United States Government Accountability Office

Washington, DC 20548

Comptroller General

of the United States

Decision

Matter of: Cognosante, LLC

File: B-405868

Date: January 5, 2012

Thomas L. McGovern III, Esq., Michael D. McGill, Esq., and Elizabeth J. Galezio, 

Esq., Hogan Lovells US, LLP, for the protester.

Alexander J. Brittin, Esq., Brittin Law Group, PLLC, for Health Integrity, LLC, an 

intervenor.

Brian E. Hildebrandt, Esq., Department of Health and Human Services, for the 

agency.

Paul E. Jordan, Esq., and David A. Ashen, Esq., Office of the General Counsel, 

GAO, participated in the preparation of the decision.

DIGEST

Protest against exclusion of protester from the competition is denied where 

contracting officer reasonably determined that protester’s dual role as both a state 

and federal audit contractor with respect to the Medicaid program would pose an

impaired objectivity organizational conflict of interest that would not be adequately 

mitigated by protester’s proposed firewall. 

DECISION

Cognosante, LLC, of McLean, Virginia, protests the Department of Health and 

Human Services (HHS), Centers for Medicare and Medicaid Services’ (CMS) 

decision to issue a task order to Health Integrity, LLC, of Easton, Maryland, instead 

of Cognosante, under request for task order proposals (RTOP) No. CMS-11-AUDITTO2R, due to an alleged organizational conflict of interest (OCI) on the part of 

Cognosante. Cognosante asserts that the agency’s determination of an OCI and 

rejection of its proposed mitigation plan were unreasonable. 

We deny the protest. 

BACKGROUND

Cognosante holds one of five indefinite-delivery, indefinite-quantity (ID/IQ) CMS 

contracts for auditing services supporting the integrity of the Medicaid program. The 

DOCUMENT FOR PUBLIC RELEASE

The decision issued on the date below was subject to 

a GAO Protective Order. This redacted version has 

been approved for public release.
Page 2 B-405868 

RTOP here was for Medicaid audit responsibilities covering 11 states (Regions VI 

and VIII), including North Dakota. Under the ID/IQ contract and resulting task orders 

(TOs), Medicaid Integrity Contractors (Audit MIC) perform audits of Medicaid claims 

from individual practitioners, institutional practitioners, pharmacies, etc., in order to 

prevent or detect Medicaid fraud, waste, and abuse; identify overpayments; 

decrease submission, processing, and payment of inappropriate claims; recommend 

appropriate administrative actions to ensure appropriate and accurate payments; 

and support the recovery of overpayments. The audit targets are supplied by other 

CMS review contractors, as vetted by the CMS-Medicaid Integrity Group, while 

payment for work under an Audit MIC TO is based on reimbursement of the 

contractor’s costs plus an award fee based on overall performance. 

In addition to the CMS program, individual states, such as North Dakota, engage 

recovery audit contractors (RAC). RACs and Audit MICs perform the same basic 

types of audits and must possess the same basic skill set for that performance. 

However, unlike CMS Audit MICs, state RACs themselves determine which claims 

will be audited, and are expected to pursue all Medicaid claim types which contain 

improper payments. In addition, RACs are paid on the basis of a contingency fee 

based on the amount of overpayments identified for recoupment, rather than on the 

cost-plus-award-fee basis used to compensate CMS Audit MICs. The record, 

however, indicates that state RACs will be prohibited from auditing claims that have 

already been audited or that are currently being audited by another entity, while 

CMS Audit MICs are prohibited from performing an investigation that a RAC has 

already begun. Agency Report (AR) at 2; Cognosante Comments at 12. 

The CMS ID/IQ contract here included the following provision on conflicts of interest: 

In addition to the organizational and consultant conflicts of interest 

stated in FAR [Federal Acquisition Regulation] Subpart 9.5, [t]he 

contractor shall be able to mitigate any of the following potential or 

apparent conflict[s] of interest, subject to CMS’ approval. . . . The 

contractor has a conflict of interest if it: . . . [c]onducts audits of health 

benefit payments or cost reports of Medicaid providers assigned to be 

audited.

ID/IQ Contract § H.5 at 41-42. In addition, the RTOP statement of work (SOW) 

provides that if an Audit MIC “foresees an actual or potential conflict of interest in the 

performance” of the TO, “it must identify the actual or potential conflict and submit a 

mitigation plan.” RTOP SOW at 17. In this regard, Audit MICs are required to 

submit an OCI certificate with any bid or proposal in response to a CMS solicitation 

and 45 days prior to any change in the information already submitted. ID/IQ 

Contract § H.5(e) at 43-44. 

Cognosante submitted a RAC proposal in response to a North Dakota solicitation 

prior to the May 31, 2011 RAC closing date, and submitted a TO proposal under the 
Page 3 B-405868 

Audit MIC RTOP prior to June 9. On August 1, Cognosante was awarded a RAC 

contract by North Dakota. On August 12, CMS opened discussions with 

Cognosante, Health Integrity, and a third offeror, ultimately leading to CMS 

notification to Cognosante on September 21 that it intended to issue it a TO as Audit 

MIC for Regions VI and VIII, which include North Dakota. 

