Report Template = 04-30-05_rev.13

Department of Health and Human Services


OFFICE OF 

INSPECTOR GENERAL 

PRESCRIPTION DRUG PLAN 


SPONSORS’ COMPLIANCE PLANS


Daniel R. Levinson


Inspector General 


December 2006


OEI-03-06-00100

Report Template = 04-30-05_rev.13

Office of Inspector General 
 http://oig.hhs.gov 

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, 

as amended, is to protect the integrity of the Department of Health and Human Services 

(HHS) programs, as well as the health and welfare of beneficiaries served by those 

programs. This statutory mission is carried out through a nationwide network of audits, 

investigations, and inspections conducted by the following operating components: 

Office of Audit Services 

The Office of Audit Services (OAS) provides all auditing services for HHS, either by 

conducting audits with its own audit resources or by overseeing audit work done by others. 

Audits examine the performance of HHS programs and/or its grantees and contractors 

in carrying out their respective responsibilities and are intended to provide independent 

assessments of HHS programs and operations. These assessments help reduce waste, 

abuse, and mismanagement and promote economy and efficiency throughout HHS. 

Office of Evaluation and Inspections 

The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide 

HHS, Congress, and the public with timely, useful, and reliable information on 

significant issues. Specifically, these evaluations focus on preventing fraud, waste, or 

abuse and promoting economy, efficiency, and effectiveness in departmental programs. 

To promote impact, the reports also present practical recommendations for improving 

program operations. 

Office of Investigations 

The Office of Investigations (OI) conducts criminal, civil, and administrative 

investigations of allegations of wrongdoing in HHS programs or to HHS beneficiaries 

and of unjust enrichment by providers. The investigative efforts of OI lead to criminal 

convictions, administrative sanctions, or civil monetary penalties. 

Office of Counsel to the Inspector General 

The Office of Counsel to the Inspector General (OCIG) provides general legal services to 

OIG, rendering advice and opinions on HHS programs and operations and providing all 

legal support in OIG's internal operations. OCIG imposes program exclusions and civil 

monetary penalties on health care providers and litigates those actions within HHS. 

OCIG also represents OIG in the global settlement of cases arising under the Civil False 

Claims Act, develops and monitors corporate integrity agreements, develops compliance 

program guidances, renders advisory opinions on OIG sanctions to the health care 

community, and issues fraud alerts and other industry guidance. 
Report Template = 04-30-05_rev.13

ΔINTROD EXE CUTIVE S UCT ION S U MMAR Y EXECUTIVE SUMMAR Y 

OBJECTIVES 

(1) To determine whether prescription drug plan sponsors have 

developed compliance plans as required by the Medicare Prescription 

Drug, Improvement, and Modernization Act of 2003; and 

(2) To determine whether prescription drug plan (PDP) sponsors’ 

compliance plans, as of January 2006, addressed all of the requirements 

and selected recommendations regarding the eight compliance elements 

presented in Federal regulations. 

BACKGROUND 

As of January 1, 2006, all 43 million Medicare beneficiaries became 

eligible to enroll in the new Part D prescription drug benefit established 

through the Medicare Prescription Drug, Improvement, and 

Modernization Act of 2003 (Public Law 108-173). Part D coverage is 

provided through private drug plans offered by plan sponsors. These 

plans include mainly stand-alone PDPs and Medicare Advantage plans 

that offer integrated coverage for both prescription drugs and other 

health care. For this report, we limited our review to stand-alone PDP 

sponsors’ compliance plans. 

Pursuant to 42 CFR § 423.504(b)(4)(vi), PDP sponsors approved to 

provide Part D benefits in 2006 are required to have compliance plans 

in place. These compliance plans must address eight elements, which 

are listed on page 2 of this report. The Office of Inspector General (OIG) 

has consistently recommended in its Compliance Program Guidances 

that compliance programs be implemented in a manner that addresses 

organizations’ specific operations and risk areas. A successful 

compliance program helps sponsors protect the integrity of Medicare 

funds and may also improve Part D plans’ efficiency and effectiveness. 

Beginning in November 2005, we requested copies of PDP sponsors’ 

compliance plans to determine whether they addressed the eight 

required elements. We asked sponsors to provide all documents that 

made up their compliance plans. By January 2006, we received 

compliance plans covering all 79 stand-alone PDP contracts. 

To determine whether PDP sponsors’ compliance plans addressed the 

eight elements in Federal regulations (42 CFR § 423.504(b)(4)(vi)), we 

reviewed each plan using information in the Centers for Medicare & 

Medicaid Services’ (CMS) summary document, issued in June 2005, 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS i 
Report Template Update = 04-30-05_rev.13 

EXE CUTIVE S U MMAR Y

entitled “Review of Sponsors’ Fraud, Waste, and Abuse 

Responsibilities;” and the fraud, waste, and abuse chapter of CMS’s 

“Prescription Drug Benefit Manual,” issued in April 2006. 

In the “Prescription Drug Benefit Manual” chapter, CMS outlines 

requirements that sponsors’ compliance plans must address to ensure 

that the eight elements established by regulation are met. While the 

manual chapter outlines CMS’s current expectations for sponsors’ 

compliance plans, the June 2005 summary document was the only CMS 

guidance available to PDP sponsors when we began our review. 

Therefore, we reviewed plans for 17 of the requirements included in the 

initial summary document. These 17 requirements were later included 

in CMS’s manual chapter as well. 

The 17 requirements we reviewed were associated with the 8 regulatory 

compliance plan elements. For the eighth element, which involves a 

comprehensive fraud and abuse plan, the summary document and 

manual chapter both include a requirement that PDP sponsors develop 

fraud and abuse plans. Neither the summary document nor the manual 

chapter provides any additional requirements regarding the 

development of fraud and abuse plans. However, the manual chapter 

does provide recommendations to sponsors concerning fraud and abuse 

plans. Comprehensive fraud and abuse plans are important to 

maintaining the integrity of the Part D benefit. Therefore, we also 

selected for review 11 recommendations from the manual chapter that 

are specific to the detection, correction, and prevention of fraud, waste, 

and abuse. This review enabled us to determine how sponsors’ 

compliance plans addressed the development of fraud and abuse 

programs in the early stages of the Part D benefit. 

We reviewed compliance plans to determine whether they addressed the 

17 requirements and 11 recommendations. Our initial reviews revealed 

that some compliance plans included language that merely restated the 

text of the requirements and recommendations. Therefore, for six 

requirements and six recommendations we assessed whether each plan 

provided specifics on how the sponsor intended to implement the 

requirement or recommendation. When a plan included these specifics, 

we determined that it provided detailed information about the 

requirement or recommendation. 

OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS ii 
Report Template Update = 04-30-05_rev.13 

EXE CUTIVE S U MMAR Y

FINDINGS 

All PDP sponsors had compliance plans, yet 72 of the 79 plans did 

not address all CMS requirements regarding the eight compliance 

plan elements. As of January 2006, all sponsors had compliance plans 

covering the 79 PDP contracts. Federal regulations outline eight 

elements PDP sponsors must include in their compliance plans, and 

CMS guidance documents specify that plans must address 

17 requirements regarding the eight elements. Seventy-two of 

seventy-nine compliance plans did not address all 17 requirements. 

