Medicare Managed Care Manual 
Chapter 21  Compliance Program Guidelines 
and 
Prescription Drug Benefit Manual 
Chapter 9 - Compliance Program Guidelines 
 
Table of Contents 
(Chapter 21 - Rev. 110, 01-11-13) 
(Chapter 9 - Rev. 16, 01-11-13) 
 
Transmittals for Chapter 21 
10  Introduction 
20  Definitions 
30  Overview of Mandatory Compliance Program 
40  Sponsor Accountability for and Oversight of FDRs 
50  Elements of an Effective Compliance Program 
50.1  Element I: Written Policies, Procedures and Standards of Conduct 
50.1.1  Standards of Conduct 
50.1.2  Policies and Procedures 
50.1.3  Distribution of Compliance Policies and Procedures and 
Standards of Conduct 
50.2  Element II:  Compliance Officer, Compliance Committee and High Level 
Oversight 
50.2.1  Compliance Officer 
50.2.2 Compliance Committee 
50.2.3  Governing Body 
50.2.4  Senior Management Involvement in Compliance Program 
50.3  Element III:  Effective Training and Education 
50.3.1  General Compliance Training 
50.3.2 Fraud, Waste, and Abuse Training 
50.4  Element IV:  Effective Lines of Communication 
50.4.1  Effective Lines of Communication Among the Compliance 
Officer, Compliance Committee, Employees, Governing Body, and FDRs 
50.4.2  Communication and Reporting Mechanisms 
50.4.3  Enrollee Communications and Education 
50.5  Element V:  Well-Publicized Disciplinary Standards 
50.5.1  Disciplinary Standards 
50.5.2  Methods to Publicize Disciplinary Standards 
  50.5.3  Enforcing Disciplinary Standards 
50.6  Element VI:  Effective System for Routine Monitoring, Auditing and 
Identification of Compliance Risks 
50.6.1  Routine Monitoring and Auditing 
50.6.2  Development of a System to Identify Compliance Risks 
50.6.3  Development of the Monitoring and Auditing Work Plan 
50.6.4  Audit Schedule and Methodology 
50.6.5  Audit of the Sponsors Operations and Compliance Program 
50.6.6  Monitoring and Auditing FDRs 
50.6.7  Tracking and Documenting  Compliance and Compliance 
Program Effectiveness 
50.6.8  OIG/GSA Exclusion 
50.6.9  Use of Data Analysis for Fraud, Waste and Abuse Prevention and 
Detection 
50.6.10  Special Investigation Units (SIUs) 
50.6.11  Auditing by CMS or its Designee 
50.7  Element VII:  Procedures and System for Prompt Response to Compliance 
Issues 
50.7.1  Conducting a Timely and Reasonable Inquiry of Detected 
Offenses 
50.7.2  Corrective Actions 
50.7.3  Procedures for Self-Reporting Potential FWA and Significant 
Non Compliance 
50.7.4  NBI MEDIC 
50.7.5  Referrals to the NBI MEDIC 
50.7.6  Responding to CMS-Issued Fraud Alerts 
50.7.7  Identifying Providers with a History of Complaints 
Appendix A:  Resources 
Appendix B:  Laws and Regulations to Consider in Standards of Conduct and/or Training 
  10  Introduction 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
These compliance program guidelines reflect the Centers for Medicare and Medicaid 
Services (CMS) interpretation of the Compliance Program requirements and related 
provisions for Medicare Advantage Organizations (MAO) and Medicare Prescription 
Drug Plans (PDP) (Chapter 42 of the Code of Federal Regulations, Parts 422 and 423, 
hereinafter collectively referred to as Parts C & D).  This chapter is designed to assist 
sponsors to establish and maintain an effective compliance program. 
 
These compliance program guidelines apply fully to the prescription drug benefit 
programs of sections 1833 and 1876 Cost Plans.  In addition, these compliance program 
guidelines apply to the prescription drug benefit programs of Program of All-Inclusive 
Care for the Elderly (PACE) plans only with respect to those portions of this chapter that 
pertain to Elements 6 and 7, which are embodied in 42 C.F.R. 423 504(b)(4)(vi)(F) and 
(G) respectively. These compliance program guidelines do not apply to the PACE plans 
or to sections 1833 and 1876 Cost Plans that do not have a prescription drug benefit 
program.  However, given the Office of Inspector General (OIG) guidance promoting 
compliance programs for all sponsors, the CMS strongly encourages sponsors to 
voluntarily develop and implement effective compliance programs. 
 
This guidance is subject to change as policy, technology and Medicare business practices 
continue to evolve. 
 
Each sponsor must implement an effective compliance program that meets the regulatory 
requirements set forth at 42 C.F.R. 422.503(b)(4)(vi) and 423.504(b)(4)(vi).  Sponsors 
should apply the principles outlined in these guidelines to all relevant decisions, 
situations, communications and developments.  Any new rule-making or interpretive 
guidance (e.g., annual call letter or Health Plan Management System (HPMS) guidance 
memoranda) may update the guidance provided in this document. Sponsors may also 
wish to consult the resources listed in the Appendices, which provide additional 
information on some topics addressed in this chapter. 
 
In this chapter, the word must is used to reflect requirements created by statute or 
regulation.  The word should is used to indicate expectations created by this guidance. 
Recommendations are noted as best practices. 
 
Chapter 9 previously addressed the prevention of fraud, waste and abuse (FWA) by only 
Part D sponsors.  In contrast, this chapter provides interpretive rules and guidance to help 
all sponsors to establish and maintain an effective compliance program to prevent, detect, 
and correct FWA and Medicare program noncompliance 
 
  These guidelines, published in both Pub. 100-18, Medicare Prescription Drug Benefit 
Manual, chapter 9 and in Pub. 100-16, Medicare Managed Care Manual, chapter 21, are 
identical and allow organizations offering both Medicare Advantage (MA) and 
Prescription Drug Plans (PDP) to reference one document for guidance. 
 
20  Definitions 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
The following definitions apply for purposes of these guidelines only: 
 
Abuse includes actions that may, directly or indirectly, result in: unnecessary costs to the 
Medicare Program, improper payment, payment for services that fail to meet 
professionally recognized standards of care, or services that are medically unnecessary. 
Abuse involves payment for items or services when there is no legal entitlement to that 
payment and the provider has not knowingly and/or intentionally misrepresented facts to 
obtain payment. Abuse cannot be differentiated categorically from fraud, because the 
distinction between fraud and abuse depends on specific facts and circumstances, 
intent and prior knowledge, and available evidence, among other factors. 
 
Act refers to the Social Security Act. 
 
Appeal (Part C Plan): Any of the procedures that deal with the review of adverse 
organization determinations on the health care services an enrollee believes he or she is 
entitled to receive, including delay in providing, arranging for, or approving the health 
care services (such that a delay would adversely affect the health of the enrollee), or on 
any amounts the enrollee must pay for a service as defined in 42 C.F.R.  422.566(b). 
These procedures include reconsideration by the MA Plan and, if necessary, an 
independent review entity, hearings before Administrative Law Judges (ALJs), review by 
the Medicare Appeals Council (MAC), and judicial review. 
 
Appeal (Part D Plan): Any of the procedures that deal with the review of adverse 
coverage determinations made by the Part D plan sponsor on the benefits under a Part D 
plan the enrollee believes he or she is entitled to receive, including a delay in providing 
or approving the drug coverage (when a delay would adversely affect the health of the 
enrollee), or on any amounts the enrollee must pay for the drug coverage, as defined in 42 
C.F.R. 423.566(b). These procedures include redeterminations by the Part D plan 
sponsor, reconsiderations by the independent review entity (IRE), Administrative Law 
Judge (ALJ) hearings, reviews by the Medicare Appeals Council (MAC), and judicial 
reviews. 
 
Audit is a formal review of compliance with a particular set of standards (e.g., policies 
and procedures, laws and regulations) used as base measures. 
 
  Cost Plan is a Health Maintenance Organization (HMO) or Competitive Medical Plan 
(CMP) with a cost-reimbursement contract under section 1876(h) of the Act (See 42 
C.F.R. 417.1, 423.4).  Cost Plan sponsors may contract to offer prescription drug 
benefits under the Part D program. (See, 42 C.F.R. 423.4.) 
 
Data Analysis is a tool for identifying coverage and payment errors, and other indicators 
of potential FWA and noncompliance.   
 
Deemed Provider or Supplier means a provider or supplier that has been accredited by 
a national accreditation program (approved by CMS) as demonstrating compliance with 
certain conditions. 
 
DHHS is the Department of Health and Human Services.  CMS is the agency within 
DHHS that administers the Medicare program.  
 
DOJ is the Department of Justice. 
 
Downstream Entity is any party that enters into a written arrangement, acceptable to 
CMS, with persons or entities involved with the MA benefit or Part D benefit, below the 
level of the arrangement between an MAO or applicant or a Part D plan sponsor or 
applicant and a first tier entity. These written arrangements continue down to the level of 
the ultimate provider of both health and administrative services.  (See, 42 C.F.R. , 
423.501). 
 
Employee(s) refers to those persons employed by the sponsor or a First Tier, 
Downstream or Related Entity (FDR) who provide health or administrative services for 
an enrollee.  
 
Enrollee means a Medicare beneficiary who is enrolled in a sponsors Medicare Part C or 
Part D plan. 
 
External Audit means an audit of the sponsor or its FDRs conducted by outside auditors, 
not employed by or affiliated with, and independent of, the sponsor. 
 
FDR means First Tier, Downstream or Related Entity. 
 
First Tier Entity is any party that enters into a written arrangement, acceptable to CMS, 
with an MAO or Part D plan sponsor or applicant to provide administrative services or 
health care services to a Medicare eligible individual under the MA program or Part D 
program.  (See, 42 C.F.R.  423.501). 
 
Formulary means the entire list of Part D drugs covered by a Part D plan and all 
associated requirements outlined in Pub. 100-18, Medicare Prescription Drug Benefit 
Manual, chapter 6. 
 
  Fraud is knowingly and willfully executing, or attempting to execute, a scheme or 
artifice to defraud any health care benefit program or to obtain (by means of false or 
fraudulent pretenses, representations, or promises) any of the money or property owned 
by, or under the custody or control of, any health care benefit program. 18 U.S.C.  1347. 
 
FWA means fraud, waste and abuse. 
 
Governing Body means that group of individuals at the highest level of governance of 
the sponsor, such as the Board of Directors or the Board of Trustees, who formulate 
policy and direct and control the sponsor in the best interest of the organization and its 
enrollees.  As used in this chapter, governing body does not include C-level management 
such as the Chief Executive Officer, Chief Operations Officer, Chief Financial Officer, 
etc., unless persons in those management positions also serve as directors or trustees or 
otherwise at the highest level of governance of the sponsor. 
 
GSA means General Services Administration. 
 
Internal Audit means an audit of the sponsor or its FDRs conducted by auditors who are 
employed by or affiliated with the sponsor. 
 
Medicare is the health insurance program for the following: 
 
  People 65 or older, 
  People under 65 with certain disabilities, or 
  People of any age with End-Stage Renal Disease (ESRD) (permanent kidney 
failure requiring dialysis or a kidney transplant). 
 
Monitoring Activities are regular reviews performed as part of normal operations to 
confirm ongoing compliance and to ensure that corrective actions are undertaken and 
effective. 
 
NBI MEDIC means National Benefit Integrity Medicare Drug Integrity Contractor 
(MEDIC), an organization that CMS has contracted with to perform specific program 
integrity functions for Parts C and D under the Medicare Integrity Program.  The NBI 
MEDICs primary role is to identify potential FWA in Medicare Parts C and D. 
 
OIG is the Office of the Inspector General within DHHS.  The Inspector General is 
responsible for audits, evaluations, investigations, and law enforcement efforts relating to 
DHHS programs and operations, including the Medicare program. 
 
