendations for improvement and a numerical scorecard indicating whether the required provider satisfactorily met the Part 521-1 requirements for each month of the review period (not to exceed 12 months).

OMIG’s introduction of monthly scorecards underlines the importance of required providers becoming and staying up-to-date with all compliance program requirements, as OMIG is authorized to impose monetary penalties of up to $5,000 per month on required providers that do not have an effective compliance program. For a second violation, OMIG may increase the penalty to $10,000 per month.

New Subpart 521-2: Requirements for MMCOs

New Subpart 521-2 requires each MMCO to adopt, implement and maintain a compliance program that satisfies all of the provisions in Subpart 521-1. In addition, each MMCO must develop a fraud, waste and abuse prevention plan and submit it to OMIG within 90 days of the effective date of the new rules or upon signing a new contract with the New York State Department of Health to begin participation as an MMCO. 

New Subpart 521-3: Self-Disclosure Program

New Subpart 521-3 implements the long-standing requirement that all enrolled Medicaid providers report, return and explain overpayments received from the Medicaid program through OMIG’s Self-Disclosure Program. Whether or not a provider is subject to the mandatory compliance program obligations, under both Federal and State law, all providers are required to report, return, and explain any overpayments received from Medicaid within 60 days of identification, or by the date any corresponding cost report was due, whichever is later. Medicaid providers should also use the Self-Disclosure Program to report damaged, lost or destroyed records that support their right to receive Medicaid payments.

*          *          *

Required providers will need to review and update their Standards of Conduct and Compliance Program policies and procedures to ensure they meet the new regulatory requirements, which cover a broad spectrum of operational changes ranging from compliance training to dissemination of policies to functions such as the formation of compliance committees, accountability and duties of the Compliance Officer and more.

FOOTNOTES

^[1] Other required providers subject to the Part 521-1 regulations are the following: hospitals, residential health care facilities, home care services agencies, providers of developmental disability services, providers of mental disability services, and providers that claim or receive $1 million or more directly or indirectly (such as managed care network participating providers) from the Medicaid program.