Sponsors’ compliance plans addressed a median of 13 of these 

requirements. For six of the eight elements, all or almost all plans 

addressed every requirement. However, many sponsors’ compliance 

plans did not address requirements relating to two elements: 

designation of a compliance officer and compliance committee, and 

procedures for internal monitoring and auditing. These elements are 

essential to the implementation of a successful compliance program. 

Compliance officers are focal points for organizations’ compliance 

activities and compliance committees assist in compliance program 

implementation. Ongoing monitoring and auditing is a critical process 

that enables organizations to identify and respond to compliance issues 

timely and to review whether compliance plan elements are functioning 

appropriately. 

Over half of the compliance plans that addressed six requirements 

involving compliance processes or programs did not contain detailed 

information about these requirements. Details about the 

implementation of various compliance plan requirements are essential for 

ensuring that a compliance plan is actually functioning within an 

organization. The six requirements are: compliance training programs, 

processes for reporting compliance violations, internal monitoring and 

auditing procedures, contractor monitoring and auditing procedures, 

procedures for responding to compliance violations, and procedures for 

implementing corrective actions. These requirements correspond to four 

of the eight compliance plan elements outlined in Federal regulations. 

While all compliance plans addressed the fraud and abuse element 

in some way, only 15 of 79 plans addressed all 11 recommendations 

that we reviewed regarding fraud detection, correction, and 

prevention. While sponsors’ compliance plans are required to include 

comprehensive plans to detect, prevent, and correct fraud, waste, and 

abuse, CMS’s manual chapter includes only recommendations regarding 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS iii 
Report Template Update = 04-30-05_rev.13 

EXE CUTIVE S U MMAR Y 

the design of these antifraud plans. All compliance plans addressed at 

least two of these recommendations, yet only 15 of 79 plans (19 percent) 

addressed all 11 CMS recommendations that we included in our review. 

At the median, plans addressed 7 of the 11 recommendations. Plans 

most often did not address CMS recommendations relating to sponsors’ 

fraud detection procedures, fraud awareness training, and efforts to 

coordinate and cooperate with CMS and law enforcement entities 

regarding potential fraud. Effective compliance plans describe sponsors’ 

plans for monitoring organizational activities for potential fraud; 

educating employees and enrollees about fraud, waste, and abuse; and 

coordinating with Government authorities regarding fraud. 

We determined whether compliance plans included detailed information 

for six recommendations regarding the establishment of fraud detection, 

correction, and prevention procedures. Even among compliance plans 

that addressed these recommendations, over 40 percent did not include 

detailed information. 

RECOMMENDATION 

This report provides results of our early review of PDP sponsors’ 

compliance plans. When implemented successfully, a compliance plan 

that includes a comprehensive fraud, waste, and abuse program helps 

sponsors protect the integrity of Medicare funds and may also improve 

the operating efficiency and effectiveness of sponsors’ PDPs. 

We found that all PDP sponsors have compliance plans. However, these 

plans have not fully addressed all of the requirements that CMS specified 

in its guidance documents for the eight required compliance plan 

elements. In addition, our findings suggest that certain PDP sponsors’ 

compliance plans contain only the broad outlines of a fraud and abuse 

plan. These compliance plans do not include descriptions of specific 

processes to implement and monitor a fraud and abuse plan. Effective 

compliance plans should include detailed and specific policies and 

procedures for how plan elements will be implemented. 

CMS has not specifically audited PDP sponsors’ compliance plans or 

fraud, waste, and abuse programs to determine whether sponsors have 

addressed the eight elements established by regulation. 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS iv 
Report Template Update = 04-30-05_rev.13 

EXE CUTIVE S U MMAR Y 

Therefore, CMS should: 

Ensure that PDP sponsors’ compliance plans address all requirements. 

The manual chapter issued by CMS in April 2006 includes both 

required and recommended provisions regarding compliance plan 

elements. CMS should ensure that sponsors’ compliance plans address 

all requirements presented in its manual chapter regarding the eight 

elements set forth in regulation. CMS should also encourage sponsors 

to provide sufficient detail in their compliance plans to clearly 

demonstrate how sponsors are actually implementing the compliance 

plan requirements. 

AGENCY COMMENTS 

CMS agreed that effective compliance plans are an important tool for 

monitoring fraud, waste, and abuse in PDP sponsors’ Part D plans and 

concurred with OIG’s recommendation. CMS stated that routine audits 

beginning in 2007 will review the required compliance plan elements 

and that sponsors will be accountable for meeting all requirements. 

CMS provided additional comments and context on some issues in the 

report. CMS suggested changes to language in the report concerning 

CMS oversight of sponsors’ compliance plans and sponsors’ voluntary 

reporting of possible fraud or misconduct to Government authorities. 

CMS also noted that it would not be possible for compliance plans to 

have addressed requirements included in the manual chapter in April 

2006 because OIG reviewed compliance plans before the final manual 

chapter was published. 

The full text of the comments are presented in Appendix C. 

OFFICE OF INSPECTOR GENERAL RESPONSE 

CMS’s planned audits, as described, address our recommendation. 

We have revised language in the body of the report and in the 

recommendation section to address CMS’s concerns about oversight of 

sponsors’ compliance plans and sponsors’ reporting procedures. 

We also revised wording in the report to clarify that the 

17 requirements included in our review were contained in the summary 

document issued to PDP sponsors in June 2005. These requirements 

were later included in CMS’s manual chapter as well. Therefore, the 

PDP sponsors’ compliance plans should have addressed the 

17 requirements at the time of our review. 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS v 
Report Template Update = 04-30-05_rev.13 

Δ T ABLE OF CONTENTS 

EXECUTIVE SUMMARY ..................................... i

INTR O D U C T I ON ........................................... 1

FINDI NGS ................................................. 9 

Seventy-two compliance plans did not address all requirements . . 9

While all plans addressed the fraud and abuse element, only

15 plans addressed all 11 recommendations reviewed ......... 13

RECOM M E NDATI O N ...................................... 15

Agency Comments...................................... 15

Office of Inspector General Response....................... 16

APPENDIXES ............................................. 17

A: Table 1: Number of Compliance Plans That Did Not Address 

17 CMS Requirements for the Eight Compliance Plan 

Elements .......................................... 17

B: Table 2: Number of Compliance Plans That Did Not Address 

11 Selected CMS Recommendations Regarding Sponsors’ 

Fraud and Abuse Plans .............................. 19

C: Agency Comments ................................... 20

ENDN OTE S ............................................... 23

ACKN O W LEDGMENTS .................................... 24
Report Template Update = 04-30-05_rev.13 

ΔINTROD UCT ION INTRODU C TION 

OBJECTIVES 

(1) To determine whether prescription drug plan sponsors have developed 

compliance plans as required by the Medicare Prescription Drug, 

Improvement, and Modernization Act of 2003; and 

(2) To determine whether prescription drug plan (PDP) sponsors’ 

compliance plans, as of January 2006, addressed all of the requirements 

and selected recommendations regarding the eight compliance elements 

presented in Federal regulations. 