Pharmacy Benefit Manager (PBM) is an entity that provides pharmacy benefit 
management services, which may include contracting with a network of pharmacies; 
establishing payment levels for network pharmacies; negotiating rebate arrangements; 
developing and managing formularies, preferred drug lists, and prior authorization 
programs; performing drug utilization review; and operating disease management 
programs.  Some sponsors perform these functions in-house and do not use an outside 
  entity as their PBM.  Many PBMs also operate mail order pharmacies or have 
arrangements to include prescription availability through mail order pharmacies.  A PBM 
is often a first tier entity for the provision of Part D benefits. 
 
PDP means Prescription Drug Plan. 
 
Related Entity means any entity that is related to an MAO or Part D sponsor by common 
ownership or control and 
 
(1)  Performs some of the MAO or Part D plan sponsors management functions 
under contract or delegation; 
 
(2)  Furnishes services to Medicare enrollees under an oral or written agreement; or  
 
(3)  Leases real property or sells materials to the MAO or Part D plan sponsor at a 
cost of more than $2,500 during a contract period.  (See, 42 C.F.R. 423.501). 
 
Special Investigations Unit (SIU) is an internal investigation unit responsible for 
conducting investigations of potential FWA. 
 
Sponsor refers to the entities described in the Introduction to these guidelines. 
 
TrOOP (True Out of Pocket) Costs are costs that an enrollee must incur on Part D 
covered drugs to reach catastrophic coverage.  (These incurred costs are defined in 
regulation at 423.100 and Pub. 100-18, Medicare Prescription Drug Benefit Manual, 
chapter 5, section 30).  In general, payments counting toward TrOOP include payments 
by enrollee, family member or friend, Qualified State Pharmacy Assistance Program 
(SPAP), Medicares Extra Help (low income subsidy), a charity, manufacturers 
participating in the Medicare coverage gap discount program, Indian Health Service, 
AIDS Drug Assistance Programs, or a personal health savings vehicle (flexible spending 
account, health savings account, medical savings account).  Payments that do NOT count 
toward TrOOP include Part D premiums and coverage by other insurances, group health 
plans, government programs (non-SPAP), workers compensation, Part D plans 
supplemental or enhanced benefits, or other third parties, drugs purchased outside the 
United States, and over-the counter drugs and vitamins. 
 
Waste is the overutilization of services, or other practices that, directly or indirectly, 
result in unnecessary costs to the Medicare program.  Waste is generally not considered 
to be caused by criminally negligent actions but rather the misuse of resources. 
 
30  Overview of Mandatory Compliance Program 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
  Section 1860D-4(c)(1)(D) of the Act, 42 C.F.R.  422.503(b)(4)(vi), 423.504(b)(4)(vi) 
 
All sponsors are required to adopt and implement an effective compliance program, 
which must include measures to prevent, detect and correct Part C or D program 
noncompliance as well as FWA. 
 
The compliance program must, at a minimum, include the following core requirements: 
 
1.  Written Policies, Procedures and Standards of Conduct; 
2.  Compliance Officer, Compliance Committee and High Level Oversight; 
3.  Effective Training and Education; 
4.  Effective Lines of Communication;  
5.  Well Publicized Disciplinary Standards; 
6.  Effective System for Routine Monitoring and Identification of Compliance Risks; 
and 
7.  Procedures and System for Prompt Response to Compliance Issues. 
 
In order to be effective, a sponsors compliance program must be fully implemented, and 
should be tailored to each sponsors unique organization, operations and circumstances. 
 
A compliance program will not be effective unless sponsors devote adequate resources to 
the program.  Adequate resources include those that are sufficient to do the following: 
 
1.  Promote and enforce its Standards of Conduct 
2.  Promote and enforce its compliance program; 
3.  Effectively train and educate its governing body members, employees and FDRs; 
4.  Effectively establish lines of communication within itself and between itself and 
its FDRs; 
5.  Oversee FDR compliance with Medicare Part C and D requirements; 
6.  Establish and implement an effective system for routine auditing and monitoring; 
and  
7.  Identify and promptly respond to risks and findings. 
 
CMS will consider a sponsors size, structure, business model, activities, the extent of its 
delegation of responsibilities to other entities, the breadth of its operation, and the risks it 
faces in evaluating whether adequate resources have been devoted to the compliance 
program. 
 
40  Sponsor Accountability for and Oversight of FDRs 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
   
42 C.F.R.  422.503(b)(4)(vi), 422.504(i), 423.504(b)(4)(vi), 423.505(i) 
 
Sponsors may enter into contracts with FDRs to provide administrative or health care 
services for enrollees on behalf of the sponsor.  Sponsors may not delegate compliance 
program administrative functions (e.g., compliance officer, compliance committee, 
compliance reporting to senior management, etc.) to entities other than its parent 
organization or corporate affiliate; however, sponsors may use FDRs for compliance 
activities such as monitoring, auditing, and training. 
 
The sponsor maintains the ultimate responsibility for fulfilling the terms and conditions 
of its contract with CMS, and for meeting the Medicare program requirements. 
Therefore, CMS may hold the sponsor accountable for the failure of its FDRs to comply 
with Medicare program requirements. 
 
Medicare program requirements apply to FDRs to whom the sponsor has delegated 
administrative or health care service functions relating to the sponsors Medicare Parts C 
and D contracts.  These requirements do not apply to persons and entities whose 
administrative contracts with the sponsor do not relate to the sponsors Medicare 
functions, for example, a contract between a sponsor and a real estate broker in 
connection with the rental of office space. 
 
Below are examples of functions that relate to the sponsors Medicare Parts C and D 
contracts: 
 
  Sales and marketing; 
  Utilization management; 
  Quality improvement; 
  Applications processing; 
  Enrollment, disenrollment, membership functions; 
  Claims administration, processing and coverage adjudication; 
  Appeals and grievances; 
  Licensing and credentialing; 
  Pharmacy benefit management; 
  Hotline operations; 
  Customer service; 
  Bid preparation; 
  Outbound enrollment verification; 
  Provider network management; 
    Processing of pharmacy claims at the point of sale; 
  Negotiation with prescription drug manufacturers and others for rebates, discounts 
or other price concessions on prescription drugs; 
  Administration and tracking of enrollees drug benefits, including TrOOP balance 
processing; 
  Coordination with other benefit programs such as Medicaid, state pharmaceutical 
assistance or other insurance programs; 
  Entities that generate claims data; and 
  Health care services. 
  Stakeholder Relationship Flow Charts 
 
 
 
 
 
 
First tier and related entities may contract with downstream entities to fulfill their 
contractual obligations to the sponsors.  A field marketing organization (first tier entity) 
may contract with a smaller brokerage firm (downstream entity) to sell the sponsors 
Medicare Parts C and D products.  That smaller brokerage firm may further contract with 
individual sales agents (downstream entities) to perform the day-to-day sales work.  A 
related entity may also be either a first tier entity or a downstream entity. 
 
It is critical that sponsors correctly identify those entities with which they contract that 
qualify as FDRs.  Sponsors are required to comply with CMS requirements for FDRs.  
Unless it is very clear that an entity is or is not an FDR, the determination of FDR status 
requires an analysis of all of the circumstances.  Sponsors should have clearly defined 
  processes and criteria to evaluate and categorize all vendors with which they contract.  
Below are some factors to consider in determining whether an entity is an FDR: 
 
  The function to be performed by the delegated entity; 
 
  Whether the function is something the sponsor is required to do or to provide 
under its contract with CMS, the applicable federal regulations or CMS guidance; 
 
  To what extent the function directly impacts enrollees; 
 
  To what extent the delegated entity has interaction with enrollees, either orally or 
in writing; 
 
  Whether the delegated entity has access to beneficiary information or personal 
health information; 
 
  Whether the delegated entity has decision-making authority (e.g., enrollment 
vendor deciding time frames) or whether the entity strictly takes direction from 
the sponsor; 
 
  The extent to which the function places the delegated entity in a position to 
commit health care fraud, waste or abuse; and 
 
  The risk that the entity could harm enrollees or otherwise violate Medicare 
program requirements or commit FWA. 
 
The method by which the analysis is performed is left to the discretion of the sponsor.   
Some sponsors use a multi-functional committee, consisting of members from the 
compliance and legal departments as well as the business owner of the FDR function, to 
make the determination. 
 
The sponsors compliance officer, working with the sponsors compliance committee, 
must develop procedures to promote and ensure that all FDRs are in compliance with all 
applicable laws, rules and regulations with respect to Medicare Parts C and D delegated 
responsibilities. The sponsor must have a system in place to monitor FDRs.  Sponsors are 
free to choose the method for monitoring their FDRs compliance with Medicare program 
requirements.  Sponsors must be able to demonstrate that their method of monitoring is 
effective. It is a best practice to use metrics to assist in observing compliance 
performance and operational trends. 
 
For more information on requirements for contracts with FDRs, see Pub. 100-16, 
Medicare Managed Care Manual, chapter 11, 110. 
 
  50  Elements of an Effective Compliance Program 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi), 423.504(b)(4)(vi)  
 
This section discusses the seven elements of an effective compliance program, as set 
forth in the applicable Federal regulations governing Parts C and D. 
 
50.1  Element I: Written Policies, Procedures and Standards of 
Conduct 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(A), 423.504(b)(4)(vi)(A) 
 
Sponsors must have written policies, procedures and standards of conduct that   
 
1.  Articulate the sponsors commitment to comply with all applicable Federal and 
State standards; 
 
2.  Describe compliance expectations as embodied in the Standards of Conduct; 
 
3.  Implement the operation of the compliance program; 
 
4.  Provide guidance to employees and others on dealing with suspected, detected or 
reported compliance issues; 
 
5.  Identify how to communicate compliance issues to appropriate compliance 
personnel; 
 
6.  Describe how suspected, detected or reported compliance issues are investigated 
and resolved by the sponsor; and 
 
7.  Include a policy of non-intimidation and non-retaliation for good faith 
participation in the compliance program, including, but not limited to, reporting 
potential issues, investigating issues, conducting self-evaluations, audits and 
remedial actions, and reporting to appropriate officials. 
 
The requirements that are discussed in this section must be included as part of the 
compliance program but may be stated either in policies and procedures or in Standards 
of Conduct.  They may, but need not, appear in both documents. 
   
50.1.1  Standards of Conduct 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(A), 423.504(b)(4)(vi)(A) 
 
Standards of Conduct, also known in some organizations as the Code of Conduct or by 
other similar names, state the overarching principles and values by which the company 
operates, and define the underlying framework for the compliance policies and 
procedures.  Standards of Conduct should describe the sponsors expectations that all 
employees conduct themselves in an ethical manner; that issues of noncompliance and 
potential FWA are reported through appropriate mechanisms; and that reported issues 
will be addressed and corrected. 
 
The Standards of Conduct may be stated in a separate Medicare-specific stand-alone 
document or within the corporate Code of Conduct.  Sponsors should update the 
Standards of Conduct to incorporate changes in applicable laws, regulations, and other 
program requirements, such as those listed in Appendix B. 
 
Standards of Conduct communicate to employees and FDRs that compliance is 
everyones responsibility from the top to the bottom of the organization. For that reason, 
and because Standards of Conduct are the most fundamental statement of the sponsors  
governing principles, Standards of Conduct should be approved by the sponsors full 
governing body. 
 
It is a best practice of some sponsors to include a resolution of the full governing body 
stating the sponsors commitment to compliant, lawful and ethical conduct.  This 
communicates to employees and FDRs that compliance and ethics are valued and 
important to those at the highest levels of authority in the company. 
 
