|
| |
DEPARTMENT OF HEALTH AND HUMAN SERVICES
CFDA 93.778 MEDICAL ASSISTANCE PROGRAM (Medicaid; TITLE XIX) Note: In accordance with OMB Circular A-133, §___.525(c)(2), when the auditor is using the
risk-based approach for determining major programs, the auditor should consider that HHS has
identified the Medicaid Assistance Program as a program of higher risk. While not precluding an
auditor from determining that the Medicaid Cluster qualifies as a low-risk program (e.g., because
prior audits have shown strong internal controls and compliance with Medicaid requirements), this
identification by HHS should be considered as part of the risk assessment process.
I. PROGRAM OBJECTIVES
Medical Assistance Program
The objective of the Medical Assistance Program (Medicaid or Title XIX of the Social Security
Act, as amended, (42 USC 1396, et seq.)) is to provide payments for medical assistance to
low-income persons who are age 65 or over, blind, disabled, or members of families with
dependent children or qualified pregnant women or children.
State Medicaid Fraud Control Units
The objective of the State Medicaid Fraud Control Units is to control provider fraud in the
Medicaid program. The State Medicaid Fraud Control Unit's grant application contains the
organization, administration, agreements, and procedures for the unit. Federal requirements are
contained in 42 CFR part 1007. This unit is separate and distinct from the State Medicaid agency.
State Survey and Certification of Health Care Providers and Suppliers
The objective of the State Survey and Certification of Health Care Providers and Suppliers
program is to determine whether the providers and suppliers of health care services under the
Medicaid program are in compliance with regulatory health and safety standards and conditions of
participation. This program is administered in a manner similar to Medicaid and includes an
approved State plan which addresses Federal requirements.
Even though the State Medicaid Fraud Control Units and State Survey and Certification of Health
Care Providers and Suppliers have substantially less Federal expenditures than the Medicaid
Assistance Program, they are clustered with Medicaid because these programs provide significant
controls over the expenditures of Medicaid funds. It is unlikely that the expenditures for these
two programs would be material to the Medicaid cluster, however noncompliance with the
requirements to administer these controls may be material.
II. PROGRAM PROCEDURES
The following paragraphs are intended to provide a high-level, overall description of how
Medicaid generally operates. It is not practical to provide a complete description of program
procedures because Medicaid operates under both Federal and State laws and regulations and
States are afforded flexibility in program administration. Accordingly, the following paragraphs
are not intended to be used in lieu of or as a substitute for the Federal and State laws and
regulations applicable to this program.
Authoritative Sources
The auditor is expected to use the applicable laws and regulations (including the applicable State
approved plan) when auditing this program. The Federal law that authorizes these programs is
Title XIX of the Social Security Act (Title XIX), enacted in 1965 and subsequently amended (42
USC 1396, et seq.). The Federal regulations applicable to the Medicaid program are found in 42
CFR parts 430 through 456, 1002, and 1007.
Administration
The U.S. Department of Health and Human Services' (HHS) Health Care Financing Administration (HCFA) administers the Medicaid program in cooperation with State governments. The Medicaid program is jointly financed by the Federal and State governments and administered by the States. For purposes of this program, the term "State" includes the 50 States, the District of Columbia, and five U.S. territories: Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands. Medicaid operates as a vendor payment program, with States paying providers of medical services directly. Participating providers must accept the Medicaid reimbursement level as payment in full. Within broad Federal rules, each State decides eligible groups, types and range of services, payment levels for services, and administrative and operating procedures. State Plans
States administer the Medicaid program under a State plan approved by HCFA. The Medicaid
State plan is a comprehensive written statement submitted by the State Medicaid agency
describing the nature and scope of its Medicaid program. A State plan for Medicaid consists of
preprinted material that covers the basic requirements, and individualized content that reflects the
characteristics of each particular State's program. The State plan is referenced to the applicable
Federal regulation for each requirement and will also contain references to applicable State
regulations.
The State plan contains all information necessary for HCFA to determine whether the State plan
can be approved to serve as a basis for determining the level of Federal financial participation in
the State program. The State plan must specify a single State agency (hereinafter referred to as
the "State Medicaid agency") established or designated to administer or supervise the
administration of the State plan. The State plan must also include a certification by the State
Attorney General which cites the legal authority for the State Medicaid agency to determine
eligibility.