In response to the CMS notification, Cognosante questioned some of the TO 

clauses, and informed the contracting officer that it intended to submit a mitigation 

plan addressing a perceived OCI regarding its recently awarded North Dakota RAC 

contract. Cognosante submitted its mitigation plan to CMS on September 23. While

Cognosante maintained in its plan that there was no conflict between its state RAC 

and CMS Audit MIC roles, it noted that it nevertheless was submitting the mitigation 

plan to “address the possibility that the scope of the audits could overlap and the 

RAC contract(s) could provide an incentive to report fraud discovered in the course 

of the Audit MIC contract under the RAC contract rather than the Audit MIC 

Contract.” Mitigation Plan at 2. In this regard, Cognosante’s mitigation plan outlined 

procedures whereby it would separate or “firewall” the RAC team from the Audit MIC 

team, and otherwise would prevent disclosure from the RAC team to the Audit MIC 

team of sensitive provider information (SPI) concerning pending or ongoing audits 

and reviews. Id. at 2-3. 

The contracting officer, with the assistance of other agency officials, reviewed the 

mitigation plan, determined that the firewall was inadequate to mitigate the apparent 

OCI, and on September 27 informed Cognosante of this decision and provided it an 

opportunity to submit an acceptable plan. Contracting Officer’s Statement (COS) 

¶¶ 14-15. When Cognosante asked what type of mitigation plan it should submit, 

the contracting officer responded that it was not up to the agency to so advise the 

firm. Id. ¶ 16. When asked whether the firm was prepared to submit an acceptable 

plan, Cognosante replied that it thought its current plan was acceptable. Id. After 

consulting with legal counsel, the contracting officer decided to exclude Cognosante 

from consideration and instead issued the TO to Health Integrity. This protest 

followed. 

DISCUSSION

Cognosante asserts that the agency unreasonably concluded that its state RAC and 

CMS Audit MIC roles would result in an “impaired objectivity” OCI. In this regard, 

the protester asserts that the agency unreasonably concluded that a firewall would 

not address the perceived OCI. 

The responsibility for determining whether a conflict exists rests with the procuring 

agency. Aetna Gov’t Health Plans, Inc.; Foundation Health Fed. Servs., Inc., 

B-254397.15 et al., July 27, 1995, 95-2 CPD ¶ 129 at 12. In making this 

determination, the FAR expressly directs contracting officers to examine the 

particular facts associated with each situation, paying consideration to the nature of 
Page 4 B-405868 

the contracts involved, and further directs contracting officers to obtain the advice of 

counsel and appropriate technical specialists before exercising their own sound 

discretion in determining whether an OCI exists. FAR §§ 9.504, 9.505. The FAR 

identifies general rules and cites examples of types of OCIs that may arise, and 

ways to avoid, neutralize, or mitigate those OCIs. FAR § 9.505. The general rules 

and examples, however, are not intended to be all-inclusive, and the FAR 

recognizes that “[c]onflicts may arise in situations not expressly covered in this 

section 9.505 or in the examples in 9.508.” Id.; see also, Lucent Techs. World 

Servs. Inc., B-295462, Mar. 2, 2005, 2005 CPD ¶ 55 at 4-6. In reviewing bid 

protests that challenge an agency’s conflicts determinations, the Court of Appeals 

for the Federal Circuit has mandated application of the “arbitrary and capricious”

standard established pursuant to the Administrative Procedures Act. See Axiom 

Res. Mgmt, Inc. v. United States, 564 F.3d 1374, 1381 (Fed. Cir. 2009). In Axiom, 

the Court of Appeals noted that “the FAR recognizes that the identification of OCIs, 

and the evaluation of mitigation proposals are fact-specific inquiries that require the 

exercise of considerable discretion.” Id. The standard of review employed by this 

Office in reviewing a contracting officer’s OCI determination mirrors the standard 

required by Axiom. In this regard, where an agency has given meaningful 

consideration to whether an OCI exists, we will not substitute our judgment for the 

agency’s, absent clear evidence that the agency’s conclusion is unreasonable. 

CIGNA Gov’t Servs., LLC, B-401068.4, B-401068.5, Sept. 9, 2010, 2010 CPD ¶ 230 

at 12.

Here, based on our review of the record, we find that the contracting officer gave 

meaningful consideration to whether an OCI exists, reasonably determining that 

Cognosante in fact would have an unmitigated OCI if awarded the TO. First, 

contrary to Cognosante’s assertions, serving as both the North Dakota RAC and the 

CMS Audit MIC with responsibility for North Dakota plainly created a potential OCI. 

In this regard, the protester’s own CMS ID/IQ contract specifically identified as a 

conflict the contractor conducting audits of health benefit payments or cost reports of 

Medicaid providers already assigned to be audited. ID/IQ Contract § H.5. 