50.1.2  Policies and Procedures 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(A), 423.504(b)(4)(vi)(A) 
 
Compliance policies and/or procedures are detailed and specific, and describe the 
operation of the compliance program.  Compliance policies may address issues such as 
sponsors compliance reporting structure, compliance and FWA training requirements, 
the operation of the hotline or other reporting mechanisms, and how suspected, detected 
or reported compliance and potential FWA issues are investigated and addressed and 
  remediated.  Sponsors should update the policies and procedures to incorporate changes 
in applicable laws, regulations, and other program requirements. 
 
50.1.3  Distribution of Compliance Policies and Procedures and 
Standards of Conduct 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(A), 423.504(b)(4)(vi)(A) 
 
In order to be effective, compliance policies and procedures and Standards of Conduct 
must be distributed to employees who support the sponsors Medicare business.  
Distribution must occur within 90 days of hire, when there are updates to the policies, 
and annually thereafter.  Sponsors may choose their distribution method.  Some examples 
are furnishing hard copies at the time of hire and electronic copies thereafter, emailing an 
electronic copy, or posting on the company intranet.  The sponsors should have a method 
to demonstrate that the Standards of Conduct and policies and procedures were 
distributed to employees. 
 
The Standards of Conduct should be written in a format that is easy to read and 
comprehend.  Sponsors should consider translating Standards of Conduct and policies 
and procedures into other languages as necessary. 
 
In order to communicate the sponsors compliance expectations for FDRs, sponsors 
should ensure that Standards of Conduct and policies and procedures are distributed to 
FDRs employees.  Sponsors may make their Standards of Conduct and policies and 
procedures available to their FDRs.  Alternatively, the sponsor may ensure that the FDR 
has comparable policies and procedures and Standards of Conduct of their own. 
 
The sponsors should have a method to demonstrate that Standards of Conduct and 
policies and procedures were distributed to FDRs employees.  Sponsors or the FDR may 
make the policies available through methods such as a fax blast, placement on an FDR 
portal, in contract materials, etc.  A best practice is to include appropriate contract 
provisions in the FDR contract, coupled with periodic monitoring of a sample of FDRs 
based on risk assessment, including a review of the FDRs compliance policies and 
procedures and Standards of Conduct.   
 
50.2  Element II:  Compliance Officer, Compliance Committee and 
High Level Oversight 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
  42 C.F.R.  422.503(b)(4)(vi)(B), 423.504(b)(4)(vi)(B)  
 
The sponsor must designate a compliance officer and a compliance committee who report 
directly and are accountable to the sponsors chief executive or other senior management. 
 
1.  The compliance officer, vested with the day-to-day operations of the compliance 
program, must be an employee of the sponsor, parent organization or corporate 
affiliate.  The compliance officer may not be an employee of an FDR. 
 
2.  The compliance officer and the compliance committee must periodically report 
directly to the sponsors governing body on the activities and status of the 
compliance program, including issues identified, investigated, and resolved by the 
compliance program. 
 
3.  The sponsors governing body must be knowledgeable about the content and 
operation of the compliance program and must exercise reasonable oversight with 
respect to the implementation and effectiveness of the compliance program. 
 
50.2.1  Compliance Officer 
(Chapter 21, Rev. 110, Issued:01-11-13, Effective:01-11-13; Implementation:01-11-13) 
(Chapter 9, Rev. 16, Issued: 01-11-13, Effective: 01-11-13; Implementation: 01-11-13) 
 
42 C.F.R.  422.503(b)(4)(vi)(B), 423.504(b)(4)(vi)(B) 
 
The compliance officer position should be full-time. The sponsor is not required to have a 
separate compliance officer (Medicare Compliance Officer) dedicated only to its 
Medicare Parts C and D business, although CMS strongly recommends a dedicated 
Medicare compliance officer. Sponsors must assess the scope of the existing compliance 
officers responsibilities, the size of the organization, and the organizations resources 
when determining whether a single compliance officer can effectively implement the 
Medicare compliance program and the sponsors commercial or other governmental 
business. 
 
The compliance officer must be an employee of the sponsor (preferred) or of its parent 
company or corporate affiliate. Sponsors may not delegate the compliance officer 
position or compliance program functions to first tier or downstream entities. When the 
compliance officer is not employed by the sponsor itself, but by the sponsors parent 
company or corporate affiliate, the sponsor must ensure that the compliance officer has 
detailed involvement in and familiarity with the sponsors operational and compliance 
activities. 
 
The sponsor must ensure that reports from the compliance officer reach the sponsors 
senior-most leader (typically the CEO or President). The direct reporting relationship 
between the compliance officer and the senior-most leadership refers to the direct 
reporting of information, not necessarily to a supervisory reporting relationship. This can 
be accomplished through a dotted line or matrix reporting. 
   
The compliance officer must have express authority to provide unfiltered, in-person 
reports to the sponsors senior-most leader. The compliance officers reports should not 
be routed to the CEO or President through operational management such as the COO, 
CFO, GC (General Counsel) or other executives responsible for operational areas. For 
example, the compliance officers report to the CEO should not be filtered through the 
CFO. However, the compliance officers reports may be relayed to the sponsors senior-
most leader through divisional Presidents. For example, the compliance officer may 
report directly to the President of the division that houses the Medicare program, who 
then reports to the CEO of the sponsor on the status and activities of the Medicare 
compliance program. 
 
The compliance officers reports to the sponsors governing body must be made through 
the compliance infrastructure. The compliance officer must have express authority to 
provide unfiltered, in-person reports to the sponsors governing body at his/her 
discretion. 
 
The Medicare compliance officer may report compliance issues directly to the corporate 
compliance officer and/or the compliance committee, who then provide compliance 
reports directly to the sponsors governing body. The compliance officer, in his/her 
discretion, need not await approval of the sponsors governing body to implement needed 
compliance actions and activities, provided that those actions and activities, as 
appropriate, are reported to the governing body or governing body committee at its next 
scheduled meeting. It is a best practice for sponsors who have both a corporate 
compliance officer and a Medicare compliance officer to allow the Medicare compliance 
officer to regularly attend meetings of the sponsors governing body and to make in-
person reports to the sponsors governing body. A related best practice is to allow the 
compliance officer to meet in Executive Session with the governing body. 
 
The compliance officer should be independent. The compliance officer should not serve 
in both compliance and operational areas (e.g., where the compliance officer is also the 
CFO, COO or GC). This leads to self-policing in the operational area(s) in which he/she 
serves, which is a conflict of interest. 
 
Because the compliance officer must be free to raise compliance issues without fear of 
retaliation, it is a best practice to require governing body approval before the compliance 
officer can be terminated from employment. 
 
The compliance officer is responsible for the implementation of the compliance program. 
The compliance officer defines the program structure, educational requirements, 
reporting, and complaint mechanisms, response and correction procedures, and 
compliance expectations of all personnel and FDRs. 
 
The compliance officer should have training and/or experience working with MA, MA-
PD or PDP programs and, with regulatory authorities. It is a best practice for the 
compliance officer to be a member of senior management. 
   
Duties of the compliance officer may include, but are not limited to: 
 
  Ensuring that Medicare compliance reports are provided regularly to the sponsors 
corporate compliance officer (if any), governing body, CEO, and compliance 
committee. Reports should include the status of the sponsors Medicare 
compliance program implementation, the identification and resolution of 
suspected, detected or reported instances of noncompliance, and the sponsors 
compliance oversight and audit activities; 
 
  Being aware of daily business activity by interacting with the operational units of 
the sponsor; 
 
  Creating and coordinating, by appropriate delegation, if desired, educational 
training programs to ensure that the sponsors officers, governing body, 
managers, employees, FDRs, and other individuals working in the Medicare 
program are knowledgeable about the sponsors compliance program, its written 
Standards of Conduct, compliance policies and procedures, and all applicable 
statutory and regulatory requirements; 
 
  Developing and implementing methods and programs that encourage managers 
and employees to report Medicare program noncompliance and potential FWA 
without fear of retaliation; 
 
  Maintaining the compliance reporting mechanism and closely coordinating with 
the internal audit department and the SIU, where applicable; 
 
  Responding to reports of potential FWA, including the coordination of internal 
investigations with the SIU or internal audit department and the development of 
appropriate corrective or disciplinary actions, if necessary. To that end, the 
compliance officer should have the flexibility to design and coordinate internal 
investigations; 
 
  Ensuring that the DHHS OIG and Government Services Administration (GSA) 
exclusion lists have been checked with respect to all employees, governing body 
members, and FDRs monthly and coordinating any resulting personnel issues 
with the sponsors Human Resources, Security, Legal or other departments as 
appropriate; 
 
  Maintaining documentation for each report of potential noncompliance or 
potential FWA received from any source, through any reporting method (e.g., 
hotline, mail, or in-person); 
 
  Overseeing the development and monitoring of the implementation of corrective 
action plans; 
 
    Coordinating potential fraud investigations/referrals with the SIU, where 
applicable, and the appropriate NBI MEDIC. This includes facilitating any 
documentation or procedural requests that the NBI MEDIC makes of the sponsor. 
 
Similarly, the compliance officer should collaborate with other sponsors, State Medicaid 
programs, Medicaid Fraud Control Units (MCFUs), commercial payers, and other 
organizations, where appropriate, when a potential FWA issue is discovered that involves 
multiple parties; and  
 
  The compliance officer should have the authority to: 
 
  Interview or delegate the responsibility to interview the sponsors employees 
o
and other relevant individuals regarding compliance issues; 
 
  Review company contracts and other documents pertinent to the Medicare 
o
program; 
 
  Review or delegate the responsibility to review the submission of data to CMS 
o
to ensure that it is accurate and in compliance with CMS reporting 
requirements; 
 
  Independently seek advice from legal counsel; 
o
 
  Report potential FWA to CMS, its designee or law enforcement; 
o
 
  Conduct and/or direct audits and investigations of any FDRs; 
o
 
  Conduct and/or direct audits of any area or function involved with Medicare 
o
Parts C or D plans; and  
 
  Recommend policy, procedure, and process changes. 
o
 
50.2.2 Compliance Committee 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(B), 423.504(b)(4)(vi)(B) 
 
Sponsors must have a compliance committee in place that oversees the Medicare 
compliance program.  The sponsor need not have a separate Medicare compliance 
committee, as long as the committee addresses Medicare compliance issues.  In many 
organizations, the compliance committee is chaired by the compliance officer.  The 
compliance committee serves to advise the compliance officer.  The compliance 
committee is accountable to, and must provide regular compliance reports to, the 
  sponsors senior-most leader and governing body.  Reports on the status of the 
compliance program are usually reported through the chairperson of the committee.  
 
Duties of the compliance committee may include, but are not limited to: 
 
  Meeting at least on a quarterly basis, or more frequently as necessary to enable 
reasonable oversight of the compliance program; 
 
  Developing strategies to promote compliance and the detection of any potential 
violations; 
 
  Reviewing and approving compliance and FWA training, and ensuring that 
training and education are effective and appropriately completed; 
 
  Assisting with the creation and implementation of the compliance risk assessment 
and of the compliance monitoring and auditing work plan; 
 
  Assisting in the creation, implementation and monitoring of effective corrective 
actions; 
 
  Developing innovative ways to implement appropriate corrective and preventative 
action; 
 
  Reviewing effectiveness of the system of internal controls designed to ensure 
compliance with Medicare regulations in daily operations; 
 
  Supporting the compliance officers needs for sufficient staff and resources to 
carry out his/her duties; 
 
  Ensuring that the sponsor has appropriate, up-to-date compliance policies and 
procedures; 
 
  Ensuring that the sponsor has a system for employees and FDRs to ask 
compliance questions and report potential instances of Medicare program 
noncompliance and potential FWA confidentially or anonymously (if desired) 
without fear of retaliation; 
 
  Ensuring that the sponsor has a method for enrollees to report potential FWA 
 
  Reviewing and addressing reports of monitoring and auditing of areas in which 
the sponsor is at risk for program noncompliance or potential FWA and ensuring 
that corrective action plans are implemented and monitored for effectiveness; and 
 
  Providing regular and ad hoc reports on the status of compliance with 
recommendations to the sponsors governing body. 
 