The State plan also specifies the criteria for determining the validity of payments disbursed under
the Medicaid program. This encompasses the system the State will use to ensure that payments
are disbursed only to eligible providers for appropriately-priced services that are covered by the
Medicaid program and provided to eligible beneficiaries. Payments must also be based on claims
that are adequately supported by medical records, and payments not be duplicated.
A State plan or plan amendment will be considered approved unless HCFA sends the State
written notice of disapproval or a request for additional information within 90 days after receipt of
the State plan or plan amendment. Copies of the State plan are available from the State Medicaid
agency.
Waivers
The State Medicaid agency may apply for a waiver of Federal requirements. Waivers are intended
to provide the flexibility needed to enable States to try new or different approaches to the efficient
and cost-effective delivery of health care services, or to adapt their programs to the special needs
of particular areas or groups of beneficiaries. Waivers allow exceptions to State plan
requirements and permit a State to implement innovative programs or activities on a time-limited
basis, and are subject to specific safeguards for the protection of beneficiaries and the program.
Actions that States may take if waivers are obtained include: (1) implement a primary care
case-management system or a specialty physician system; (2) designate an entity to act as a central
broker in assisting Medicaid beneficiaries to choose among competing health care plans; (3) share
with beneficiaries (through the provision of additional services) cost-savings made possible
through the beneficiaries' use of more cost effective medical care; (4) limit beneficiaries' choice of
providers to providers that fully meet reimbursement, quality, and utilization standards, which are
established under the State plan and are consistent with access, quality, and efficient and
economical furnishing of care; (5) include as "medical assistance," under its State plan, home and
community-based services furnished to beneficiaries who would otherwise need inpatient care that
is furnished in a hospital, skilled nursing facility (SNF), or intermediate care facility (ICF), and is
reimbursable under the State plan; and, (6) impose a deduction, cost-sharing or similar charge of
up to twice the "nominal charge" established under the State plan for outpatient services for
certain nonemergency services. A State may also obtain a waiver of statutory requirements to
provide an array of home and community-based services which may permit an individual to avoid
institutionalization (42 CFR part 441 subpart G). Depending on the type of requirement being
waived, a waiver may be effective for initial periods ranging from two to three years, with varying
renewal periods. Copies of waivers are available from the State Medicaid agency.
Payments to States
Once HCFA has approved a State plan and waivers, it makes quarterly grant awards to the State
to cover the Federal share of Medicaid expenditures for services, training, and administration.
The amount of the quarterly grant is determined on the basis of information submitted by the
State Medicaid agency (in quarterly estimate and quarterly expenditure reporting). The grant
award authorizes the State to draw Federal funds as needed to pay the Federal financial
participation portion of qualified Medicaid expenditures. The HHS Payment Management System
Division of Payment Management (PMS-DPM) in Rockville, MD disburses Federal funds to
States including funding under Medicaid. Currently, all States use a system developed by HHS
called SMARTLINK to request funds on an as needed basis. States may use one of two payment
mechanisms which are linked to SMARTLINK: (1) wire transfers through the Automated
Clearinghouse in conjunction with the Federal Reserve Bank, which is settled the day after the
request date, or (2) FEDWIRE transfers through the U.S. Department of the Treasury, which is a
same day payment mechanism. The payment method is selected by the State and approved by the
U.S. Department of the Treasury and HHS before payments are made through either mechanism.
States report cash activity to PMS-DPM with a quarterly Cash Transactions Report (PMS-272).
State Expenditure Reporting
Thirty days after the end of the quarter, States electronically submit form HCFA-64 , "Quarterly
Statement of Expenditures for the Medical Assistance Program." The HCFA-64 presents
expenditures and recoveries and other items that reduce expenditures for the quarter and prior
period expenditures. The amounts reported on the HCFA-64 and its attachments must be actual
expenditures for which all supporting documentation, in readily reviewable form, has been
compiled and is available immediately at the time the claim is filed. States use the Medicaid
Budget and Expenditure System to electronically submit the HCFA-64 directly to HCFA.
Eligibility
Eligibility for Medicaid is based primarily on income and resources. The States must provide
services to mandatory categorically needy and other required special groups (e.g., individuals
receiving Aid to Families With Dependent Children (AFDC), Temporary Assistance for Needy
Families (TANF), or Supplemental Security Income (SSI)). States may provide coverage to
members of optional groups who do not receive cash assistance (e.g., individuals who would be
eligible for but are not receiving AFDC) and medically needy individuals (individuals who are
eligible for Medicaid after deducting large medical expenditures from their income). Eligibility
criteria will be specified in the individual State plan.