BACKGROUND 

Medicare Coverage of Prescription Drugs 

Section 101 of the Medicare Prescription Drug, Improvement, and 

Modernization Act of 2003 (Public Law 108-173) established Medicare 

Part D to provide outpatient prescription drug benefits under the Medicare 

program. As of January 1, 2006, all 43 million1 Medicare beneficiaries 

became eligible to enroll in the new Part D prescription drug benefit. It is 

estimated that the Part D benefit will cost $31 billion in 2006 and 

$768 billion over 10 years.2 

Part D coverage is provided through private drug plans offered by plan 

sponsors. These plans include mainly stand-alone PDPs and Medicare 

Advantage plans that offer integrated coverage both for prescription drugs 

and for other health care.3 For this report, we limited our review to 

stand-alone PDP sponsors’ compliance plans. As of June 2006, more than 

22 million Medicare beneficiaries were enrolled in a Part D drug plan; 

16.4 million of these beneficiaries were enrolled in stand-alone PDPs.4 

Prescription Drug Plan Sponsors’ Compliance Plans 

Entities that sought to become PDP sponsors were required to complete an 

application and bidding process that began in January 2005.5 The Centers 

for Medicare & Medicaid Services (CMS) awarded contracts to successful 

applicants in September 2005. PDP sponsors are required to implement 

compliance plans that include comprehensive plans to detect, correct, and 

prevent fraud, waste, and abuse.6 A successful compliance program helps 

sponsors protect the integrity of Medicare funds and may also improve 

Part D plans’ efficiency and effectiveness. 

To qualify to become a PDP sponsor, applicants were required to attest in 

Section 3.12 of the PDP sponsor application that their compliance plans 

addressed the eight elements required in Federal regulations. 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 1 
Report Template Update = 04-30-05_rev.13 

INTROD UCT ION 

As listed in 42 CFR § 423.504(b)(4)(vi), the eight elements PDP sponsors’ 

compliance plans must contain are: 

(1) Written policies, procedures, and standards of conduct articulating the 

organization’s commitment to comply with all applicable Federal and 

State standards. 

(2) The designation of a compliance officer and compliance committee 

accountable to senior management. 

(3) Effective training and education between the compliance officer and 

organization employees, contractors, agents, and directors. 

(4) Effective lines of communication between the compliance officer and 

the organization’s employees, contractors, agents, directors and 

members of the compliance committee. 

(5) Enforcement of standards through well-publicized disciplinary 

guidelines. 

(6) Procedures for effective internal monitoring and auditing. 

(7) Procedures for ensuring prompt response to detected offenses and 

development of corrective action initiatives relating to the 

organization’s contract as a Part D plan sponsor. 

(8) A comprehensive fraud and abuse plan to detect, correct, and prevent 

fraud, waste, and abuse. This fraud and abuse plan should include 

procedures to voluntarily self-report potential fraud or misconduct 

related to the Part D program to the appropriate government 

authority.7 

In addition to attesting that their compliance plans addressed these 

elements, applicants were asked to provide narrative responses describing 

the sections of their compliance plans related to fraud, waste, and abuse as 

they would apply to the operation of the Medicare Part D benefit. 

According to the PDP sponsor application instructions, CMS expected 

compliance plans containing these elements to be in place by 

September 15, 2005.8 

Compliance Plan Guidance for Prescription Drug Plan Sponsors 

In June 2005, CMS issued an eight-page summary document, “Review of 

Sponsors’ Fraud, Waste, and Abuse Responsibilities,” containing 

compliance plan guidance for applicants to use during the bidding process. 

On February 8, 2006, CMS issued more detailed guidance in the form of a 

draft chapter for its “Prescription Drug Benefit Manual” and solicited PDP 

sponsors’ comments. In April 2006, CMS finalized the chapter of the 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 2 
Report Template Update = 04-30-05_rev.13 

INTROD UCT ION

“Prescription Drug Benefit Manual” outlining the requirements and 

recommendations for compliance plans. CMS specified multiple 

requirements for four of the eight compliance plan elements. For each of 

the remaining four elements, CMS specified only one requirement, which is 

essentially the same as the element. 

The manual chapter CMS developed for PDP sponsors is similar to 

Compliance Program Guidances the Office of Inspector General (OIG) has 

been issuing since 1998 for health care entities such as hospitals, home 

health agencies, durable medical equipment companies, and managed care 

organizations. The OIG Compliance Program Guidances contain elements 

that are the same as the first seven compliance plan elements specified in 

the Part D regulations.9 OIG has reiterated in each of its Compliance 

Program Guidances that all of these compliance plan elements are 

essential to developing an effective compliance program that reduces an 

organization’s vulnerability to fraud, waste, and abuse. 

Antifraud, Waste, and Abuse Plans (Eighth Element) 

PDP sponsors’ compliance plans must address eight elements. For the 

eighth element, which involves a comprehensive fraud and abuse plan, 

CMS’s manual chapter requires PDP sponsors to develop fraud and abuse 

plans but does not provide any other specific requirements. However, the 

manual chapter does provide recommendations to sponsors concerning 

fraud and abuse plans. The manual chapter explains that these 

recommendations provide sponsors with a road map to develop and 

implement effective fraud, waste, and abuse programs to protect Part D 

plans and the Medicare Trust Fund. The manual chapter also states that 

sponsors may either create a separate fraud, waste, and abuse program or 

integrate fraud, waste, and abuse provisions into the other seven elements 

of their compliance plans. 

Oversight of Prescription Drug Plan Sponsors’ Compliance Activities 

CMS’s “Part D Oversight Strategy for Contractors/Industry” specifies that 

new Medicare Drug Integrity Contractors (MEDIC) will be responsible for 

many Part D oversight activities. MEDICs’ responsibilities include 

analyzing claims and other data, investigating potential fraud and abuse, 

referring potential fraud cases to appropriate law enforcement agencies or 

CMS, conducting program integrity audits, and reviewing the fraud and 

abuse components of PDP sponsors’ compliance plans. CMS has already 

selected several companies as MEDICs, but has not yet assigned any task 

orders to these companies to review PDP sponsors’ compliance efforts or 

fraud, waste, and abuse programs. As of August 2006, only one MEDIC 

was operating under an approved task order. This MEDIC’s efforts have 

OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 3 
Report Template Update = 04-30-05_rev.13 

INTROD UCT ION

focused on processing complaints regarding Part D fraud, waste, and 

abuse, particularly in the areas of enrollment and marketing. 

METHODOLOGY 

Compliance Plan Request 

To determine whether PDP sponsors developed compliance plans as 

required by Federal regulations, we requested copies of compliance plans 

for the 79 stand-alone PDP contracts with CMS. For each contract, we 

mailed a letter to the PDP sponsor asking it to provide all documents that 

made up its compliance plan. 

We collected compliance plans between November 2005 and January 2006. 

