Independent audit and actuary requirements for State Medicaid managed care programs

(a)

In general

Section 1932 of the Social Security Act (42 U.S.C. 1396u–2) is amended by adding at the end the following:

(i)

Independent audit requirements

(1)

In general

As a condition of receiving a payment under section 1903(a) with respect to expenditures under a contract with a managed care entity under section 1903(m), a State, acting through the State agency under the State plan or another State entity, shall, in accordance with this subsection, enter into a contract with an independent auditor to— (A)conduct audits of such managed care entity under such contract; and (B)report the results of such audits under paragraph (7). (2)

Independent auditor defined

In this subsection, subject to subparagraph (B), the term independent auditor means, with respect to the audit of a managed care entity in a State for a period of time, an auditing entity that— (A)had no financial relationship with the managed care entity or an affiliate of such managed care entity for activities occurring during the period for which the audit is conducted; (B)has no such financial relationship with the managed care entity or affiliate for the period during which the audit is being conducted; and (C)with respect to the initial audits under paragraph (4) of a managed care entity, has not had such a financial relationship with the managed care entity or affiliate during the 2-year period ending on the date the auditing entity and State enter into a contract under paragraph (1). (3)

Standards for audits

(A)

In general

The Secretary shall set uniform standards for the audits required under paragraph (4). (B)

Requirements for standards

The standards under subparagraph (A) shall— (i)be consistent with Federal Government auditing standards issued by the Comptroller General of the United States; (ii)specify a uniform reporting format for the reporting of such audits under paragraph (7); and (iii)require that any report for an audit required under paragraph (7) include a certification by a certified public accountant. (4)

Types of audits and information required

(A)

In general

The independent auditor contracting with a State under paragraph (1) shall conduct and complete, for each managed care entity with a contract under section 1903(m) in such State the following: (i)A biannual financial audit described in paragraph (5). (ii)A biannual performance-compliance audit described in paragraph (6). (B)

Timing of audits

(i)

Initial, staggered audits

For the purpose of establishing baseline data, with respect to each managed care entity with a contract under section 1903(m) with a State, the State shall complete— (I)an initial audit under subparagraph (A)(i) not later than 6 months after the date of enactment of the Medicaid Integrity Act of 2013; and (II)an initial audit under subparagraph (A)(ii) not later than 18 months after such date.

The initial audit of an entity under subparagraph (A)(ii) shall be completed approximately 1 year after the initial audit of the entity under subparagraph (A)(i).

(ii)

Subsequent, staggered audits

Subsequent audits under each such subparagraph shall be completed every two years. (C)

Period covered by audit

(i)

In general

Each audit under this paragraph shall cover a 2-calendar-year period. (ii)

Initial financial audit

The first biennial financial audit under subparagraph (A)(i) shall cover the 2-calendar-year period that ends on the last day of the calendar year that ends 6 months before the deadline for completion of such initial audit under (B)(i)(I). (iii)

Initial performance-compliance audit

The first biennial performance-compliance audit under subparagraph (A)(ii) shall cover the 2-calendar-year period that ends on the last day of the calendar year that ends 6 months before the deadline for completion of such initial audit under (B)(i)(II). (5)

Biannual financial audit

A biannual financial audit under paragraph (4)(A)(i), with respect to a managed care entity with a contract under section 1903(m) in a State, is an audit of the finances of the managed care entity relating to such contract. Each such audit shall include an audit of at least the following information: (A)

Expenses and revenues

With respect to services provided under such contract, the managed care entity’s— (i)administrative expenses; (ii)revenues, including investment income; and (iii)payments made by the managed care entity for nonadministrative services. (B)

Claims and encounter data

Subject to paragraph (7)(C)— (i)claims data related to services provided by such managed care entity under such contract; and (ii)encounter data that relate to such services and support such claims. (C)

Expenditures on patient services

With respect to services provided under such contract, the managed care entity’s payments to health care providers, that have been issued a national provider identifier under title XI, for items and services furnished on behalf of beneficiaries based on the claims and encounter data described in subparagraph (B). (D)

Provider payment ratio

(i)

In general

The ratio of the payments to health care providers described in subparagraph (C) to the aggregate payments to the managed care entity under the contract. (ii)

Construction

The ratio under clause (i) is not a medical loss ratio and is not comparable to a medical loss ratio. (E)

Provider payment rates and methodologies

Subject to paragraph (7)(C)(ii), the managed care entity’s payment rates and payment methodology for health care services under such contract, by provider type or service category, including a description of— (i)alternative payment arrangements between the managed care entity and providers; and (ii)payments made by the managed care entity to providers that are separate from claims for services provided. (F)

