1. Compliance and How It Fits in the ACO
Angie Charlet, DBA, MHA, RN
Dir. of Quality/Education, Compliance for ICAHN, ACO

2. AGENDA Compliance Requirements in an ACO Audit Review
Policies for Robust Program Success
Credit goes to Management Performance Associates (our consultants)

3. The requirement 42 CFR § 425.300 Compliance plan.
(a) The ACO must have a compliance plan that includes at least the following elements:
(1) A designated compliance official or individual who is not legal counsel to the ACO and reports directly to the ACO's governing body.
(2) Mechanisms for identifying and addressing compliance problems related to the ACO's operations and performance.
(3) A method for employees or contractors of the ACO, ACO participants, ACO providers/suppliers, and other individuals or entities performing functions or services related to ACO activities to anonymously report suspected problems related to the ACO to the compliance officer.
(4) Compliance training for the ACO, the ACO participants, and the ACO providers/suppliers.
(5) A requirement for the ACO to report probable violations of law to an appropriate law enforcement agency.
(b)
(1) ACOs that are existing entities may use the current compliance officer if the compliance officer meets the requirements set forth in paragraph (a)(1) of this section.
(2) An ACO's compliance plan must be in compliance with and be updated periodically to reflect changes in law and regulations.

4. OIG Guidance Policies and Procedures Compliance Officer and Committee
Communication (hotline)
Discipline
Investigations and Corrective Action
Auditing and Monitoring
Training and Education

5. Compliance Program Infrastructure:
Governance & Structure
Policies and Procedures
Training and Education
Auditing and Monitoring
Complaints and Communication
Investigations, Corrective Action and Discipline
Review and updates

6. Role of the committee
“The OIG recommends that a compliance committee be established to advise the compliance officer and assist in the implementation of the compliance program.” “The compliance committee benefits from having the perspectives of individuals with varying responsibilities in the organization, such as operations, finance, audit, human resources, utilization review, social work, discharge planning, medicine, coding and legal, as well as employees and managers of key operating units.” - OIG Compliance Guidance for Hospitals

7. Committee duties
Develop and implement a strategy to promote the Program to ACO Associates, including, but not limited to, compliance training.
Assist the Corporate Compliance Officer in responding to compliance-related issues as they arise, including reporting any probable violation of law to the appropriate law enforcement agency.
Serve as a forum to share information and ideas concerning compliance-related matters.
Evaluate the Program’s effectiveness on a regular basis and make appropriate improvements in its operations.
Analyze ACO’s industry environment, the legal requirements with which it must comply, and specific risk areas.
Assess existing P&P that address these areas for possible incorporation into the Compliance Program.
Work with relevant parties to develop standards of conduct and policies and procedures to promote compliance with ACO’s Compliance program.
Recommend and monitor, in conjunction with relevant parties, the development of internal systems and controls to carry out ACO’s standards and policies and procedures as a part of daily operations.
Promote detection of potential compliance violations (e.g. through a hotline).

8. Governance and Structure
Completed
Compliance Officer & Committee job description
Medical Director Job description
Board Resolution
Compliance Program Policy
Written board reports
Vet Medicare beneficiary on the board
Relationship with health care legal counsel
Establish how ACO will communicate with Participants and providers/suppliers (monthly calls)
Quarterly Compliance Committee meetings
ACO board composition and control policy
ACO leadership and management structure policy
Board conflicts of interest policy

9. Governance and Structure cont.
What’s next?
Code of Conduct
Live board reports
Screen directors for conflicts
Document meaningful commitment

10. Policies and Procedures
Compliance Program Policy
Questions and Complaints
Administrative Operating Requirements
Shared savings (and losses) qualification
Notifying CMS of new/removed Participants and Providers/Suppliers
Public reporting and transparency
Repayment mechanism
Waivers
Antitrust
QM Collection and Reporting

11. Policies and Procedures
Beneficiaries and Patient Centeredness
Participant and Provider/Supplier Management (drafting stage)
Participant and Provider/Supplier requirements
Meaningful commitment
Reporting/hotline
HIPAA Privacy
HIPAA Security
HIPAA Breach Notification
HIPAA and Social Media