Second, the contracting officer determined that the potential OCI could not be 

adequately mitigated. Upon receiving notice of Cognosante’s identified conflict and 

its proposed firewall-based mitigation plan, the contracting officer discussed the 

matter and obtained review by agency subject matter experts as well as legal 

counsel. Memorandum to File, Sept. 29, 2011; AR at 5. As part of this review, the 

contracting officer was concerned that the different basis under which state RACs 

and CMS Audit MICs are paid for their work could result in an impaired objectivity 

type of OCI on the part of the Audit MIC, with that contractor having an incentive to 

audit a claim under its state contract rather than under its CMS contract. In this 

regard, the contracting officer noted that a state RAC, which reviews all potential 

claims and chooses which audits to conduct, will be paid a percentage of any 

overpayment, resulting in a potentially greater financial benefit to the contractor than 

that provided under the CMS Audit MIC TO, pursuant to which the Audit MIC is 
Page 5 B-405868 

reimbursed on a cost-plus-award-fee basis for its work. COS ¶ 10. Further, the 

agency explains that if a particular audit is performed by a state RAC, the 

government will recoup less of an overpayment than it would if the audit were 

performed by the CMS Audit MIC. AR at 4. In the contracting officer’s view, given 

these conflicting roles and the potential financial benefit to the contractor from 

conducting an audit under the RAC contract rather than the CMS contract, there 

would always be a question of where the company would place its resources in 

performing the two contracts. COS ¶ 10. Further, the contracting officer concluded 

that a firewall between Cognosante’s Audit MIC and RAC teams would not be an 

acceptable means of mitigating the apparent impaired objectivity OCI that would be 

created if Cognosante held both contracts. 

Cognosante asserts that a firewall would properly address any potential OCI. In this 

regard, it explains that it has no control over which audits CMS would assign it to 

perform, and notes that once an audit is begun by either the RAC or the Audit MIC, 

another contractor is prohibited from re-auditing the claim. Cognosante Comments 

at 11-12. Thus, it maintains that only if there were some exchange of information 

between the RAC and Audit MIC employees--that is, only if there were an active 

collusion between the two groups of its employees--would there be any conflict, but 

that the proposed firewall would mitigate any such conflict. Id. at 16. 

We find the contracting officer’s position regarding the proposed firewall to be 

reasonable. In this regard, we have found that a firewall arrangement is virtually 

irrelevant to an OCI involving potentially impaired objectivity. Nortel Gov’t Solutions, 

Inc., B-299522.5, B-299522.6, Dec. 30, 2008, 2009 CPD ¶ 10 at 6. This is because 

the conflict at issue pertains to the organization, and not the individual employees. 

Here, while the firewall proposed by Cognosante may create the appearance of 

separation to mitigate the OCI, the fact remains that personnel in both the RAC and 

Audit MIC roles will be working for the same organization with the same incentive to 

benefit Cognosante overall. Thus, the RAC contract staff would have an incentive to 

identify and commence audits on those North Dakota claims with the largest 

potential for overpayment before they could be identified by CMS, with the result that 

the government would realize a smaller return when recovering the overpayment, 

and the CMS Audit MIC staff would have an incentive to permit the RAC contract 

staff to capture such claims first. Although a firewall between the RAC and Audit 

MIC staff may make such gaming of the system more difficult, we find reasonable 

the contracting officer’s determination that the concerns associated with the OCI 

extend beyond individual employees sharing information, and that the different, 

conflicting roles Cognosante would have, if it held both the RAC and Audit MIC 

contracts, would always call into question how the company would approach 

contract performance, including where it would place its resources. COS ¶ 10. 

While Cognosante disagrees with the contracting officer’s conclusions with respect 

to the conflict between the different roles, it has not shown that the contracting 
Page 6 B-405868 

officer’s judgment here reflects an abuse of discretion. Valdez Int’l Corp., 

B-402256.3, Dec. 29, 2010, 2011 CPD ¶ 13 at 6.1

Our conclusion is not changed by Cognosante’s assertions that it was not provided 

sufficient information on the agency’s reasons for rejecting its plan, and that the 

agency did not take sufficient time to resolve the matter, opting instead to issue the 

TO prior to the end of the fiscal year. Protest at 8-9. In our view, Cognosante was 

responsible for preparing an adequate mitigation plan, and the contracting officer’s 

explanation that the proposed firewall to address the perceived OCI was inadequate, 

along with her invitation to submit a revised plan, were sufficient to place the 

protester on notice that it needed to revise its solution. As to the alleged lack of time 

devoted to consideration and review of the OCI, the responsibility lies primarily with 

Cognosante and its delay of 7 weeks (from award of the RAC contract) before 

providing notice of the OCI to CMS, contrary to the provisions of its ID/IQ contract, 

ID/IQ Contract § H.5(e) at 43-44. In sum, we see nothing unreasonable in the 

agency’s handling of Cognosante’s OCI. 

The protest is denied. 

Lynn H. Gibson

General Counsel

 1 While not highlighted by the agency, we note that Cognosante’s OCI is potentially 

more far reaching than a single state RAC contract. [Deleted].