Identification of administrative vendors

With respect to services provided under such contract, identification of providers and vendors for administrative services under contract with the managed care entity. (G)

Reserve fund contributions

Contributions that the managed care entity has made to its reserve fund under such contract. (H)

Reinsurance

Data on the amount of reinsurance or transfer of risk that the managed care entity has obtained with respect to the risk assumed by such entity under such contract. (I)

Charitable contributions and donations

Contributions and donations that the managed care entity has made to government or non-profit entities, the identity of such government or non-profit entities, and the amount of the contributions and donations made to each such entity. (6)

Biannual performance-compliance audit

A biannual audit under this paragraph (4)(A)(ii), with respect to a managed care entity with a contract under section 1903(m) in a State, is an audit of the performance of such managed care entity under such contract (including with respect to the performance of risk assessment under the contract) and the compliance of such managed care entity, during the period covered by the audit, with— (A)the terms of the contract; and (B)applicable State and Federal laws, regulations, and guidance, including provisions of such laws, regulations, and guidance related to allowable costs under such contracts. (7)

Reporting and public availability of audit results

(A)

Notice and opportunity for comment

(i)

In general

With respect to an audit of a managed care entity conducted by an independent auditor under this subsection, such auditor shall— (I)submit a report on the results of the audit to the managed care entity; and (II)provide the managed care entity with the opportunity to submit comments on such audit to the auditor during a 30-day period. (ii)

Review of comments and revision of report

The independent auditor shall review the comments submitted under clause (i)(II) and may revise such report based on such comments. (B)

Public report

(i)

In general

Not later than 45 days after the end of the 30-day comment period provided under subparagraph (A)(i)(II), the independent auditor shall submit to the Secretary, the State, and the managed care entity a report containing the results of such audit (including, in the case of an annual financial audit under paragraph (4)(A)(i), the information described in paragraph (5)(D)), any comments received under subparagraph (A)(i)(II), and an executive summary of the audit report. The Secretary for good cause may extend by not more than 30 days the deadline for submitting a report under the previous sentence. (ii)

Posting on public web site

Subject to subparagraph (C), not later than 30 days after the date that the State receives a report under clause (i), the State shall post such report (including the executive summary of the report) on a Web site maintained by the State in connection with administration of this title and available to the public. (C)

Privacy and confidentiality protection

(i)

Patient protections

Nothing in this subsection shall be construed as modifying the application of the HIPAA privacy regulations (as defined in section 1180(b)(3)). (ii)

Protection of certain proprietary information

Nothing in this subsection shall be construed as authorizing the public disclosure of the payment rates that a managed care entity uses to pay any health care provider or the methodology that the managed care entity uses to develop such rates. (iii)

Protection of encounter data

Subject to clause (i), an independent auditor, when submitting a report under subparagraph (A), may submit encounter data to a State. An independent auditor, or a State, shall not submit to the Federal Government any encounter data that are collected for purposes of the audits under this subsection. (D)

Withholding of payment for failure to report

(i)

In general

If a report required under this paragraph is not submitted to the Secretary as required under subparagraph (B)(i) by an independent auditor with respect to a managed care entity in a State, the Secretary shall withhold, by the withholding percentage under clause (ii), the payment to the State under section 1903(a) for expenditures under a contract under section 1903(m) for the managed care entity for the period during which the report is due but not submitted. (ii)

Withholding percentage

The withholding percentage specified in this clause is— (I)5 percentage points; plus (II)if the failure to report continued beyond 30 days after the date on which such report was due under subparagraph (B)(i), 5 additional percentage points for each subsequent 30-day period until such report is submitted. (iii)

Restoration of payment

Any amounts withheld under this subparagraph due to the failure to submit a report shall be paid to a State not later than 10 days after the date such report is submitted. (8)

Response to deficiencies

(A)

Report

If a report submitted under paragraph (7) indicates a deficiency with respect to the financial reporting, performance, or compliance (as applicable) with respect to a managed care entity with a contract under section 1903(m) with a State, not later than 30 days after the date of submission of such report the State shall submit to the Secretary (and post on the Web site referred to in paragraph (7)(B)(ii)) documentation of any action that the State has taken or intends to take in response to a reported deficiency. Such documentation shall include documentation of any of the following: (i)Adjustments to the terms of new or renewed contracts with such managed care entity. (ii)A corrective action plan entered into by the managed care entity with such State. (iii)Any intermediate sanction under subsection (e) against the managed care entity. (iv)Termination of the contract with the managed care entity. (B)