  The compliance committee should include individuals with a variety of backgrounds, and 
reflect the size and scope of the sponsor.  Members of the compliance committee should 
have decision-making authority in their respective areas of expertise.  Sponsors should 
include members of senior management (e.g., CFO, COO), as well as auditors, 
pharmacists, registered nurses, and nationally certified pharmacy technicians on the 
compliance committee (to the extent that their organization has those positions on staff.).  
Other committee members might include personnel experienced in legal issues, statistical 
analysts, and staff/managers from various departments within the organization who 
understand the vulnerabilities within their respective areas of expertise. 
 
50.2.3  Governing Body 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(B), 423.504(b)(4)(vi)(B) 
 
The sponsors governing body (e.g., Board of Directors or Board of Trustees) must 
exercise reasonable oversight with respect to the implementation and effectiveness of the 
sponsors compliance program.  The governing body of the organization that contracted 
with CMS or its parent company may oversee the Medicare compliance program.  When 
compliance issues are presented to the sponsors governing body, it should make further 
inquiry and take appropriate action to ensure the issues are resolved. 
 
The sponsors governing body may delegate compliance program oversight to a specific 
committee of the governing body (e.g., Board Audit Committee or Board compliance 
committee), but the governing body as a whole remains accountable for reviewing the 
status of the compliance program. The scope of the delegation from the full governing 
body to the governing body committee must be clear in the committees charter and 
reporting. 
 
The governing body must receive training and education as to the structure and operation 
of the compliance program.  The governing body should be knowledgeable about 
compliance risks and strategies, should understand the measurements of outcome, and 
should be able to gauge effectiveness of the compliance program. 
 
Reasonable oversight by the governing body (assisted by a committee, if desired) 
includes, but is not limited to: 
 
  Approving the Standards of Conduct (this should be performed by the full 
governing body and not a committee); 
 
  Understanding the compliance program structure; 
 
    Remaining informed about the compliance program outcomes, including results 
of internal and external audits; 
 
  Remaining informed about governmental compliance enforcement activity such 
as Notices of Non-Compliance, Warning Letters and/or more formal sanctions; 
 
  Receiving regularly scheduled, periodic updates from the compliance officer and 
compliance committee; and 
 
  Reviewing the results of performance and effectiveness assessments of the 
compliance program. 
 
The following are examples of activities in which the governing body, or a governing 
body committee, may wish to have involvement.  Alternatively, the governing body may 
delegate some or all of these activities to senior management or to the compliance 
committee:  
 
  Development, implementation and annual review of compliance policies and 
procedures; 
 
  Approval of compliance policies and procedures; 
 
  Review and approval of  compliance and FWA training; 
 
  Review and  approval of compliance risk assessment; 
 
  Review of internal and external audit work plans and audit results; 
 
  Review and approval of corrective action plans resulting from audits; 
 
  Review and approval of appointment of the compliance officer; 
 
  Review and approval of performance goals for the compliance officer; 
 
  Evaluation of the senior management teams commitment to ethics and the 
compliance program; and 
 
  Review of dashboards, scorecards, self-assessment tools, etc., that reveal 
compliance issues. 
 
The governing body should collect and review measurable evidence that the compliance 
program is detecting and correcting Medicare program noncompliance on a timely basis.  
It is a best practice for the governing body to be provided with data showing that the 
program has reduced the risks of program noncompliance and FWA.  Some indicators of 
an effective compliance program are: 
 
    Use of quantitative measurement tools (e.g., scorecards, dashboard reports, key 
performance indicators) to report, and track and compare over time, compliance 
with key Medicare Parts C and D operations such as enrollment, appeals and 
grievances, prescription drug benefit administration; 
 
  Use of monitoring to track and review open/closed corrective action plans, FDR 
compliance, Notices of Non-Compliance, warning letters, CMS sanctions, 
marketing material approval rates, training completion/pass rates, etc.; 
 
  Implementation of new or updated Medicare requirements (e.g., tracking HPMS 
memo from receipt to implementation) including monitoring or auditing and 
quality control measures to confirm appropriate and timely implementation; 
 
  Increase or decrease in number and/or severity of complaints from employees, 
FDRs, providers, beneficiaries through customer service calls or the Complaint 
Tracking Module (CTM), marketing misrepresentations, Parts A and B issues, 
etc.; 
 
  Timely response to reported noncompliance and potential FWA, and effective 
resolution (i.e., non-recurring issues); 
 
  Consistent, timely and appropriate disciplinary action; and 
 
  Detection of noncompliance and FWA issues through monitoring and auditing: 
 
  Whether root cause was determined and corrective action appropriately 
o
and timely implemented and tested for effectiveness; 
 
  Detection of FWA trends and schemes via daily claims reviews, outlier 
o
reports, pharmacy audits, etc.; and 
 
  Actions taken in response to compliance reports submitted by FDRs. 
o
 
The sponsor should ensure that CMS is able to validate, through review of governing 
body meeting minutes or other documentation, the active engagement of the governing 
body in the oversight of the Medicare compliance program.  A governing body that is 
appropriately engaged asks questions, requires follow-up on issues and takes action when 
necessary. 
 
50.2.4  Senior Management Involvement in Compliance Program 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(B), 423.504(b)(4)(vi)(B) 
   
An effective compliance program cannot be achieved unless the CEO (or senior-most 
leader) and other senior management, as appropriate, are engaged in the compliance 
program. The CEO and senior management must recognize the importance of the 
compliance program in the sponsors success. 
 
In situations where the contract holder engages in multiple lines of business (e.g., 
commercial, Medicare, etc.), with each line of business having its own CEO, the senior-
most leader of the contract holder must be engaged in compliance program oversight. 
 
The CEO and senior management should ensure that the compliance officer is integrated 
into the organization and is given the credibility, authority and resources necessary to 
operate a robust and effective compliance program. The CEO must receive periodic 
reports from the compliance officer of risk areas facing the organization, the strategies 
being implemented to address them and the results of those strategies.  The CEO must 
also be advised of all governmental compliance enforcement activity, from Notices of 
Non-compliance to formal enforcement actions. 
 
50.3  Element III:  Effective Training and Education 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(C), 423.504(b)(4)(vi)(C) 
 
The sponsor must establish, implement and provide effective training and education for 
its employees, including the CEO, senior administrators or managers, and for the 
governing body members, and FDRs. 
 
The training and education must occur at least annually and be made a part of the 
orientation for new employees, including the chief executive and senior administrators or 
managers, governing body members, and FDRs. 
 
FDRs who have met the FWA certification requirements through enrollment into the 
Medicare program or accreditation as a Durable Medical Equipment, Prosthetics, 
Orthotics, and Supplies (DMEPOS) are deemed to have met the training and educational 
requirements for fraud, waste, and abuse. 
 
Effectiveness of Training and Education 
 
Effectiveness of training, education, compliance policies and procedures, and Standards 
of Conduct will be apparent through sponsors compliance with all Medicare program 
requirements.  Sponsors must ensure that employees are aware of the Medicare 
requirements related to their job function. 
 
  50.3.1  General Compliance Training 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(C), 423.504(b)(4)(vi)(C) 
 
The sponsors employees (including temporary workers and volunteers), and governing 
body members, must, at a minimum, receive general compliance training within 90 days 
of initial hiring, and annually thereafter.  The following are examples of how sponsors 
may satisfy the general compliance training requirements: 
 
  Classroom training; 
  Online training modules; or 
  Attestations that employees have read and received the sponsors Standards of 
Conduct and/or compliance policies and procedures. 
 
Sponsors must be able to demonstrate that their employees have fulfilled these training 
requirements. Examples of proof of training may include copies of sign-in sheets, 
employee attestations and electronic certifications from the employees taking and 
completing the training. 
 
Sponsors must ensure that general compliance information is communicated to their 
FDRs.  The sponsors compliance expectations can be communicated through 
distribution of the sponsors Standards of Conduct and/or compliance policies and 
procedures to FDRs employees. Distribution may be accomplished through Provider 
Guides, Business Associate Agreements or Participation Manuals, etc. 
 
Sponsors should  review and update, if necessary, the general compliance training 
whenever there are material changes in regulations, policy or guidance, and at least 
annually. 
 
The following are examples of topics the general compliance training program should 
communicate: 
 
  A description of the compliance program, including a review of compliance 
policies and procedures, the Standards of Conduct, and the sponsors commitment 
to business ethics and compliance with all Medicare program requirements; 
 
  An overview of how to ask compliance questions, request compliance 
clarification or report suspected or detected noncompliance.  Training should 
emphasize confidentiality, anonymity, and non-retaliation for compliance related 
questions or reports of suspected or detected noncompliance or potential FWA; 
 
    The requirement to report to the sponsor actual or suspected Medicare program 
noncompliance or potential FWA; 
 
  Examples of reportable noncompliance that an employee might observe; 
 
  A review of the disciplinary guidelines for non-compliant or fraudulent behavior. 
The guidelines will communicate how such behavior can result in mandatory 
retraining and may result in disciplinary action, including possible termination 
when such behavior is serious or repeated or when knowledge of a possible 
violation is not reported; 
 
  Attendance and participation in compliance and FWA training programs as a 
condition of continued employment and a criterion to be included in employee 
evaluations; 
 
  A review of policies related to contracting with the government, such as the laws 
addressing gifts and gratuities for Government employees; 
 
  A review of potential conflicts of interest and the sponsors system for disclosure 
of conflicts of interest; 
 
  An overview of HIPAA/HITECH, the CMS Data Use Agreement (if applicable), 
and the importance of maintaining the confidentiality of personal health 
information; 
 
  An overview of the monitoring and auditing process; and 
 
  A review of the laws that govern employee conduct in the Medicare program. 
 
See Appendix B for other examples of laws and regulations that may be discussed in 
training. 
 
50.3.2 Fraud, Waste, and Abuse Training 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(C), 423.504(b)(4)(vi)(C) 
 
The sponsors employees (including temporary workers and volunteers), and governing 
body members, as well as FDRs employees who have involvement in the administration 
or delivery of Parts C and D benefits must, at a minimum, receive FWA training within 
90 days of initial hiring  (or contracting in the case of FDRs), and annually thereafter.  
Additional, specialized or refresher training may be provided on issues posing FWA risks 
  based on the individuals job function (e.g., pharmacist, statistician, customer service, 
etc.).  Training may be provided: 
 
  upon appointment to a new job function; 
  when requirements change; 
  when employees are found to be noncompliant; 
  as a corrective action to address a noncompliance issue; and 
  when an employee works in an area implicated in past FWA. 
 
Sponsors may choose to tailor the training in response to circumstances surrounding 
potential FWA and specific functions performed by FDRs. 
 
Sponsors must be able to demonstrate that their employees and FDRs have fulfilled these 
training requirements as applicable.  Examples of proof of training may include copies of 
sign-in sheets, employee attestations and electronic certifications from the employees 
taking and completing the training. 
 
Sponsors must provide the FWA training directly to their FDRs or provide appropriate 
FWA training materials to their FDRs. 
 
To reduce the potential burden on FDRs, CMS has developed and provided a 
standardized FWA training and education module.  The module is available through the 
CMS Medicare Learning Network (MLN) at http://www.cms.gov/MLNProducts.  Using 
CMS training module is optional and a sponsor may use another method.  However, this 
training meets CMS FWA training requirements so sponsors should accept FDRs use of 
this FWA training option.  For details on accessing the FWA training and education on 
the MLN website, see the May 8, 2012, HPMS memo regarding Fraud, Waste and Abuse 
Training and Education Guidance. 
 
