Independent Auditors – A New Twist to the CMS Audit Validation Process

On October 20, 2015, CMS announced its 2015/2016 Audit Protocols and Process Updates and published the documents to its website.  The HPMS memo and corresponding documents can be found at <https://www.cms.gov/Medicare/Compliance-and-Audits/Part-C-and-Part-D-Compliance-and-Audits/ProgramAudits.>.   The updated protocols and process updates incorporate clarifications to previously published protocols, particularly for record layouts for data universes.  The good news for plans that incorporate the audit protocols into their compliance program and work to be audit-ready at all times is that there were no significant changes from the previously published protocols.  For new plans and plans that have not incorporated the audit protocols into their compliance programs, the time to start is yesterday!
Just when plans thought everything will remain the same for 2016 – BAM – CMS announced on November 12, 2015 that they are introducing a new, and very significant change to the audit validation process.  Starting with 2015 audit results and going forward, CMS will, at its discretion, require a plan to hire an Independent Auditor (IA) to validate that deficiencies identified during a program audit were corrected.  CMS was granted this authority in the Final Rule issued on February 12, 2015 and is now ready to implement.  The HPMS memo announcing the IA process can be found at <https://www.cms.gov/Medicare/Compliance-and-Audits/Part-C-and-Part-D-Compliance-and-Audits/Downloads/HPMS_Memo_Independent_Auditor_Valdiation_Process.pdf>.
Some key takeaways from this announcement:

  • CMS will not recommend IA’s. The Sponsor must attest that the IA is independent and is free of conflicts of interest that would prevent, or give the appearance of preventing, the IA from providing an objective assessment of the Sponsor’s performance, including current or prior consulting relationships.
  • The validation must be conducted in accordance with a workplan and schedule approved by CMS.
  • The Sponsor’s CEO must use the IA’s validation report as the basis for attesting that the conditions are corrected and are not likely to recur. Previously, the CEO would attest prior to CMS conducting a validation audit.
  • The Sponsor must respect the independence of the IA and not attempt to influence the outcome of the validation.
  • The IA’s validation report should not make recommendations to CMS whether or not the audit conditions have been adequately corrected. CMS will make the final determination based on the results of the validation.Although CMS says that they will use discretion in determining when a Sponsor will be required to use an IA, Medicare Compliance Solutions has already seen CMS implement the IA process for plans who were audited in 2015.  It’s very likely this will be the standard going forward.

Although not communicated in the HPMS memo, we have observed that CMS is providing Sponsors with 150 days from the date that CMS approves the audit corrective action plan to implement the corrections and complete the validation.   Therefore, it is critical to select an IA early in the process so that you have ample time to develop your validation plan, obtain CMS approval, and complete the validation on time.  The best thing to do is to act quickly, finish the validation, and move forward with being compliant!
If you have questions about the 2015/2016 audit protocols or IA process, call us! (562) 334-7980