OIG report to Congress

The Secretary, acting through the Inspector General in the Department of Health and Human Services, shall annually submit to Congress and make available to the public a report on the audits conducted under this subsection and the responses of States to reports of deficiencies in such audits. Such report shall contain such recommendations for changes in law or regulation as may be appropriate to ensure the prudent expenditure of funds for items and services furnished through managed care entities. (9)

Access to information required under contract; sanctions for misrepresentation or falsification of records

(A)

Access

If a State enters into or renews a contract under section 1903(m) after the date of the enactment of the Medicaid Integrity Act of 2013, such contract shall provide that the managed care entity, as a condition of receiving payment under such contract, shall provide the independent auditor with access to all information necessary for purposes of the audits under paragraph (4). (B)

Sanctions for misrepresentation or falsification

The misrepresentation or falsification of information that is furnished for purposes of such an audit shall be subject to a civil monetary penalty under subparagraph (B)(i) of section 1903(m)(5) in the same manner as a misrepresentation or falsification described in subparagraph (A)(iv)(I) of such section. (10)

Application to waiver States

In the case of any State which is providing medical assistance to its residents under a waiver granted under section 1115, the Secretary shall require the State to meet the requirements of this subsection and subsection (j) in the same manner as the State would be required to meet such requirement if the State had in effect a plan approved under this title. (11)

Reducing duplicate audits

Notwithstanding any other provision of this title, insofar as the Secretary determines that the performance of an audit under this subsection duplicates the performance of an audit required under another provision of this title, the completion of the audit under this subsection shall satisfy such requirement. (12)

Reservation of State powers

Nothing in this subsection shall be construed to limit the power of a State, including the power of a State to pursue civil and criminal penalties under State law against any individual or entity that misuses, or engages in fraud or abuse related to, the funds provided to a State under this title. (13)

Construction

Nothing in this subsection shall be construed to prevent the Secretary from taking any action, including disallowances of payment, with respect to violations of this title related to a contract with a managed care entity. (14)

Definitions

(A)

Affiliate of the managed care entity

For purposes of this subsection and subsection (j), the term affiliate of the managed care entity means an entity that, to a significant extent, is associated or affiliated with, or has control of or is controlled by, the managed care entity or that is related to such managed care entity by common ownership. For purposes of this definition— (i)common ownership exists if an individual or individuals possess significant ownership or equity in the managed care entity and the affiliate of the managed care entity; and (ii)control exists if an entity has the power, directly or indirectly, to significantly influence or direct the actions or policies of another entity. (B)

Contract year

For purposes of this subsection, the term contract year means, with respect to a managed care entity and a State, the 12-month period that begins on the effective date of a contract under section 1903(m) between the managed care entity and the State, and each subsequent 12-month period while such contract is effective.

(b)

Independent actuary

Section 1932 of the Social Security Act (42 U.S.C. 1396u–2), as amended by section 2, is further amended by adding at the end the following:

(j)

Independent actuary

As a condition of receiving a payment under section 1903(a) with respect to expenditures under a contract between a State and a managed care entity under section 1903(m), a State may not enter into an agreement with an entity (referred to in this subsection as an actuary) to provide actuarial services related to the State’s administration of such contract unless the following requirements are met: (1)

No actuarial services or financial relationship for contract period

The actuary has not provided actuarial services to the managed care entity for, or otherwise had any financial relationship with the managed care entity during, any period of the contract (between such managed care entity and the State) with respect to which the actuarial services under the agreement (between the actuary and the State) are to be provided. (2)

No financial relationship during term of agreement with State

The actuary agrees not to have such a financial relationship with the managed care entity or affiliate during any part of the period of the agreement (between the State and the actuary). (3)

Special rule for first contract year

For the first contract year in which this subsection applies, the actuary has not had such a financial relationship with the managed care entity or affiliate during the 2-year period ending on the date the actuary and State enter into an agreement subject to this subsection.

(c)

Transitional financial incentives to States

Section 1903(a)(3) of the Social Security Act (42 U.S.C. 1396b(a)(3)) is amended by inserting after subparagraph (F) the following:

(G)75 percent of so much of the sums expended as are attributable to expenditures for the first 3 biannual financial audits conducted under section 1932(i)(4)(A)(i) after the date of enactment of the Medicaid Integrity Act of 2013, and for the first 2 biannual performance-compliance audits conducted under section 1932(i)(4)(A)(ii) after such date; plus