Topics that should be addressed in FWA training include, but are not limited to the 
following: 
 
  Laws and regulations related to MA and Part D FWA (i.e., False Claims Act, 
Anti-Kickback statute, HIPAA/HITECH, etc.); 
 
  Obligations of FDRs to have appropriate policies and procedures to address 
FWA;  
 
  Processes for sponsors and FDR employees to report suspected FWA to the 
sponsor (or, as to FDR employees, either to the sponsor directly or to their 
employers who then must report it to the sponsor); 
 
  Protections for sponsor and FDR employees who report suspected FWA; and 
 
    Types of FWA that can occur in the settings in which sponsor and FDR 
employees work.  
 
Sponsors are accountable for maintaining records for a period of 10 years of the time, 
attendance, topic, certificates of completion (if applicable), and test scores of any tests 
administered to their employees, and must require FDRs to maintain records of the 
training of the FDRs employees. 
 
FDRs who have met the FWA certification requirements through enrollment into Parts A 
or B of the Medicare program or through accreditation as a supplier of DMEPOS are 
deemed to have met the FWA training and education requirements. No additional 
documentation beyond the documentation necessary for proper credentialing is required 
to establish that an employee or FDR or employee of an FDR is deemed.  In the case of 
chains, such as chain pharmacies, each individual location must be enrolled into 
Medicare Part A or B to be deemed. See examples of such entities in Pub. 100-16, 
Medicare Managed Care Manual, chapter 6 70. 
 
50.4  Element IV:  Effective Lines of Communication 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(D), 423.504(b)(4)(vi)(D) 
 
The sponsor must establish and implement effective lines of communication, ensuring 
confidentiality between the compliance officer, members of the compliance committee, 
the sponsors employees, managers and governing body, and the sponsors FDRs.  Such 
lines of communication must be accessible to all and allow compliance issues to be 
reported including a method for anonymous and confidential good faith reporting of 
potential compliance issues as they are identified. 
 
50.4.1  Effective Lines of Communication Among the Compliance 
Officer, Compliance Committee, Employees, Governing Body, and 
FDRs 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(D), 423.504(b)(4)(vi)(D) 
 
Sponsors must have an effective way to communicate information from the compliance 
officer to others.  Such information should include the compliance officers name, office 
location and contact information; laws, regulations and guidance for sponsors and FDRs, 
  such as statutory, regulatory, and sub-regulatory changes (e.g., HPMS memos); and 
changes to policies and procedures and Standards of Conduct. 
 
Methods to communicate information may include physical postings of information, e-
mail distributions, internal websites, and individual and group meetings with the 
compliance officer.  The dissemination of information from the compliance officer must 
be made within a reasonable time and to all appropriate parties. 
 
50.4.2  Communication and Reporting Mechanisms 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(D), 423.504(b)(4)(vi)(D) 
 
The sponsors written Standards of Conduct and/or policies and procedures must require 
all employees, members of the governing body, and FDRs to report compliance concerns 
and suspected or actual violations related to the Medicare program to the sponsor. 
 
Sponsors must have a system in place to receive, record, respond to and track compliance 
questions or reports of suspected or detected noncompliance or potential FWA from 
employees, members of the governing body, enrollees and FDRs and their employees. 
Reporting systems must maintain confidentiality (to the greatest extent possible), allow 
anonymity if desired (e.g., through telephone hotlines or mail drops), and emphasize the 
sponsors / FDRs policy of non-intimidation and non-retaliation for good faith reporting 
of compliance concerns and participation in the compliance program. FDRs that partner 
with multiple sponsors may train their employees on the FDRs reporting processes 
including emphasis that reports must be made to the appropriate sponsor. 
 
Sponsors must adopt, widely publicize, and enforce a no-tolerance policy for retaliation 
or retribution against any employee or FDR who in good faith reports suspected FWA.  
Employees and FDRs must be notified that they are protected from retaliation for False 
Claims Act complaints, as well as any other applicable anti-retaliation protections. 
 
The methods available for reporting compliance or FWA concerns and the non-retaliation 
policy must be publicized throughout the sponsors or FDRs facilities.  This information 
can be publicized, for example, through the use of posters, table tents, mouse pads, key 
cards and other prominent displays. General compliance training should include the 
reporting requirements and the available methods for reporting. 
 
Sponsors must make the reporting mechanisms user friendly, easy to access and navigate, 
and available 24 hours a day for employees, members of the governing body, and FDRs.  
It is a best practice for sponsors to establish more than one type of reporting mechanism 
to account for the different ways in which people prefer to communicate or feel 
comfortable communicating. 
   
When a suspected compliance issue is reported, it is a best practice for sponsors to 
provide the complainant with information regarding expectations of a timely response, 
confidentiality, non-retaliation and progress reports. 
 
50.4.3  Enrollee Communications and Education 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(D), 423.504(b)(4)(vi)(D) 
 
Sponsors must educate their enrollees about identification and reporting of potential 
FWA. Education methods may include flyers, letters, pamphlets that can be included in 
mailings to enrollees (such as enrollment packages, Explanation of Benefits (EOB), 
and information published on sponsor websites (especially on enrollee links), etc.). 
 
50.5  Element V:  Well-Publicized Disciplinary Standards 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(E), 423.504(b)(4)(vi)(E) 
 
Sponsors must have well-publicized disciplinary standards through the implementation of 
procedures which encourage good faith participation in the compliance program by all 
affected individuals.  These standards must include policies that: 
 
1.  Articulate expectations for reporting compliance issues and assist in their 
resolution; 
 
2.  Identify noncompliance or unethical behavior; and 
 
3.  Provide for timely, consistent, and effective enforcement of the standards when 
noncompliance or unethical behavior is determined. 
 
50.5.1  Disciplinary Standards 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(E), 423.504(b)(4)(vi)(E) 
 
  Sponsors must establish and implement disciplinary policies and procedures that reflect 
clear and specific disciplinary standards. The disciplinary policies must describe the 
sponsors expectations for the reporting of compliance issues including noncompliant, 
unethical or illegal behavior, that employees participate in required training, and the 
expectations for assisting in the resolution of reported compliance issues.  In addition, the 
disciplinary policies must identify noncompliant, unethical or illegal behavior, through 
examples of violative conduct that employees might encounter in their jobs.  Further, the 
policies must provide for timely, consistent and effective enforcement of the standards 
when noncompliant or unethical behavior is found.  Finally, the disciplinary action must 
be appropriate to the seriousness of the violation. 
 
50.5.2  Methods to Publicize Disciplinary Standards 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(E), 423.504(b)(4)(vi)(E) 
 
To encourage good faith participation in the compliance program, sponsors must 
publicize disciplinary standards for employees and FDRs.  The standards should include 
the duty and expectation to report issues or concerns.  The following are examples of the 
types of publication mechanisms that could be used: 
 
  Newsletters; 
  Regular presentations at department staff meetings; 
  Communications with FDRs; 
  General compliance training; 
  Intranet site; 
  Posters prominently displayed throughout employee work and break areas; and 
  Cafeteria table tents. 
 
50.5.3  Enforcing Disciplinary Standards 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(E), 423.504(b)(4)(vi)(E) 
 
Sponsors must be able to demonstrate to CMS that disciplinary standards are enforced in 
a timely, consistent and effective manner.  Records must be maintained for a period of 10 
years for all compliance violation disciplinary actions, capturing the date the violation 
was reported, a description of the violation, date of investigation, summary of findings, 
  disciplinary action taken and the date it was taken.  Sponsors should periodically review 
these records of discipline to ensure that disciplinary actions are appropriate to the 
seriousness of the violation, fairly and consistently administered and imposed within a 
reasonable timeframe.  Sponsors may consider including compliance as a measure on an 
individuals annual performance review.  In addition, a best practice followed by some 
sponsors is to publish de-identified disciplinary action in employee publications, such as 
a newsletter, in order to demonstrate to employees that disciplinary action is imposed for 
violations. 
 
50.6  Element VI:  Effective System for Routine Monitoring, Auditing 
and Identification of Compliance Risks 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(E), 423.504(b)(4)(vi)(E)  
 
Sponsors must establish and implement an effective system for routine monitoring and 
identification of compliance risks.  The system should include internal monitoring and 
audits and, as appropriate, external audits, to evaluate the sponsors, including FDRs, 
compliance with CMS requirements and the overall effectiveness of the compliance 
program. 
 
50.6.1  Routine Monitoring and Auditing 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(F), 423.504(b)(4)(vi)(F) 
 
Sponsors must undertake monitoring and auditing to test and confirm compliance with 
Medicare regulations, sub-regulatory guidance, contractual agreements, and all applicable 
Federal and State laws, as well as internal policies and procedures to protect against 
Medicare program noncompliance and potential FWA. 
 
Monitoring activities are regular reviews performed as part of normal operations to 
confirm ongoing compliance and to ensure that corrective actions are undertaken and 
effective.  An audit is a formal review of compliance with a particular set of standards 
(e.g., policies and procedures, laws and regulations) used as base measures. 
 
Sponsors must develop a monitoring and auditing work plan that addresses the risks 
associated with the Medicare Parts C and D benefits.  The compliance officer and 
compliance committee are key participants in this process. 
 
  Sponsors must have a system of ongoing monitoring and auditing that is reflective of its 
size, organization, risks and resources to assess performance in, at a minimum, areas 
identified as being at risk.  The monitoring and auditing work plan must be coordinated, 
overseen and/or executed by the compliance officer, assisted if desired by the compliance 
department staff and/or the compliance committee.  The compliance officer may 
coordinate with the audit department, if any, in connection with these activities.  The 
compliance officer must receive regular reports from the audit department or from those 
who are conducting the audits regarding the results of auditing and monitoring and the 
status and effectiveness of corrective actions taken. It is the responsibility of the 
compliance officer or his/her designee to provide updates on monitoring and auditing 
results to the compliance committee, the CEO, senior leadership and the sponsors 
governing body.  In addition, for specific work coordinated with the audit department, the 
compliance officer and Chief Audit Executive may share the responsibility to provide 
updates on monitoring and auditing results to the compliance committee, the CEO, senior 
leadership and the sponsors governing body. 
 
50.6.2  Development of a System to Identify Compliance Risks 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(F), 423.504(b)(4)(vi)(F) 
Sponsors must establish and implement policies and procedures to conduct a formal 
baseline assessment of the sponsors major compliance and FWA risk areas, such as 
through a risk assessment. The sponsors assessment must take into account all Medicare 
business operational areas.  Each operational area must be assessed for the types and 
levels of risks the area presents to the Medicare program and to the sponsor.  Factors that 
sponsors may consider in determining the risks associated with each area include, but are 
not limited to: 
 
  Size of department; 
  Complexity of work;  
  Amount of training that has taken place; 
  Past compliance issues; and 
  Budget. 
 
Areas of particular concern for Medicare Parts C and D sponsors include, but are not 
limited to, marketing and enrollment violations, agent/broker misrepresentation, selective 
marketing, enrollment/disenrollment noncompliance, credentialing, quality assessment, 
appeals and grievance procedures, benefit/formulary administration, transition policy, 
protected classes policy, utilization management, accuracy of claims processing, 
detection of potentially fraudulent claims, and FDR oversight and monitoring. 
 
  Risks identified by the risk assessment must be ranked to determine which risk areas will 
have the greatest impact on the sponsor, and the sponsor must prioritize the monitoring 
and auditing strategy accordingly.  Risks change and evolve with changes in the law, 
regulations, CMS requirements and operational matters.  Therefore, there must be 
ongoing review of potential risks of noncompliance and FWA and a periodic re-
evaluation of the accuracy of the sponsors baseline assessments.  Risk areas identified 
through CMS audits and oversight, as well as through the sponsors own monitoring, 
audits and investigations are priority risks.  The results of the risk assessment inform the 
development of the monitoring and audit work plan. 
 