We received 60 compliance plans covering all 79 contracts. Several PDP 

sponsors operate multiple prescription drug plans across the country, but 

each of these sponsors has just one compliance plan in place to cover all of 

its PDPs. In our analysis, we counted a compliance plan that covered 

multiple PDP contracts once for every contract it covered. Therefore, the 

total number of compliance plans referred to in this report is 79. 

Compliance Plan Review 

To determine whether PDP sponsors’ compliance plans addressed CMS’s 

requirements and recommendations regarding the eight elements, we 

developed a detailed checklist and used it to review each compliance plan. 

The checklist contained eight sections corresponding to the eight required 

compliance plan elements. We based the checklist on statements included 

in CMS’s summary document issued June 2005, entitled “Review of 

Sponsors’ Fraud, Waste, and Abuse Responsibilities” and on the fraud, 

waste, and abuse chapter of CMS’s “Prescription Drug Benefit Manual,” 

issued in April 2006. 

For nearly all checklist items, we adopted a very broad approach to 

determining whether the text of a plan addressed a compliance plan 

requirement or recommendation. Two requirements regarding the second 

element were exceptions to this approach. These requirements state that 

sponsors must designate a compliance officer and compliance committee. 

We reviewed plans for specific evidence that a sponsor had designated a 

compliance officer and compliance committee to determine if the 

compliance plan had addressed these requirements. 

We did not attempt to assess the quality of the plans, nor the extent to 

which the plans had been implemented as part of PDP sponsors’ 

operations. Some sponsors provided us with the compliance plan section of 

OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 4 
Report Template Update = 04-30-05_rev.13 

INTROD UCT ION 

the completed PDP application that they submitted to CMS for approval in 

2005. We did not include these documents in our review. 

Requirements for Eight Compliance Plan Elements 

In the manual chapter, CMS outlines requirements that sponsors’ 

compliance plans must address to ensure that the eight elements 

established by regulation are met. CMS’s manual chapter distinguishes 

between statutory or regulatory program requirements that must be 

included in sponsors’ compliance plans and recommendations that CMS 

suggests sponsors address in their plans. 

While the manual chapter issued in April 2006 outlines CMS’s current 

expectations for sponsors’ compliance plans, the June 2005 summary 

document was the only CMS guidance available to PDP sponsors when we 

began our review. Therefore, we reviewed plans for 17 of the requirements 

included in the initial summary document. These 17 requirements were 

later included in CMS’s manual chapter as well. 

We used the 17 requirements to determine whether sponsors’ compliance 

plans addressed the eight compliance plan elements. For four elements 

(1, 3, 5, and 8), the CMS guidance specifies only one requirement, which is 

essentially the same as the element. Compliance plan elements and the 

requirements related to each element are presented in Table 1 below. 

Table 1. Eight Compliance Plan Elements and Seventeen Related CMS Requirements 

Element 1: Written policies, procedures, and standards of conduct articulating the organization’s commitment to 

comply with all applicable Federal and State standards* 

1. Sponsor has written policies, procedures, and standards of conduct articulating the organization’s commitment to 

comply with all applicable Federal and State standards. 

Element 2: The designation of a compliance officer and compliance committee accountable to senior 

management 

2. Sponsor has a compliance officer in place. 

3. Sponsor has a compliance committee in place. 

4. Sponsor has established a compliance committee that is overseen by the compliance officer, advises the compliance 

officer, and assists in the implementation of the compliance program. 

5. Compliance officer is responsible for developing, operating, and monitoring the fraud, waste, and abuse program. 

Element 3: Effective training and education between the compliance officer and organization employees, 

contractors, agents, and directors* 

6. Sponsor has a training and education program in place. 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 5 
Report Template Update = 04-30-05_rev.13 

INTROD UCT ION

Element 4: Effective lines of communication between the compliance officer and the organization’s employees, 

contractors, agents, directors, and members of the compliance committee 

7. Sponsor has established lines of communication to provide organization-wide information about how to report 

compliance concerns and suspected or actual misconduct. 

8. Sponsor has mechanisms in place for capturing concerns and risks, such as hotlines, suggestion boxes, or employee 

exit interviews. 

Element 5: Enforcement of standards through well-publicized disciplinary guidelines* 

9. Sponsor enforces standards through disciplinary guidelines. 

Element 6: Procedures for effective internal monitoring and auditing 

10. Sponsor has an internal monitoring and auditing program. 

11. Sponsor has a plan in place to monitor and audit contractors’ responsibilities and activities. 

12. When requested, sponsor is prepared to allow CMS to audit its financial records. 

13. Sponsor allows access to any auditor acting on behalf of the Federal Government or CMS to conduct an onsite audit. 

14. Sponsor’s contractors provide records to CMS or its designee. 

Element 7: Procedures for ensuring prompt response to detected offenses and development of corrective action 

initiatives relating to the organization’s contract as a Part D plan sponsor 

15. Sponsor has procedures for ensuring prompt responses to detected offenses and development of corrective action 

initiatives. 

16. Sponsor conducts appropriate corrective actions in response to potential violations. 

Element 8: A comprehensive fraud and abuse plan to detect, correct, and prevent fraud, waste, and abuse* 

17. Sponsor has a comprehensive fraud and abuse plan to detect, correct, and prevent fraud, waste, and abuse. 

*For this element, CMS guidance specifies only one requirement which is essentially the same as the element. 

Our initial reviews revealed that some compliance plans included language 

that merely restated the text of the requirements. We therefore selected 

six CMS requirements (numbers 6, 7, 10, 11, 15, and 16 in Table 1 above) 

for which we assessed whether each plan provided specifics on how the 

sponsor intended to implement the requirements. When a plan included 

these specifics, we determined that the plan provided detailed information 

about the requirements. 

Recommendations for Eighth Compliance Plan Element 

For the eighth element, regarding a comprehensive fraud and abuse plan, 

the summary document and manual chapter both include a requirement 

that PDP sponsors develop fraud and abuse plans. Neither the summary 

document nor the manual chapter provides any other specific requirements 

regarding the development of such plans; however, the manual chapter 

does provide recommendations to sponsors concerning fraud and abuse 

plans. Comprehensive fraud and abuse plans are important to 

maintaining the integrity of the Part D benefit. Therefore, we selected for 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 6 
Report Template Update = 04-30-05_rev.13 

INTROD UCT ION 

review 11 recommendations from the manual chapter that are specific to 

the detection, correction, and prevention of fraud, waste, and abuse. This 

review enabled us to determine how sponsors’ compliance plans addressed 

the development of fraud and abuse programs in the early stages of the 

Part D benefit. 

We reviewed sponsors’ compliance plans to determine whether they 

addressed the 11 recommendations. Compliance plans that addressed at 

least one of these CMS recommendations were considered to have 

addressed the requirement for the eighth element. The 11 selected 

recommendations related to the eighth element are presented in Table 2. 

We selected six recommendations (numbers 1, 2, 3, 7, 8, and 10 in Table 2) 

for which we assessed whether each plan provided specifics on how the 

sponsor intended to implement the recommendations. When a plan 

included these specifics, we determined that the plan provided detailed 

information about the recommendations. 