12. Policies and Procedures
Distribute Compliance Program and Code
Code of Conduct
Quality Assurance
Billing and Claims Submission (Participants, Provider and Suppliers)
Referrals
Kickbacks
Stark
Beneficiary Inducements
Avoidance of at-risk beneficiaries (cherry picking)
Referrals and cost-shifting
Employee and Contractor Screening

13. Policies and Procedures
Records
Marketing
Data
Submission
Certification
Sharing
Data Use Agreements
HER use
Minimum necessary

14. Training and Education
Participants and Provider/Suppliers
Compliance Officers
Participant Board Members (to be done by local compliance officers)
CO should complete attestation of completion to ACO

15. Auditing and Monitoring
Press Ganey (or other vendor) patient experience of care survey
Minimum of quarterly analysis of claims data (7 per provider to identify areas for improvement)
Review of QM accuracy as part of ACO on-site audits
Review quarterly data for trends to identify potential QM inaccuracies/variations to investigate
HIPAA Security Risk Analysis completed

16. Auditing and Monitoring
Obtain attestations
Annual review of ACO compliance program
Review OIG work plan (most recent from October 2017), identify risks, audit those risks
Use peer to peer audits, ACO officer completing audits, or self-audits certified by member participants, to address ACO risk areas

17. Suggested Audit frequency
Governance
Frequency
Verify board resolution is in place
Annual
Board focus and involvement
CCO qualifications, job description, reporting
Anonymous Compliance Committee Survey
ACO governing body documents, composition, control and duties
ACO board Medicare beneficiary COI
Board conflicts of interest vetting process
Leadership and management structure
Medical director meets requirements

18. Suggested Audit frequency
Participant and Provider/Supplier Management
Frequency
Meaningful commitment
Annual
Adherence to patient centeredness processes
ACO participants do not participate in another MSSP
New P and P/S receive CMS participation agreement
Each Participant ahs a CMS participation agreement
Exclusivity of Participant TINs
Verification of NPIs and TINs
Monthly
ACO develops claims audit tool for use by P and P/S
TBD
# of PCPs
Monthly or Quarterly
Identification of new/removed P and P/S
P and P/S accurately capturing covered lives/beneficiaries meet requirements
Quarterly
Verification of Provider and Supplier TINs

19. Suggested Audit frequency
ACO requirements
Frequency
Documentation in support of CMS participation agreement
Annual
Identification of ACO changes requiring CMS notification
Monthly
ACO’s status as an State legal entity is up to date
Shared savings distributed in accordance with CMS participation agreement and 3-part aim
When applicable, verify repayment mechanism
CMS participation agreement supplemented as necessary
Adherence to CMS participation agreement
Antitrust compliance (if applicable)
Tax exempt status
Posting, accuracy, and adherence to CMS MSSP Public reporting guidance
Waiver requirements (if/when applicable)
Savings (when applicable, and losses) criteria are met

20. Suggested Audit frequency
ACO Compliance Basics
Frequency
Compliance Program Policy and Code of Conduct updates
Annual
7 compliance program elements,
Investigation procedures
Complaints and response
Review compliance reports for trends
Annual or Quarterly
Compliance as part of employee performance
Compliance program updates were implemented
Compliance Program and Code were distributed
Anonymous employee surveys
ACO internal assessment of cost and quality of care
Quarterly
Analysis of beneficiary and provider complaints

21. Suggested Audit frequency
Data
Frequency
Accuracy of data used for beneficiary assignment (Physician NPI, claims for primary care services HCPCS codes)
Annual
Data policies
Data accuracy, verification of data certification
Monthly or Quarterly
PQRS data accuracy
Data sharing: HIPAA Security Risk Analysis; audit P and P/S compliance with HIPAA
Minimum necessary data was used
Degree of EMR adoption
Accuracy of QM data; quality performance
ACO data submission/certification and of data submission/certification by P and P/S
Analysis of specific financial and QM data reported by the ACO as well as aggregate annual and quarterly reports
Quarterly and Annually