50.6.3  Development of the Monitoring and Auditing Work Plan 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(F), 423.504(b)(4)(vi)(F) 
 
Once the risk assessment has been completed, a monitoring and auditing work plan must 
be developed.  The compliance officer may coordinate with each department to develop a 
monitoring and auditing work plan based upon the results of the risk assessment.  The 
work plan may include: 
 
  The audits to be performed; 
  Audit schedules, including start and end dates 
  Announced or unannounced audits; 
  Audit methodology; 
  Necessary resources; 
  Types of Audit:  desk or onsite;  
  Person(s) responsible; 
  Final  audit report due date to compliance officer; and 
  Follow up activities from findings. 
 
Sponsors must include in their work plans a process for responding to all monitoring and 
auditing results and for conducting follow-up reviews of areas found to be non-compliant 
to determine if the implemented corrective actions have fully addressed the underlying 
problems. 
 
Corrective action and follow-up should be led or overseen by the compliance officer and 
assisted, if desired, by the compliance department staff, and include actions such as 
reporting findings to CMS or to the NBI MEDICs, if necessary. 
 
  50.6.4  Audit Schedule and Methodology 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(F), 423.504(b)(4)(vi)(F) 
 
The work plan must include a schedule that lists all of the monitoring and auditing 
activities for the calendar year.  Sponsors may want to organize the schedule by month or 
quarter. 
 
Sponsors must audit their operational areas and those of their first tier entities.  It is a best 
practice for sponsors to use a combination of desk and on-site audits, including, as 
appropriate and as permitted by contractual agreements, unannounced audits or spot 
checks when developing the work plan.   On-site audits provide the auditor an 
opportunity to assess the on-site operations, interview staff, and gain a better 
understanding of the performance of the area under review. 
 
Sponsors should prepare a standard audit report that includes items such as: 
 
  Audit Objectives; 
  Scope and Methodology; 
  Findings: 
 
  Condition; 
o
  Criteria; 
o
  Cause; 
o
  Effect; and 
o
 
  Recommendations 
 
In developing the types of audits to include in the work plan sponsors must: 
 
  Determine which risk areas will most likely affect the sponsor, and prioritize the 
monitoring and audit strategy accordingly; 
 
  Utilize appropriate methods in: 
 
  Selecting sponsor facilities, pharmacies, providers, claims, and other areas 
o
for audit; 
 
  Determining appropriate sample size; 
o
 
  Extrapolating audit findings using statistically valid methods that comply 
o
with generally accepted auditing standards to the full universe; and 
   
  Applying targeted or stratified sampling methods driven by data mining 
o
and complaint monitoring;   
 
  Use special targeted techniques based on aberrant behavior; 
 
  Assess compliance with internal processes and procedures; 
 
  Examine the performance of the compliance program, including a review of 
training, reporting mechanisms (e.g., hotline log), investigation files, OIG/GSA 
exclusion list screenings, evidence of employee receipt of Standards of Conduct 
and conflict of interest disclosures/attestations, and sampling for evidence in 
support of attestations, if the sponsor uses attestations to monitor compliance; and 
 
  Conduct follow up review by auditing, monitoring or otherwise of areas 
previously found non-compliant to determine if the implemented corrective 
actions have fully addressed the underlying problem. 
 
50.6.5  Audit of the Sponsors Operations and Compliance Program 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(F), 423.504(b)(4)(vi)(F) 
 
The compliance officer and compliance committee must ensure the implementation of an 
audit function appropriate to the sponsors size, scope and structure.  The audit function 
may be performed by a separate audit department or may be performed by the 
compliance department.  Staff dedicated to the audit function will be responsible for 
monitoring and auditing the sponsors operational areas to ensure compliance with 
Medicare regulations.  Adequate resources must be devoted to the audit function 
considering factors such as size and scope of the sponsors Medicare Part C and D 
programs, its compliance history, current compliance risks, and the amount of resources 
necessary to meet the goals of its annual work plan. 
 
Participants in the audit function must be knowledgeable about CMS operational 
requirements for the areas under review.  Auditors may include, as needed, pharmacists, 
nurses, physicians, certified public accountants, fraud investigators, SIU staff, 
compliance staff with operational backgrounds and other highly skilled staff.  These 
specific roles need not reside within the audit department or compliance department. 
Rather, they may reside in other departments provided their services are accessible to 
perform the necessary audit responsibilities. 
 
Sponsors must ensure that auditors are independent and do not engage in self-policing. 
Operations staff may assist in audit activities provided the assistance is compatible with 
  the independence of the audit function.  For example, operations staff may gather data for 
samples requested by the auditor and may provide other types of information to auditors. 
Sponsors must ensure that audit staff have access to the relevant personnel, information, 
records and areas of operation under review, including the operational areas at the plan 
and FDR level. 
 
Sponsors must audit the effectiveness of the compliance program and the results must be 
shared with the governing body.  Audits of the compliance program should occur at least 
annually.  In order to avoid self-policing, sponsors who exclusively use compliance 
department staff, including the compliance officer, for their auditing function should train 
employees who are not part of the compliance department to perform the audit, or 
outsource the audit to external auditors. 
 
While the compliance department staff may not conduct the formal audit of the 
effectiveness of the compliance program, it may administer less formal measures of 
compliance program effectiveness, such as a self-assessment tool or dashboard or 
scorecard in support of the compliance program effectiveness audit. 
 
50.6.6  Monitoring and Auditing FDRs 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(F), 423.504(b)(4)(vi)(F) 
 
Sponsors are responsible for the lawful and compliant administration of the Medicare 
Parts C and D benefits under their contracts with CMS, regardless of whether the sponsor 
has delegated some of that responsibility to FDRs.  The sponsor must develop a strategy 
to monitor and audit its first tier entities to ensure that they are in compliance with all 
applicable laws and regulations, and to ensure that the first tier entities are monitoring the 
compliance of the entities with which they contract (the sponsors downstream 
entities).  Sponsors must also monitor any related entities to ensure those entities are 
compliant with all applicable laws and regulations. 
 
Sponsors must include in their work plan the number of first tier entities that will be 
audited each year and how the entities will be identified for auditing.  It is a best practice 
for sponsors to conduct a number of on-site audits. 
 
Sponsors must conduct specific monitoring of first tier entities to ensure they fulfill the 
compliance program requirements.  When a sponsor has a large number of first tier 
entities, making it impractical and/or cost prohibitive to monitor or audit all first tier 
entities for all compliance program requirements, the sponsor may perform a risk 
assessment to identify its highest risk first tier entities, then select a reasonable number of 
first tier entities to audit from the highest risk groups.  Monitoring of first tier entities for 
compliance program requirements must include an evaluation to confirm that the first tier 
  entities are applying appropriate compliance program requirements to downstream 
entities with which the first tier contracts. 
 
When FDRs perform their own audits, it is a best practice for sponsors to obtain a 
summary of the audit work plan and audit results that relate to the services the FDR 
performs.  Examples of reports that sponsors should receive and review as part of their 
FDR monitoring and auditing efforts include, but are not limited to: 
 
  Payment Reports that detail the amount paid by both the sponsor and the enrollee; in 
addition, payment reports identifying  the provider, the enrollee and a description of 
the drug (including dosage and amount) or service provided.  These reports should be 
used to identify over and under payments, duplicate payments, timely payments, and 
pricing aberrances, and to help verify correct pricing; 
 
  Drug Utilization Reports that identify the number of prescriptions filled by a 
particular enrollee and in particular, numbers of prescriptions filled for suspect 
classes of drugs, such as narcotics, to identify possible therapeutic abuse or illegal 
activity by an enrollee.  Enrollees with an abnormal number of prescriptions or 
prescription patterns for certain drugs should be identified in reports.   Likewise, 
Drug Utilization Management reports from FDRs may be a useful tool in identifying 
FWA;  
 
  Provider Utilization Reports that identify the number and types of visits and 
services submitted for payment to identify possible spikes and/or irregularities such 
as a provider submitting claims for services that would not normally be performed by 
the providers specialty; 
 
  Prescribing and Referral Patterns by Physician Reports that identify the number 
of prescriptions and referrals written by a particular provider and typically focus on a 
class or particular type of drug, such as narcotics, or a specific type of DME, such as 
scooters.  These reports should be generated to identify possible prescriber and 
referral/provider, pharmacy fraud and DME fraud; and  
 
  Geographic ZIP Reports that identify possible doctor shopping schemes or script 
mills by comparing the geographic location (ZIP code) of the patient to the location 
of the provider that wrote the prescription and should include the location of the 
dispensing pharmacy.  These reports should generate information on those enrollees 
who obtain multiple prescriptions from providers located more than the normal 
distance traveled for care (for example, 30 miles).  Normal distance should take 
into account where the enrollee resides (i.e., enrollees in rural areas would typically 
have longer trips to a doctor or pharmacy than enrollees living in urban areas). 
 
When corrective action is needed, sponsors must ensure that corrective actions are taken 
by the entity.  Although first tier entities may perform their own internal auditing, the 
sponsor remains obligated to perform its own auditing of first tier entities. 
 
  50.6.7  Tracking and Documenting Compliance and Compliance 
Program Effectiveness 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(F), 423.504(b)(4)(vi)(F) 
 
Sponsors should track and document compliance efforts.  In addition to formal audits and 
monitoring, it is a best practice for sponsors to regularly track and document compliance 
using dashboards, scorecards, self-assessment tools that the sponsor creates or purchases, 
and other mechanisms that show the extent to which operational areas and FDRs are 
meeting compliance goals.  Compliance of operational areas should be tracked by 
management and publicized to employees. Issues of noncompliance identified in 
dashboards, scorecards and self-assessment tools, etc., should be shared with senior 
management.  Sponsors should consider including compliance performance as a measure 
for staff, management, and FDR evaluations. 
 
50.6.8  OIG/GSA Exclusion 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
The Act 1862(e)(1)(B), 42 C.F.R.  422.503(b)(4)(vi)(F), 422.752(a)(8), 
423.504(b)(4)(vi)(F), 423.752(a)(6), 1001.1901 
 
This section provides guidance regarding sponsors implementation of FWA safeguards 
to identify excluded providers and entities.  Medicare payment may not be made for 
items or services furnished or prescribed by an excluded provider or entity.  Sponsors 
shall not use federal funds to pay for services, equipment or drugs prescribed or provided 
by a provider, supplier, employee or FDR excluded by the DHHS OIG or GSA. 
 
Sponsors must review the DHHS OIG List of Excluded Individuals and Entities (LEIE 
list) and the GSA Excluded Parties Lists System (EPLS) prior to the hiring or contracting 
of any new employee, temporary employee, volunteer, consultant, governing body 
member, or FDR, and monthly thereafter, to ensure that none of these persons or entities 
are excluded or become excluded from participation in federal programs.  Monthly 
screening is essential to prevent inappropriate payment to providers, pharmacies, and 
other entities that have been added to exclusions lists since the last time the list was 
checked.  After entities are initially screened against the entire LEIE and EPLS at the 
time of hire or contracting, sponsors need only review the LEIE supplement file provided 
each month, which lists the entities added to the list that month, and review the EPLS 
updates provided during the specified monthly time frame. 
 
  OIGs LEIE includes all health care providers and suppliers that are excluded from 
participation in federal health care programs, including those health care providers and 
suppliers that might also be on the EPLS.  In addition to health care providers (that are 
also included on the OIG LEIE) the EPLS includes non-health care contractors. 
 
Links to instructions for accessing this information are available in Appendix A: 
Resources. 
 