Table 2. Eleven CMS Recommendations Regarding Sponsors’ Antifraud Plans 

Element 8: A comprehensive fraud and abuse plan to detect, correct, and prevent fraud, waste, and abuse 

1. Sponsor has procedures for the identification of fraud, waste, and abuse in its network. 

2. Sponsor has a process to identify overpayments at any level within its network and to properly repay such 

overpayments in accordance with CMS policy. 

3. Sponsor has policies and procedures for coordinating and cooperating with MEDICs, CMS, and law enforcement, 

including policies that fully cooperate with any audits conducted by the abovementioned entities or their designees. 

4. Sponsor’s compliance officer’s duties include responding to reports of potential and actual instances of Part D fraud, 

waste, or abuse, including the coordination of internal investigations and the development of appropriate corrective or 

disciplinary actions. 

5. Sponsor’s compliance officer’s duties include maintaining documentation for each report of potential fraud, waste, or 

abuse received through any of the reporting methods (i.e. hotline, mail, in-person) which summarizes the initial report of 

noncompliance, the investigation, the results of the investigation, and all corrective and/or disciplinary action(s) taken as a 

result of the investigation. 

6. Sponsor’s compliance training addresses pertinent laws related to fraud and abuse. 

7. Sponsor has various methods to educate enrollees on prescription drug fraud, waste, and abuse. 

8. Sponsor has procedures for internal monitoring and auditing to test and confirm compliance with the Part D benefit 

regulations, subregulatory guidance, contractual agreements, and all applicable State and Federal laws, as well as 

internal policies and procedures to protect against potential fraud, waste, or abuse. 

9. Sponsor receives and reviews at least one of the following data reports: payment reports, drug utilization reports, 

prescribing patterns by physician reports, geographic ZIP reports. 

10. Sponsor conducts data analysis that includes the comparison of claim information against other data (e.g., provider, 

drug provided, diagnoses, or beneficiaries) to identify potential errors and/or potential fraud. 

11. Sponsor has procedures in place to voluntarily self-report potential fraud or misconduct to Government authorities 

such as OIG (through OIG’s Provider Self-Disclosure Protocol) or the Department of Justice. 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 7 
Report Template Update = 04-30-05_rev.13 

INTROD UCT ION 

Standards 

This inspection was conducted in accordance with the “Quality Standards 

for Inspections” issued by the President’s Council on Integrity and 

Efficiency and the Executive Council on Integrity and Efficiency. 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 8 
Report Template Update = 04-30-05_rev.13 

Δ FINDINGS

 All PDP sponsors had compliance plans, yet 

72 of the 79 plans did not address 

all CMS requirements regarding the eight 

compliance plan elements 

As of January 2006, all sponsors had 

compliance plans covering the 

79 PDPs. Some sponsors submitted 

compliance documents that had been 

prepared by their pharmacy benefit 

managers or parent organizations. 

Compliance plans ranged in length from a nine-page document to two large 

binders full of compliance information. Some compliance plans were a 

collection of policy and procedure documents, while other plans were 

individual documents divided into chapters for different compliance issues. 

Federal regulations concerning PDPs outline eight elements that sponsors 

must include in their compliance plans.10 CMS’s guidance documents 

specify 17 requirements relating to the eight compliance plan elements. 

Sponsors’ compliance plans addressed between 6 and 17 of these 

requirements. Seventy-two of the seventy-nine compliance plans did not 

address all 17 requirements. Sponsors’ plans addressed a median of 

13 requirements. Table 1 in the Appendix provides information on the 

number of plans that did not address each of the 17 requirements. 

All or almost all of the compliance plans addressed every requirement 

relating to six of the eight elements. Many sponsors’ compliance plans did 

not address requirements relating to two elements: designation of a 

compliance officer and compliance committee, and procedures for internal 

monitoring and auditing. 

Compliance officer and compliance committee. Twenty-one compliance 

plans did not address all requirements regarding the compliance officer 

and compliance committee element. Four of these twenty-one plans did not 

address the compliance officer and compliance committee element in any 

way. 

Twelve compliance plans did not indicate that sponsors designated a 

compliance officer. Eleven compliance plans did not indicate that sponsors 

designated a compliance committee. Federal regulations state that all 

PDP sponsors must have a compliance officer and compliance committee in 

place.11 PDP sponsors’ compliance officers are responsible for developing, 

operating, and monitoring the organization’s fraud, waste, and abuse 

program, yet 63 plans did not state that the compliance officer or another 

individual or group is specifically responsible for maintaining the sponsor’s 

antifraud program, as required. An organization’s compliance officer 

serves as the focal point for compliance activities and an organization’s 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 9 
Report Template Update = 04-30-05_rev.13 

F I NDING S 

compliance committee typically advises the compliance officer and assists 

in the implementation of the compliance program. 

Internal monitoring and auditing. Seventy-one compliance plans did not 

address all requirements for the internal monitoring and auditing element. 

Fifty-two of these seventy-one plans addressed only one or two of the five 

requirements for the internal monitoring and auditing element. 

PDP sponsors are required to monitor and audit their contractors’ 

activities regarding the administration and delivery of the Part D benefit 

and to ensure that contractors’ records are available for Government 

review. (We use the term contractors to indicate organizations that CMS’s 

manual chapter refers to as “first-tier entities” or “downstream entities.”) 

Forty-four compliance plans did not indicate that sponsors have procedures 

in place to monitor and audit their contractors’ activities. In addition, 

64 plans did not indicate that sponsors’ contractors would provide their 

records to CMS or its designee. CMS is required to conduct audits to 

confirm sponsors’ compliance with Part D contracts; however, 48 plans did 

not indicate that sponsors would allow CMS or other Government 

authorities to audit their records. While these results do not suggest that 

sponsors or their contractors would not provide requested records, the 

compliance plans contained no information relating to these requirements. 

An ongoing monitoring and auditing process is critical to a successful 

compliance program because it enables an organization to identify and 

respond to compliance issues timely and to assess whether compliance plan 

elements are functioning appropriately (e.g., whether employees are 

completing compliance training, whether compliance policies have been 

distributed or made available). 

Over half of compliance plans did not contain detailed information for each of 

six requirements involving compliance processes or programs 

While sponsors’ compliance plans in some way addressed certain CMS 

compliance plan requirements, the majority of plans did not contain details 

about how sponsors would implement these requirements. Details about 

the implementation of various compliance plan requirements are essential 

for ensuring that a compliance plan is actually functioning within an 

organization. 

More than half of compliance plans that addressed each of six 

requirements we reviewed involving compliance processes or programs did 

not contain detailed information for these requirements. These 

requirements correspond to four of the eight compliance plan elements. 

The six requirements are: compliance training programs, processes for 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 10 
Report Template Update = 04-30-05_rev.13 

F I NDING S 

reporting compliance violations, internal monitoring and auditing 

procedures, contractor monitoring and auditing procedures, procedures for 

responding to compliance violations, and procedures for implementing 

corrective actions. The number of plans that did not address each 

requirement in detail is presented in Table 1 of Appendix A. 

