By Julie Mason, Integritas President
CMS notified MA plans this week that it will be conducting audits of the new prior authorization and related rules published in April of this year in the final rule, CMS-4201-F, starting in January 2024. If you haven’t fully implemented UM process changes to comply with the provisions in the final rule, this is a critical wake-up call to do so ASAP. CMS indicated it will oversee MA compliance with the requirements through its regular program audits as well as focused audits. It is unlikely that CMS will conduct focused audits before the spring, given that the new requirements are effective January 1, 2024 (though they may have reason to conduct a full-scale program audit prior to then). CMS looks for compliance over a period of time (often three months), so they likely won’t conduct focused audits before several months have passed from the implementation date. However, if certain UM processes haven’t been fully implemented by now, there is not much time to put them into place and ensure they are working as intended before CMS could come knocking on your door.
Beyond implementing process changes, it is highly recommended to validate that the changes have been implemented correctly. No MA plan wants to be caught with their proverbial pants down in a CMS audit, and CMS is not very forgiving of MA plans who don’t monitor and audit their operations, especially those as critical and high profile as the new UM requirements. This is one of the reasons CMS announced that focused audits will include review of both Compliance Program Effectiveness (CPE) and Organization Determinations, Appeals and Grievances (ODAG) program areas. Including CPE indicates that CMS will be looking for such monitoring and auditing activities by a plan’s Compliance Department.
A common mechanism to evaluate compliance is to conduct an internal audit of a sample of organization determinations, in which all the new requirements are evaluated (as well as the old ones, since CMS will be looking at those, too). Some of the actions CMS will logically be looking at include, but are not limited to:
Did the UM reviewer/Medical Director follow existing CMS coverage guidelines (NCDs, LCDs, guidance in Medicare manuals, etc.)? Do you have those guidelines documented in the case file, or readily accessible in an audit?
If no CMS coverage guidelines exist for a particular service or if the guidelines leave room for flexibility in covering the service outside of the CMS guidelines, do you have an internal coverage policy? Is it documented? Is it based on publicly available current evidence in widely used treatment guidelines or clinical literature? Does the evidence meet CMS standards for valid supporting evidence?
Was the internal policy approved by the UM Committee? Do you have a UM Committee? Does the UM Committee meet the requirements laid out by CMS in the final rule?
For approved organization determinations, was the prior authorization period valid for as long as medically necessary to avoid disruptions in care, in accordance with applicable coverage criteria, the patient’s medical history, and the treating provider’s recommendation? Is there documentation to support the duration of the prior authorization?
Was the approved prior authorization duration shorter than periods that are outlined in traditional Medicare coverage criteria? If so, is the shorter prior authorization period supported by the evidence in the patient’s medical record and by treatment guidelines or clinical literature that is widely available?
For new enrollees, was an active course of treatment begun prior to the enrollment disrupted and/or was a new prior authorization required before expiration of the 90-day transition period?
Does the clinical decision-maker for the organization determination have expertise in the field related to the requested service that can be supported/defended to CMS in an audit? Is it documented in the case file?
If your internal audit results in a ‘No’ to any of the above questions, now is the time to close those gaps. If you are lacking the internal resources or expertise to audit for these actions, engaging an external expert resource such as Integritas Medicare is a wise and timely investment. Our team of clinicians, former health plan professionals and former CMS regulators each have decades of experience in implementing and evaluating processes to ensure compliance with CMS requirements. We can be reached at 415-596-5277 or info@integritasmedicare.com.
Commenti