22. Suggested Audit frequency
Beneficiaries
Frequency
Beneficiary notification
Annual
Documentation of beneficiary opportunity to decline data sharing; honoring elections to decline; adherence to DUA
Verify patient experience of care survey vendor is CMS certified; review survey results
Gifts/services for beneficiary inducements
Minimum # of beneficiaries
Monthly or Quarterly
Patient centeredness processes

23. Suggested Audit frequency
Risk Areas
Frequency
Kickbacks/Referrals
Annual
Adherence to Records policy
Avoidance of at-risk beneficiaries (review data for trends suggesting cherry picking
Quarterly
Referrals/cost shifting
Marketing materials/practices
HIPAA audit plan
Monthly, Quarterly and Annually
Verify QM data is accurate (medical records review; audit quality performance; monitor minimum attainment level)
Monthly or quarterly
Audit for duplicate payments
Monthly or Quarterly
Employee, director, contractor screens
Monthly
Billing and claims/false claims audits
Coding and medical necessity peer to peer audits*
* One Option is for ACO to coordinate audits, or a peer-to-peer audit program for a year and for all new ACO providers, then transition to a checklist/attestation. If provider does not send in attestation, ACO sends in their own auditor and charges an audit fee.

24. Member Obligations/Attestations
Hotline in place
Hotline # provided to ACO
Compliance officer, Privacy officer and security officer information provided to ACO
Compliance committee
Beneficiary assignment
Patient centeredness
Meaningful commitment
TIN exclusivity
Non-participation in other MSSP
Participation agreements

25. Member Obligations/Attestations
Compliance board resolution
Regular compliance reporting to their Boards
Conflicts of interest policy
Compliance training program
Compliance audits (including billing)
HIPAA compliance program
QAPI program

26. Member Obligations/Attestations
Accuracy of ACO data submissions to ACO in accordance with federal requirements
Excluded provider screens conducted monthly
License verifications and background checks
Use of ACO/CMS approved marketing materials
False claims/claims submission compliance policies
False claims/claims submission auditing and monitoring
Medical necessity auditing and monitoring

27. Complaints and Communication
Online complaint form established
Compliance Questions and Reports policy updated
Publicize reporting options

28. Investigations, Corrective Action, and Discipline
Compliance Reports and Questions Policy updated
Compliance Log Form created
Compliance Report Intake Form created
Provider agreements provide ACO discretion to take action for non-compliance, up to and including removal from the ACO
Tell Participants, Providers and Suppliers about reporting options and what needs to be reported to ACO

29. Investigations, Corrective Action, and Discipline
What should be reported to ACO?
Billing
Care
Excluded providers/unlicensed providers
Documentation/data accuracy
False claims
Patient experience of care/failure to meet patient centeredness
ACO policy violations
Provider RAC audit findings that may violate ACO policies
Failure to achieve 3-ppart aim

30. Review and Updates Ongoing:
Review OIG work plans, ACO guidance, OCR press releases, and other compliance updates on an ongoing basis; incorporate into the compliance program

31. Biggest Risks
“Notwithstanding any arrangements between or among an ACO, ACO participants, ACO providers/suppliers, and other individuals or entities performing functions or services related to ACO activities, the ACO must have ultimate responsibility for adhering to and otherwise fully complying with all terms and conditions of its agreement with CMS.”
42 CFR (c)

32. Biggest Risks
Accuracy of data submitted to CMS
Quality Assurance
Adherence to patient centeredness processes
Meaningful commitment from members
Measuring achievement of the three-part aim of improving care delivery, improving health, and reducing growth in costs through improvement
ACO’s biggest challenge is verifying that its members adhere to the compliance program.

33. Addressing Risks Audits How does ACO tackle these risks? Policies
Training
Audits
Attestations

34. Tools and Resources

35. P&P Manual Copy of our manual…..
Feel free to call with questions/changes etc.

36. Training Webinar/Slide Deck
This was our training program from our consultants. Should you have any questions or need assistance feel free to reach out to either Margaret or Scott as well as myself.
Management Performance Associates
Margaret Scavotto, CEO
Scott Gima, COO Exec. VP Compliance
, ext 21