Compliance training programs. All but one compliance plan (78 of 79) 

addressed compliance training and education programs, but more than half 

of these plans (41 of 78) did not include any details regarding these 

programs. One compliance plan only indicated that the sponsor was 

currently working on a training plan. Another plan stated that the sponsor 

will update its compliance training program based on legal and regulatory 

requirements; however, the plan provided no detailed information about 

the content of the sponsor’s training program. Compliance training 

programs are critical to ensuring that appropriate information regarding 

compliance plans and specific risk areas is communicated to individuals 

throughout an organization. Effective compliance plans include the 

following types of information regarding sponsors’ compliance training 

programs: the topics to be covered, the format of the training, and the 

consequences to employees of their failure to participate in compliance 

training. 

Processes for reporting compliance violations. Seventy-five of seventy-nine 

compliance plans indicated that sponsors have systems to communicate 

information throughout their organizations about reporting compliance 

concerns and misconduct. However, 44 of these 75 plans did not provide 

substantive descriptions of sponsors’ reporting systems. For example, one 

plan simply stated that the compliance officer would be available to 

employees and contractors to clarify compliance policies and procedures, 

but did not provide detailed information regarding the sponsor’s reporting 

systems. Organizations should have mechanisms in place for the reporting 

of improper conduct so that such allegations may be reviewed and 

addressed as appropriate. It is essential that reporting systems be clearly 

communicated to employees and contractors so that they can make 

effective use of these systems when necessary. 

Internal and contractor monitoring and auditing procedures. All but one 

compliance plan addressed sponsors’ internal monitoring and auditing 

procedures in some way, but more than half of these plans (44 of 78) did 

not describe monitoring and auditing procedures in detail. For example, 

one plan only noted that the sponsor uses audits to monitor compliance and 

prepares an annual compliance work plan with audit schedules. The plan 

did not include the audit schedule or any additional information about the 

OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 11 
Report Template Update = 04-30-05_rev.13 

F I NDING S 

the sponsor’s monitoring and auditing program. Of the 35 compliance 

plans that mentioned sponsors’ efforts to monitor contractors’ activities, 

26 plans did not describe sponsors’ procedures for monitoring and auditing 

contractors’ performance in detail. An ongoing evaluation process is 

critical to a successful compliance program. An effective compliance plan 

includes an auditing schedule and identifies the auditing and monitoring 

techniques that will be used by an organization and the areas that will be 

subject to audit. 

Procedures for responding to compliance violations. All 79 compliance plans 

indicated that sponsors have procedures in place for ensuring prompt 

response to detected offenses and for developing and implementing 

corrective actions. However, 43 plans did not describe these procedures. 

For example, one plan merely stated that the compliance officer is 

responsible for requesting an investigation of a suspected violation of the 

law or the sponsor’s compliance policy. Another plan only stated that the 

sponsor would conduct an investigation as promptly as practicable when a 

violation is reported. 

Detected but uncorrected compliance violations can seriously endanger the 

mission, reputation, and legal status of an organization. The development 

of procedures for conducting timely and reasonable inquiries into reported 

misconduct and responding to the results of such inquiries is critical to 

ensuring that organizations respond appropriately to suspected 

noncompliance. 

Procedures for implementing corrective actions. Fifty-four of seventy-nine 

compliance plans did not provide detailed descriptions of the types of 

corrective actions sponsors undertake in response to compliance violations. 

Some of these plans offered only brief, general statements regarding 

sponsors’ corrective actions. For example, several plans indicated that 

sponsors’ employees are subject to “ . . . disciplinary action up to and 

including termination . . . ” in response to compliance violations. Effective 

compliance programs include guidance regarding disciplinary actions for 

compliance violations. 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 12 
Report Template Update = 04-30-05_rev.13 

F I NDING S 

While all compliance plans addressed the fraud and 

abuse element in some way, only 15 of 79 plans 

addressed all 11 recommendations that we reviewed 

regarding fraud detection, correction, and prevention 

While all plans in some way 

addressed at least 2 of the 

11 CMS recommendations 

that we reviewed regarding 

the development of a 

comprehensive fraud and abuse plan, only 15 plans addressed all 11 

selected recommendations. At the median, plans addressed 7 of these 11 

recommendations. The eighth compliance plan element set forth in Part D 

regulations requires PDP sponsors to have “a comprehensive fraud and 

abuse plan to detect, correct, and prevent fraud, waste, and abuse.”12 

CMS’s manual chapter, issued in April 2006, contains a number of 

recommendations regarding the overall design of PDP sponsors’ compliance 

plans. We selected 11 of these recommendations that were specific to fraud 

detection, correction, and prevention and determined whether sponsors’ 

compliance plans addressed them. The number of plans that did not 

address each recommendation selected for review is presented in Table 2 of 

the Appendix. 

Sponsors’ efforts to detect fraud and abuse are essential to the integrity of 

the Part D benefit. Of the 79 compliance plans reviewed, 14 did not 

indicate that sponsors have any procedures in place to identify fraud, 

waste, and abuse. In addition, analysis of claims and other data is a key 

activity in identifying fraud,13 yet 28 compliance plans did not indicate 

that sponsors conduct any analysis of program data to examine trends, 

identify potential errors, or detect fraud. Effective compliance plans 

include specific techniques that are utilized to monitor an organization’s 

activities for potential fraud and abuse, procedures for conducting reviews 

of identified issues, and policies and procedures for responding to identified 

noncompliance. 

Nineteen of seventy-nine plans did not indicate that sponsors have policies 

and procedures in place for coordinating and cooperating with CMS and 

law enforcement entities. CMS’s manual chapter includes a 

recommendation that sponsors have procedures to voluntarily report fraud 

or misconduct to Government authorities such as OIG or the Department 

of Justice, yet 19 plans did not indicate that sponsors have such procedures 

in place. 

Forty-six compliance plans did not indicate that sponsors addressed CMS’s 

recommendation that their compliance training programs educate 

employees on fraud and abuse laws. Fifty compliance plans did not 

indicate that sponsors have methods to educate their enrollees on fraud, 

OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 13 
Report Template Update = 04-30-05_rev.13 

F I NDING S 

waste, and abuse. Educating employees and enrollees is a key component 

to ensuring that such individuals recognize and know how to report 

potential fraud and abuse and compliance violations. 

Even when compliance plans addressed certain CMS recommendations, over 

40 percent did not include detailed information 

In addition to determining whether sponsors’ compliance plans addressed 

CMS’s recommendations in any way, we also determined whether plans 

included detailed information for six recommendations regarding the 

establishment of fraud detection, correction, and prevention procedures. 

Over 40 percent of plans that addressed the 6 recommendations did not 

contain detailed information for each of the recommendations. A 

compliance plan should include detailed and specific policies and 

procedures for how the various plan elements will be implemented in order 

to operate as a functioning and effective compliance program. 

Sixty-five of seventy-nine plans indicated that sponsors have procedures in 

place for the identification of fraud, waste, and abuse, but 28 of the 

65 plans (43 percent) included only basic references to these procedures. 