50.6.9  Use of Data Analysis for Fraud, Waste and Abuse Prevention 
and Detection 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(F), 423.504(b)(4)(vi)(F) 
 
Sponsors must perform effective monitoring in order to prevent and detect FWA.  
Sponsors may accomplish this through the use of data analysis.  Data analysis should 
include the comparison of claim information against other data (e.g., provider, drug or 
medical service provided, diagnoses or beneficiaries) to identify unusual patterns 
suggesting potential errors and/or potential fraud and abuse.  Data analysis should factor 
in the particular prescribing and dispensing practices of providers who serve a particular 
population (e.g., long term care providers, assisted living facilities, etc.).  Use of data 
analysis may include monitoring pharmacy and medical billing to detect unusual patterns.  
Sponsors may invest in data analysis software applications that give them the ability to 
analyze large amounts of data to detect FWA both internally and externally.  Data 
analysis should: 
 
  Establish baseline data to enable the sponsor to recognize unusual trends, changes 
in drug utilization over time, physician referral or prescription patterns, and plan 
formulary composition over time; 
 
  Analyze claims data to identify potential errors, inaccurate TrOOP accounting, 
and provider billing practices and services that pose the greatest risk for potential 
FWA to the Medicare program; 
 
  Identify items or services that are being over utilized; 
 
  Identify problem areas within the plan such as enrollment, finance, or data 
submission; 
 
  Identify problem areas at the FDR (e.g., PBM, pharmacies, pharmacists, 
physicians, other health care providers and  suppliers); and 
 
  Use findings to determine where there is a need for a change in policy. 
   
Sponsors should develop indicators that will be used to identify norms, abnormalities, 
and individual variables that describe statistically significant time-series trends. Examples 
include: 
 
  Standard deviations from the mean; 
  Percent above the mean or median; and 
  Percent increase in charges, number of visits/services from one period to another. 
 
Sponsors should routinely generate and review reports on pharmacy billing, medical 
claims, etc., based upon the data analysis performed to identify pharmacies and other 
FDRs that require further review. 
 
50.6.10  Special Investigation Units (SIUs) 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(F), 423.504(b)(4)(vi)(F) 
 
An effective program to control FWA includes policies and procedures to identify and 
address FWA at both the sponsor and FDR levels in the delivery of Parts C and D 
benefits.  An SIU is an internal investigation unit, often separate from the compliance 
department, responsible for conducting surveillance, interviews, and other methods of 
investigation relating to potential FWA.  Depending upon the size of and resources 
available within the organization, sponsors must either establish a specific SIU or ensure 
that responsibilities generally conducted by an SIU are conducted by the compliance 
department.  Sponsors are not expected to perform law enforcement activities and may 
refer all matters indicative of FWA to the NBI MEDIC or law enforcement. 
 
SIU responsibilities should include: 
 
  Reducing or eliminating Medicare Parts C and D benefit costs due to FWA; 
 
  Reducing or eliminating fraudulent or abusive claims paid for with federal 
dollars; 
 
  Preventing illegal activities; 
 
  Identifying enrollees with overutilization issues; 
 
  Identifying and recommending providers for exclusion, including those who have 
defrauded or abused the system to the NBI MEDIC and/or law enforcement; 
 
    Referring suspected, detected or reported cases of illegal drug activity, including 
drug diversion, to the NBI MEDIC and/or law enforcement and conducting case 
development and support activities for NBI MEDIC and law enforcement 
investigations; and 
  Assisting law enforcement by providing information needed to develop successful 
prosecutions. 
 
SIUs must be accessible through multiple channels such as via phone, email, Internet 
message submission, and mail.  Sponsors must ensure that suspicions of FWA can be 
reported anonymously to the SIU. 
 
Sponsors must ensure that the SIU and compliance department communicate and 
coordinate closely to ensure that the Medicare Parts C and D benefits are protected from 
fraudulent, abusive and wasteful schemes throughout the administration and delivery of 
benefits, both at the sponsor and FDR levels. 
 
50.6.11  Auditing by CMS or its Designee 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(F), 423.504(b)(4)(vi)(F), 422.504(e)(2), 423.505(e)(2) 
 
CMS has the discretionary authority to perform audits under 42 C.F.R. 44 422.504(e)(2) 
and 423.505(e)(2), which specify the right to audit, evaluate, or inspect any books, 
contracts, medical records, patient care documentation, and other records of sponsors or 
FDRs that pertain to any aspect of services performed, reconciliation of benefit liabilities, 
and determination of amounts payable under the contract or as the Secretary of Health 
and Human Services may deem necessary to enforce the contract. 
 
Sponsors must allow access to any auditor acting on behalf of the federal government or 
CMS to conduct an on-site audit.  On-site audits require a thorough review of required 
documentation.  Such reviews include any information needed to determine compliance 
with the Medicare Parts C and D regulations and contracts, such as copies of 
prescriptions, invoices, provider and pharmacy licenses, claims records, signature logs, 
records documenting delivery status by postal carrier, long-term care delivery notice to 
nursing staff, other forms of documentation of medication delivery, purchase records, 
contracts, rebate and discount agreements, as well as interviews of the staff.  The 
interviews gauge whether control activities are practiced as dictated by the companys 
policy and applicable Parts C and D requirements are being followed. On-site audits are 
based on sampling or results of desk audits.  In most cases, CMS or its designee will 
provide reasonable notice to the sponsor of the time and content of the audit. 
 
The OIG has independent authority to conduct audits and evaluations necessary to ensure 
accurate and correct payment and to otherwise oversee Medicare reimbursement. 
   
Sponsors and FDRs must provide records to CMS or its designee.  Sponsors should 
cooperate in allowing access as requested.  Failure to do so may result in a referral of the 
sponsor and/or FDR to law enforcement and/or implementation of other corrective 
actions, including intermediate sanctioning in line with 42 C.F.R. Subpart O.  MEDICs 
and other contractors tasked to conduct audits by CMS, as well as contractors trained by 
CMS and engaged by sponsors to conduct CMS data validation audits, are acting on 
behalf of the federal government and are not required to sign the sponsors confidentiality 
statement prior to the start of an on-site audit.  Sponsors and FDRs are required to 
cooperate with CMS and CMS contractors, such as the NBI MEDICs.  This cooperation 
includes providing CMS and/or the NBI MEDICs or other contractors access to all 
requested records associated in any manner with the Parts C or D program. 
 
When CMS or its designee (e.g., the NBI MEDIC) requests information that will be used 
for an audit, CMS or its designee will notify the sponsor of an appropriate time period 
within which to provide the requested information. 
 
50.7  Element VII:  Procedures and System for Prompt Response to 
Compliance Issues 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(G), 423.504(b)(4)(vi)(G) 
 
Sponsors must establish and implement procedures and a system for promptly responding 
to compliance issues as they are raised, investigating potential compliance problems as 
identified in the course of self-evaluations and audits, correcting such problems promptly 
and thoroughly to reduce the potential for recurrence, and ensuring ongoing compliance 
with CMS requirements. 
 
1.  If the sponsor discovers evidence of misconduct related to payment or delivery of 
items or services under the contract, it must conduct a timely, reasonable inquiry 
into that conduct. 
 
2.  The sponsor must conduct appropriate corrective actions (for example, repayment 
of overpayments, disciplinary actions against responsible individuals) in response 
to the potential violation referenced above. 
 
3.  The sponsor should have procedures to voluntarily self-report potential fraud or 
misconduct related to the Medicare program to CMS or its designee (such as the 
NBI MEDIC). 
 
  50.7.1  Conducting a Timely and Reasonable Inquiry of Detected 
Offenses 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(G), 423.504(b)(4)(vi)(G) 
 
Sponsors must conduct a timely and well-documented reasonable inquiry into any 
compliance incident or issue involving potential Medicare program noncompliance or 
potential FWA. 
 
Program noncompliance and FWA may occur at the level of the sponsor or its FDRs.  It 
may be discovered through a hotline, a website, an enrollee complaint, during routine 
monitoring or self evaluation, an audit, or by regulatory authorities.  Regardless of how 
the noncompliance or FWA is identified, sponsors must initiate a reasonable inquiry as 
quickly as possible, but not later than 2 weeks after the date the potential noncompliance 
or potential FWA incident was identified. 
 
A reasonable inquiry includes a preliminary investigation of the matter by the compliance 
officer or a delegated member of his/her staff and/or the sponsors SIU. If the issue 
appears to involve potential fraud or abuse and the sponsor does not have either the time 
or the resources to investigate the potential fraud or abuse in a timely manner, it should 
refer the matter to the NBI MEDIC within 30 days of the date the potential fraud or abuse 
is identified so that the potentially fraudulent or abusive activity does not continue. 
 
Sponsors are responsible for monitoring for FWA and Medicare program noncompliance 
within their organizations. When serious noncompliance or waste occurs, CMS strongly 
encourages sponsors to refer the matter to CMS.  When potential fraudulent or abusive 
activity is identified, CMS strongly encourages sponsors to refer the matter to the 
appropriate MEDIC (currently, the NBI MEDIC). 
 
50.7.2  Corrective Actions 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(G), 423.504(b)(4)(vi)(G) 
 
Sponsors must undertake appropriate corrective actions in response to potential 
noncompliance or potential FWA. 
 
Corrective actions must be designed to correct the underlying problem that results in 
program violations and to prevent future noncompliance. A root cause analysis 
  determines what caused or allowed the FWA, problem or deficiency to occur. A 
corrective action must be tailored to address the particular FWA, problem or deficiency 
identified, and must include timeframes for specific achievements. 
 
The sponsor must ensure that FDRs have corrected their deficiencies.  When developing 
corrective actions for FWA or program noncompliance by an FDR, the elements of the 
corrective action should be detailed in writing and include ramifications if the FDR fails 
to implement the corrective action satisfactorily.  Also, the sponsor / FDR contract should 
include language that details the ramifications of failing to maintain compliance or 
engaging in FWA, such as contract termination. 
 
In order to ensure that the FDR has implemented the corrective action, sponsors should 
conduct independent audits or review the FDRs monitoring or audit reports.  Sponsors 
must continue to monitor corrective actions after their implementation to ensure that they 
are effective. 
 
The elements of the corrective action that address noncompliance or FWA committed by 
the sponsors employee(s) or FDRs must be documented, and include ramifications 
should the sponsors employee(s) or its FDRs fail to satisfactorily implement the 
corrective action. The sponsor must enforce effective correction through disciplinary 
measures, including employment or contract termination, if warranted. 
 
Thorough documentation must be maintained of all deficiencies identified and corrective 
actions taken. 
 
50.7.3  Procedures for Self-Reporting Potential FWA and Significant 
Non Compliance 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(G), 423.504(b)(4)(vi)(G) 
 
Self-reporting of FWA and Medicare program noncompliance is voluntary.  CMS 
nonetheless strongly encourages self-reporting as an important practice in maintaining an 
effective compliance program.  Sponsors should self-report potential FWA discovered at 
the plan level, and potential fraud and abuse by FDRs, as well as significant waste and 
significant incidents of Medicare program noncompliance. 
 
Where sponsors notify the MEDICs of potential FWA in accordance with the guidelines 
described below, the MEDICs will refer potential FWA to law enforcement when 
appropriate.  Issues that are referred to the NBI MEDIC and are determined not to be 
potential FWA will be returned to the sponsor to be addressed. 
 
  Sponsors are required to investigate potential FWA activity to make a determination 
whether potential FWA has occurred.  Sponsors must conclude investigations of potential 
FWA within a reasonable time period after the activity is discovered.  If after conducting 
a reasonable inquiry, the sponsor (e.g., the compliance officer or SIU) determines that 
potential FWA related to the Medicare Parts C or D programs has occurred, the matter 
should be referred to the NBI MEDIC promptly.  Sponsors should also refer potential 
FWA at the FDR levels to the NBI MEDIC so that the NBI MEDIC can help identify and 
address any scams or schemes. 
 