Thirteen of these twenty-eight plans made brief references to the sponsor’s 

fraud hotline, or to fraud, waste, and abuse training. Another five plans 

stated only sponsors’ intentions to address fraud, waste, and abuse in the 

future. Forty-three of seventy-nine plans indicated that sponsors have 

processes to identify overpayments or repay such overpayments, yet 41 of 

the 43 plans (95 percent) did not describe these processes in any detail. 

Fifty-one of seventy-nine plans indicated that sponsors conduct data 

analysis to detect fraud. Thirty-seven of these 51 plans (73 percent) did 

not include descriptions of data analysis processes or methods to identify 

errors and questionable data patterns. 

Twenty-nine plans indicated that sponsors have methods to educate their 

enrollees on fraud, waste, and abuse. However, 19 of these plans 

(66 percent) did not describe sponsors’ education methods in detail. 

Sixty-nine of seventy-nine plans indicated that sponsors have monitoring 

and auditing procedures that test sponsors’ compliance with laws, 

regulations, and internal policies, but 40 of the 69 plans (58 percent) did 

not provide descriptions of these procedures to protect against potential 

fraud and abuse. Sixty of seventy-nine plans indicated that sponsors have 

policies and procedures in place for coordinating and cooperating with CMS 

and law enforcement entities. Of these, 46 plans (77 percent) did not 

describe sponsors’ policies and procedures for such coordination and 

cooperation. 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 14 
Report Template Update = 04-30-05_rev.13 

ΔEXE CUTIVE S U MMAR Y RECOMME NDA TION 

This report provides results of our early review of PDP sponsors’ 

compliance plans. When implemented successfully, a compliance plan that 

includes a comprehensive fraud, waste, and abuse program helps sponsors 

protect the integrity of Medicare funds and may also improve the operating 

efficiency and effectiveness of sponsors’ PDPs. 

We found that all PDP sponsors have compliance plans. However, these 

plans have not fully addressed all of the requirements that CMS specified in 

its guidance documents for the eight required compliance plan elements. In 

addition, our findings suggest that certain PDP sponsors’ compliance plans 

contain only the broad outlines of a fraud and abuse plan. These compliance 

plans do not include descriptions of specific processes to implement and 

monitor a fraud and abuse plan. Effective compliance plans should include 

detailed and specific policies and procedures for how plan elements will be 

implemented. 

CMS has not specifically audited PDP sponsors’ compliance plans or fraud, 

waste, and abuse programs to determine whether sponsors have addressed 

the eight elements established by regulation. Therefore, CMS should: 

Ensure that PDP sponsors’ compliance plans address all requirements. 

The manual chapter issued by CMS in April 2006 includes both required 

and recommended provisions regarding compliance plan elements. CMS 

should ensure that sponsors’ compliance plans address all requirements 

presented in its manual chapter regarding the eight elements set forth in 

regulation. CMS should also encourage sponsors to provide sufficient 

detail in their compliance plans to clearly demonstrate how sponsors are 

actually implementing the compliance plan requirements. 

AGENCY COMMENTS 

CMS agreed that effective compliance plans are an important tool for 

monitoring fraud, waste, and abuse in PDP sponsors’ Part D plans and 

concurred with OIG’s recommendation. CMS stated that it stands ready to 

take appropriate action against any plan that fails to respond to its 

concerns. 

CMS also provided additional comments and context on some issues in the 

report. CMS stated that the short timeframes for implementing many new 

provisions of the Medicare Prescription Drug, Improvement, and 

Modernization Act may have had an impact on how thorough documents, 

such as compliance plans, were. CMS also stated that, although 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 15 
Report Template Update = 04-30-05_rev.13 

R E C O MMENDA T I O N S 

compliance plan audits will not begin until January 2007, CMS account 

managers have been conducting routine compliance efforts with PDP 

sponsors since the start of the Part D program. CMS stated that the 

routine audits beginning in 2007 will review the required compliance plan 

elements and that sponsors will be accountable for meeting all 

requirements. 

CMS stated that it would not be possible for compliance plans to address 

all 17 requirements to the extent that these requirements were found in 

the April 2006 manual chapter because OIG reviewed compliance plans 

that sponsors provided between November 2005 and January 2006. 

CMS also suggested modifying language in the report concerning PDP 

sponsors’ voluntary reporting of possible fraud or misconduct to 

Government authorities, such as OIG or the Department of Justice. 

The complete text of CMS’s comments can be found in Appendix C. 

OFFICE OF INSPECTOR GENERAL RESPONSE 

CMS’s planned audits, as described, address our recommendation. In 

addition, OIG acknowledges the efforts CMS described to ensure that PDP 

sponsors comply with requirements on a range of issues and we have 

revised language in our recommendation section accordingly. 

We have revised language in the report concerning PDP sponsors’ 

procedures for voluntarily reporting misconduct to Government 

authorities. We also revised wording in the report to clarify that the 

17 requirements included in our review were contained in the summary 

document issued to PDP sponsors in June 2005. These requirements were 

later included in CMS’s manual chapter as well. Therefore, the PDP 

sponsors’ compliance plans should have addressed the 17 requirements at 

the time of our review. 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 16 
Report Template Update = 04-30-05_rev.13 

ΔAPP E N D I X ~A APPENDIX~A 

Table 1. Number of Compliance Plans That Did Not Address 17 CMS Requirements for the Eight 

Compliance Plan Elements 

Compliance plan requirements 

Plans did not 

address the 

requirement 

Plans 

addressed the 

requirement in 

some way 

Plans addressed 

the requirement, 

but not in detail 

NR=Not Reviewed 

Element 1: Written policies, procedures, and standards of conduct 

1. Sponsor has written policies, procedures, and standards of conduct 

articulating the organization’s commitment to comply with all applicable 

Federal and State standards. 

0 79 NR 

Element 2: Compliance officer and compliance committee 

2. Sponsor has a compliance officer in place. 12 67 NR 

3. Sponsor has a compliance committee in place. 11 68 NR 

4. Sponsor has established a compliance committee that is overseen by the 

compliance officer, advises the compliance officer, and assists in the 

implementation of the compliance program. 

16 63 NR 

5. Compliance officer is responsible for developing, operating, and 

monitoring the fraud, waste, and abuse program. 63 16 NR 

Element 3: Compliance training and education 

6. Sponsor has a training and education program in place. 1 78 41 

Element 4: Lines of communication 

7. Sponsor has established lines of communication to provide organizationwide information about how to report compliance concerns and suspected or 

actual misconduct. 

4 75 44 

8. Sponsor has mechanisms in place for capturing concerns and risks, such 

as hotlines, suggestion boxes, or employee exit interviews. 4 75 NR 

Element 5: Disciplinary guidelines 

9. Sponsor enforces standards through disciplinary guidelines. 4 75 NR 

Element 6: Internal monitoring and auditing 

10. Sponsor has an internal monitoring and auditing program. 1 78 44 

11. Sponsor has a plan in place to monitor and audit contractors’ 

responsibilities and activities. 

44 35 26 

12. When requested, sponsor is prepared to allow CMS to audit its financial 

records. 48 31 NR 

13. Sponsor allows access to any auditor acting on behalf of the Federal 

Government or CMS to conduct an onsite audit. 58 21 NR 

14. Sponsor’s contractors provide records to CMS or its designee. 64 15 NR 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 17 
Report Template Update = 04-30-05_rev.13 

APP E N D I X ~A 

Compliance plan requirements 

Plans did not 

address the 

requirement 

Plans 

addressed the 

requirement in 

some way 

Plans addressed 

the requirement, 

but not in detail 

NR=Not Reviewed 

Element 7: Response to offenses and corrective actions 

15. Sponsor has procedures for ensuring prompt responses to detected 

offenses and development of corrective action initiatives. 0 79 43 

16. Sponsor conducts appropriate corrective actions in response to 

potential violations. 

0 79 54 

Element 8: Comprehensive fraud and abuse plan to detect, correct, and prevent fraud, waste, and abuse 

17. Sponsor has a comprehensive fraud and abuse plan to detect, 

correct, and prevent fraud, waste, and abuse. 0 79 NR 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 18 
Report Template Update = 04-30-05_rev.13 

Δ APPENDIX~B 

Table 2. Number of Compliance Plans That Did Not Address 11 Selected CMS Recommendations 

Regarding Sponsors’ Fraud and Abuse Plans 

Compliance plan recommendations* 

Plans did not 

address the 

recommendation 

Plans

 addressed the 

recommendation 

in some way 

Plans 

addressed the 

recommendation, 

but not in detail 

NR=Not Reviewed 

Element 8: A comprehensive fraud and abuse plan to detect, correct, and prevent fraud, waste, and abuse 

1. Sponsor has procedures for the identification of fraud, waste, and 

abuse in its network. 14 65 28 

2. Sponsor has a process to identify overpayments at any level within 

its network and to properly repay such overpayments in accordance with 

CMS policy. 

36 43 41 

3. Sponsor has policies and procedures for coordinating and 

cooperating with MEDICs, CMS, and law enforcement, including policies 

that fully cooperate with any audits conducted by the abovementioned 

entities or their designees. 

19 60 46 

4. Sponsor’s compliance officer’s duties include responding to reports 

of potential and actual instances of Part D fraud, waste, or abuse, 

including the coordination of internal investigations and the development 

of appropriate corrective or disciplinary actions. 

4 75 NR 

5. Sponsor’s compliance officer’s duties include maintaining 

documentation for each report of potential fraud, waste, or abuse 

received through any of the reporting methods (i.e. hotline, mail, inperson) which summarizes the initial report of noncompliance, the 

investigation, the results of the investigation, and all corrective and/or 

disciplinary action(s) taken as a result of the investigation. 

12 67 NR 

6. Sponsor’s compliance training addresses pertinent laws related to 

fraud and abuse. 46 33 NR 

7. Sponsor has various methods to educate enrollees on prescription 

drug fraud, waste, and abuse. 50 29 19 

8. Sponsor has procedures for internal monitoring and auditing to test 

and confirm compliance with the Part D benefit regulations, 

subregulatory guidance, contractual agreements, and all applicable 

State and Federal laws, as well as internal policies and procedures to 

protect against potential fraud, waste, or abuse. 

10 69 40 

9. Sponsor receives and reviews at least one of the following data 

reports: payment reports, drug utilization reports, prescribing patterns 

by physician reports, geographic ZIP reports. 

38 41 NR 

10. Sponsor conducts data analysis that includes the comparison of 

claim information against other data (e.g., provider, drug provided, 

diagnoses, or beneficiaries) to identify potential errors and/or potential 

fraud. 

28 51 37 

11. Sponsor has procedures in place to voluntarily self-report potential 

fraud or misconduct to Government authorities such as OIG (through 

OIG’s Provider Self-Disclosure Protocol) or the Department of Justice. 

19 60 NR 

*CMS’s manual chapter specifies recommendations for designing the fraud and abuse plans outlined in Element 8. We reviewed 

compliance plans to determine whether they addressed 11 recommendations specific to fraud detection, correction, and prevention that 

we selected for review. 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 19 
Report Template Update = 04-30-05_rev.13 

Δ APPENDIX~C 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 20 
Report Template Update = 04-30-05_rev.13 

APP E N D I X ~C 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 21 
Report Template Update = 04-30-05_rev.13 

APP E N D I X ~C 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 22 
Report Template Update = 04-30-05_rev.13 

ΔENDNOTES  ENDNOTE S 

1 “Medicare Coverage—General Information.” Centers for Medicare & 

Medicaid Services (CMS). December 2005. Available online at 

http://www.cms.hhs.gov/CoverageGenInfo/. Accessed April 10, 2006, 

p. 1. 

2 “Medicare Prescription Drug Benefit Fact Sheet.” Henry J. Kaiser 

Family Foundation. May 2006. Available online at 

http://www.kff.org/medicare/upload/7044-03-2.pdf. Accessed 

May 16, 2006, p. 2. 

3 “Medicare Prescription Drug Benefit: Solicitation for Applications from 

Prescription Drug Plans (PDPs).” CMS. January 21, 2005, as revised on 

March 9, 2005, p. 4. 

4 “Total Medicare Beneficiaries with Drug Coverage Data (v06.11.06).” 

CMS. June 2006. Available online at 

http://www.cms.hhs.gov/PrescriptionDrugCovGenIn/02_EnrollmentData 

.asp. Accessed June 15, 2006. 

5 “Medicare Prescription Drug Benefit: Solicitation for Applications 

from Prescription Drug Plans (PDPs).” CMS. January 21, 2005, as 

revised on March 9, 2005, pp. 2–4. 

6 42 CFR § 423.504(b)(4)(vi). 

7 Ibid. 

8 “Medicare Prescription Drug Benefit: Solicitation for Applications 

from Prescription Drug Plans (PDPs).” CMS. January 21, 2005, as 

revised on March 9, 2005, p. 15. 

9 “Fraud Prevention & Detection—Compliance Guidance.” U.S. 

Department of Health and Human Services, Office of Inspector General. 

Available online at http://oig.hhs.gov/fraud/complianceguidance.html. 

Accessed April 28, 2006. 

10 42 CFR § 423.504(b)(4)(vi). 

11 Ibid. 

12 Ibid. 

13 “Prescription Drug Benefit Manual: Chapter 9—Part D Program to 

Control Fraud, Waste and Abuse.” CMS. April 2006, p. 43. 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 23 
Report Template Update = 04-30-05_rev.13 

Δ ACKNOWLEDGMENTS 

This report was prepared under the direction of Robert A. Vito, Regional 

Inspector General for Evaluation and Inspections in the Philadelphia 

regional office, and Linda M. Ragone, Deputy Regional Inspector General. 

Other principal Office of Evaluation and Inspections staff who contributed 

include: 

Amy J. Sernyak, Team Leader 

Nancy J. Molyneaux, Program Analyst 

Emily Dolan Multari, Program Analyst 

Linda Abbott, Program Specialist 

Tricia Davis, Director, Medicare Branch 

Barbara Tedesco, Mathematical Statistician 

 OE I-03-06-00 100 P RESCR I P T I O N DR U G P LAN S PONS O R S ’ C O M P L I ANCE P L ANS 24