Sponsors should also consider reporting potentially fraudulent conduct to government 
authorities such as the Office of Inspector General (through the OIGs Provider Self-
Disclosure Protocol) or the Department of Justice.  All health care providers doing 
business with Medicare that want to disclose violations of law are eligible to disclose 
fraudulent conduct under the Provider Self-Disclosure Protocol.  The Protocol offers a 
detailed step-by-step explanation of how a provider should proceed in reporting and 
assessing the extent of potential fraud and how the OIG will go about verifying 
irregularities. 
 
Where a sponsor discovers an incident of significant Medicare program noncompliance, 
the sponsor should report the incident to CMS as soon as possible after its discovery.  
This will enable CMS to provide guidance to the sponsor on mitigation of the harm 
caused by the incident of noncompliance.  While no bright line definition exists as to 
what is a significant or serious incident that should be reported, sponsors should err 
on the side of over-reporting rather than under-reporting. 
 
Self-reporting offers sponsors the opportunity to minimize the potential cost and 
disruption of a full scale audit and investigation, to negotiate a fair monetary settlement, 
and to potentially avoid an OIG permissive exclusion preventing the entity from doing 
business with Federal health care programs. 
 
50.7.4  NBI MEDIC 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(G), 423.504(b)(4)(vi)(G) 
 
Medicare Drug Integrity Contractors (MEDIC) are organizations that CMS contracts with 
to perform specific program integrity functions for Parts C and D under the Medicare 
Integrity Program.  The MEDICs primary role is to identify potential fraud and abuse in 
Medicare Part C and Part D.  There is currently one National Benefit Integrity (NBI) 
MEDIC. 
 
NBI MEDICs will investigate referrals from sponsors, develop the investigations, and 
make referrals to appropriate law enforcement agencies or other outside entities when 
  necessary.  The NBI MEDIC will keep the sponsor apprised of the development and 
status of the investigation. If the NBI MEDIC determines a referral to be a matter related 
to noncompliance or mere error rather than fraud or abuse, the matter will be returned to 
CMS and/or the sponsor for appropriate follow-up. 
 
Sponsors should refer cases involving potential fraud or abuse that meet any of the 
following criteria to the NBI MEDIC: 
 
  Suspected, detected or reported  criminal, civil, or administrative law violations; 
 
  Allegations that extend beyond the Parts C and D plans, involving multiple health 
plans, multiple states, or widespread schemes; 
 
  Allegations involving known patterns of fraud; 
 
  Pattern of fraud or abuse threatening the life or well being of beneficiaries; and 
 
  Scheme with large financial risk to the Medicare Program or beneficiaries. 
 
50.7.5  Referrals to the NBI MEDIC 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 16, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(G), 423.504(b)(4)(vi)(G) 
 
Each sponsor referral to the NBI MEDIC should contain specifics that will allow an 
investigator to follow-up on a case including basic identifying information and contacts 
as well as a description of the allegations. 
 
If available, a referral should include: 
 
  Name of: 
  compliance officer or SIU investigator, and 
o
 
  Organization; 
o
 
  Contact information for follow up; 
 
  Summary of the Issue: 
  Include the basic who, what, when, where, how, and why; and 
o
 
  Any potential legal violations; 
o
 
  Specific Statutes and Allegations: 
    List civil, criminal, and administrative code or rule violations, state and 
o
federal; and 
 
  Provide detailed description of the allegations or pattern of fraud, waste, 
o
or abuse; 
 
  Incidents and Issues: 
  List incidents and issues related to the allegations; 
o
 
  Background information: 
  Contact information for the complainant, the perpetrator or subject of the 
o
investigation, and beneficiaries, pharmacies, providers, or other entities 
involved; and 
 
  Additional background information that may assist investigators, such as 
o
names and contact information of informants, relators, witnesses, 
websites, geographic locations, corporate relationships, networks; 
 
  Perspectives of Interested Parties: 
  Perspective of Plan, CMS, enrollee; 
o
 
  Data: 
  Existing and potential data sources; 
o
 
  Graphs and trending; 
o
 
  Maps; and 
o
 
  Financial impact estimates; and 
o
 
  Recommendations in Pursuing the Case: 
  Next steps, special considerations, cautions. 
o
 
Call the NBI MEDIC at 1-877-7SafeRX (1-877-772-3379). 
 
For referral forms, go to:  
http://www.healthintegrity.org/html/contracts/medic/case_referral.html 
 
The NBI MEDIC may request additional information in order to fully investigate and 
resolve the matter.  The sponsor shall furnish additionally requested information within 
30 days, unless the NBI MEDIC specifies otherwise.  In instances where the MEDIC 
requires information in less than 30 days, all parties involved will be notified as soon as 
possible.  Sponsors should provide updates to the NBI MEDIC when new information 
regarding the matter is identified. 
 
  50.7.6  Responding to CMS-Issued Fraud Alerts 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(G), 423.504(b)(4)(vi)(G) 
 
CMS issues alerts to Part D sponsors concerning fraud schemes indentified by law 
enforcement officials.  Typically, these alerts describe alleged activities involving 
pharmacies practicing drug diversion or prescribers participating in illegal remuneration 
schemes. Sponsors may take action (including denying or reversing claims) in instances 
where the sponsors own analysis of its claims activity indicates that fraud may be 
occurring.  A sponsors decision to deny or reverse claims should be made on a claim-
specific basis. 
 
When a Fraud Alert is received, the sponsor should review its contractual agreements 
with the identified parties.  It would be appropriate for the sponsor to consider 
terminating the contract(s) with the identified parties if law enforcement has issued 
indictments against particular parties and the terms of the sponsors contract(s) authorizes 
contract termination in those circumstances. 
 
Sponsors are also obligated to review their past paid claims from entities identified in a 
fraud alert.  With the issuance of a fraud alert, CMS has placed sponsors on notice (see 
42 CFR 423.505(k)(3)) that they should review claims involving identified providers.  To 
meet the best knowledge, information, and belief standard of certification, sponsors 
should make their best efforts to, identify claims that may be or may have been part of an 
alleged fraud scheme and remove them from their sets of prescription drug event data 
submissions. 
 
50.7.7  Identifying Providers with a History of Complaints 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
42 C.F.R.  422.503(b)(4)(vi)(G), 423.504(b)(4)(vi)(G), 422.504(d)-(e) 
Sponsors should maintain files for a period of 10 years on both in-network and out-of-
network providers who have been the subject of complaints, investigations, violations, 
and prosecutions.  This includes enrollee complaints, NBI MEDIC investigations, OIG 
and/or DOJ investigations, US Attorney prosecution, and any other civil, criminal, or 
administrative action for violations of Federal health care program requirements.  
Sponsors should also maintain files that contain documented warnings (i.e., fraud alerts) 
and educational contacts, the results of previous investigations, and copies of complaints 
resulting in investigations.  Sponsors must comply with requests by law enforcement, 
  CMS and CMS designee regarding monitoring of providers within the sponsors 
network that CMS has identified as potentially abusive or fraudulent. 
  Appendix A: Resources 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
For more information on topics discussed in this chapter, including developing and 
implementing effective compliance and fraud and abuse plans, see: 
 
Government Resources: 
 
1.  National Benefit Integrity MEDIC: 
http://www.healthintegrity.org/html/contracts/medic/index.html 
 
2.  Stop Medicare Fraud:  
http://www.stopmedicarefraud.gov 
 
3.  The Patient Protection and Affordable Care Act: 
http://www.gpo.gov/fdsys/pkg/PLAW-111publ148/pdf/PLAW-111publ148.pdf 
 
4.  Compliance Guidance for Medicare+Choice Organizations:  
http://oig.hhs.gov/fraud/docs/complianceguidance/111599.pdf 
 
5.  Office of the Inspector General, Compliance Program Guidance for the 
Healthcare Industry:  
http://oig.hhs.gov/compliance/compliance-guidance/index.asp 
 
6.  Federal Sentencing Guidelines: 
http://www.ussc.gov/Guidelines 
 
7.  Fraud Alerts, Bulletins and Other Guidance from the OIG: 
http://oig.hhs.gov/compliance/alerts/index.asp 
 
8.  False Claims Act:  
http://www.justice.gov/jmd/ls/legislative_histories/pl99-562/pl99-562.html 
 
9.  Health Insurance Portability and Accountability Act (HIPAA): 
http://aspe.hhs.gov/admnsimp/pl104191.htm 
 
10. Anti-Kickback Statute (see section 1128B(b)): 
http://www.ssa.gov/OP_Home/ssact/title11/1128B.htm#f 
 
11. Stark Law (Physician Self-Referral):  
https://www.cms.gov/PhysicianSelfReferral/ 
 
12. TRICARE Fraud & Abuse:   
  http://www.tricare.osd.mil/fraud 
 
 
Other Resources:  
 
1.  Health Care Administrators Association (HCAA): 
http://www.hcaa.org/ 
 
2.  Heath Care Compliance Association (HCCA): 
http://www.hcca-info.org 
 
3.  Society of Corporate Compliance and Ethics (SCCE): 
http://www.corporatecompliance.org 
 
4.  American Health Lawyers Association (AHLA): 
http://www.healthlawyers.org 
 
5.  National Health Care Anti-Fraud Association (NHCAA): 
http://www.nhcaa.org 
 
6.  Institute for Health Care Improvement (IHI): 
http://ihi.org 
 
7.  Corporate Responsibility and Health Care Quality  A Resource for Health Care 
Boards of Directors, U.S. Dept. of Health and Human Services Office of the 
Inspector General and The American Health Lawyers Assn.: 
http://oig.hhs.gov/fraud/docs/complianceguidance/CorporateResponsibilityFinal%
209-4-07.pdf 
 
Links to OIG and GSA Exclusions Databases 
 
  OIG LISTSERV via the OIG Website: http://exclusions.oig.hhs.gov/  
 
  General Services Administration (GSA) database of excluded individuals/ 
entities:  https://www.epls.gov/ 
  Appendix B:  Laws and Regulations to Consider in Standards of 
Conduct and/or Training 
(Chapter 21 - Rev. 109, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-
20-12) 
(Chapter 9 - Rev. 15, Issued: 07-27-12, Effective: 07-20-12; Implementation: 07-20-
12) 
 
  Title XVIII of the Social Security Act 
 
  Medicare regulations governing Parts C and D found at 42 C.F.R.  422 and 423 
respectively 
 
  Patient Protection and Affordable Care Act (Pub. L. No. 111-148, 124 Stat. 119) 
 
  Health Insurance Portability and Accountability Act (HIPAA) (Public Law 104-
191) 
 
  False Claims Acts (31 U.S.C.  3729-3733) 
 
  Federal Criminal False Claims Statutes (18 U.S.C.  287,1001) 
 
  Anti-Kickback Statute (42 U.S.C.  1320a-7b(b)) 
 
  The Beneficiary Inducement Statute (42 U.S.C.  1320a-7a(a)(5)) 
 
  Civil monetary penalties of the Social Security Act (42 U.S.C.  1395w-27 (g)) 
 
  Physician Self-Referral (Stark) Statute (42 U.S.C.  1395nn) 
 
  Fraud and Abuse, Privacy and Security Provisions of the Health Insurance 
Portability and Accountability Act, as modified by HITECH Act 
 
  Prohibitions against employing or contracting with persons or entities that have 
been excluded from doing business with the Federal Government (42 U.S.C. 
1395w-27(g)(1)(G) 
 
  Fraud Enforcement and Recovery Act of 2009 
 
  All sub-regulatory guidance produced by CMS and HHS such as manuals, 
training materials, HPMS memos, and guides 
  Transmittals Issued for this Chapter 
 
Rev #  Issue Date  Subject  Impl Date  CR# 
R110MCM  01/11/2013  Compliance Guidelines Program  01/11/2013 N/A 
R109MCM  07/27/2012  Initial Issuance of Chapter  07/20/2012 N/A 
R108MCM  07/20/2012  Initial Issuance of Chapter - Rescinded and  07/20/2012 N/A 
replaced by Transmittal 109