Under the Personal Responsibility and Work Opportunity Reconciliation Act of 1996, the cash
welfare program known as AFDC was repealed and replaced with block grants to States known
as TANF. Under the old AFDC law, children and parents who received cash welfare were
automatically enrolled in the Medicaid program. While the new law eliminates the entitlement to
welfare, access to Medicaid for children and parents who would have met the State's old AFDC
income and asset standards in place on July 16, 1996 has been preserved--whether or not these
individuals are eligible for the new TANF system (P.L. 104-193).
States must provide limited Medicaid coverage for "qualified Medicare beneficiaries." These are
aged and disabled persons who are receiving Medicare, whose income is below 100 percent of the
Federal poverty level, and whose resources do not exceed twice the allowable amount under SSI
(42 CFR section 407.40).
The State plan will specify if determinations of eligibility are made by agencies other than the
State Medicaid agency and will define the relationships and respective responsibilities of the State
Medicaid agency and the other agencies. The application process includes completing and filing
an application form, being interviewed, and having information verified. The State plan must also
provide that the State Medicaid agency will maintain individual records on each applicant and
Medicaid beneficiary including: date of application, date and basis for disposition, facts essential
to determination of initial and continuing eligibility, provision of medical assistance, and basis for
discontinuing assistance.
Services
Medicaid expenditures include medical assistance payments for eligible recipients for such services
as hospitalization, prescription drugs, nursing home stays, outpatient hospital care, and physicians'
services, and expenditures for administration and training. In order for a medical assistance
payment to be considered valid, it must comply with the requirements of Title XIX, as amended,
(42 USC 1396, et seq.) and implementing Federal regulations. Determinations of payment
validity are made by individual States in accordance with approved State plans under broad
Federal guidelines.
Some States have managed care arrangements under which the State enters into a contract with
an entity, such as an insurance company, to arrange for medical services to be available for
beneficiaries. The State pays a fixed rate per person (capitation rate) without regard to the actual
medical services utilized by each beneficiary.
Also, Medicaid expenditures include administration and training, the State Survey and
Certification Program, and State Medicaid Fraud Control Units.
Control Systems
Utilization Control and Program Integrity
The State plan must provide methods and procedures to safeguard against unnecessary utilization
of care and services, including those provided by long term care institutions. In addition, the
State must have: (1) methods of criteria for identifying suspected fraud cases; (2) methods for
investigating these cases; and, (3) procedures, developed in cooperation with legal authorities, for
referring suspected fraud cases to law enforcement officials.
These requirements may be met by the State Medicaid agency assuming direct responsibility for
assuring the requirements or met by contracting with a peer review organization (PRO) to
perform such reviews. The reviewer must establish and use written criteria for evaluating the
appropriateness and quality of Medicaid services.
The State Medicaid agency must have procedures for the ongoing post-payment review, on a
sample basis, for the necessity, quality, and timeliness of Medicaid services. The State Medicaid
agency may conduct this review directly or may contract with a PRO.
Suspected fraud identified by utilization control and program integrity should be referred to the
State Medicaid Fraud Control Units.
Inpatient Hospital and Long Term Care Facility Audits
States are required to establish as part of the State plan standards and methodology for
reimbursing inpatient hospital and long term care facilities based on payment rates that represent
the cost to efficiently and economically operate such facilities and provide Medicaid services. The
State Medicaid agency must provide for the filing of uniform cost reports by each participating
provider. These cost reports are used by the State Medicaid agency to aid in the establishment of
payment rates. The State Medicaid agency must provide for periodic audits of the financial and
statistical records of the participating providers. Such audits could include desk audits of cost
reports in addition to field audits. These audits are an important control for the State Medicaid
agency in ensuring that established payment rates are proper.
ADP Risk Analyses and System Security Reviews
The Medicaid program is highly dependent on extensive and complex computer systems that
include controls for ensuring the proper payment of Medicaid benefits. States are required to
establish a security plan for ADP systems that include policies and procedures to address: (1)
physical security of ADP resources; (2) equipment security to protect equipment from theft and
unauthorized use; (3) software and data security; (4) telecommunications security; (5) personnel
security; (6) contingency plans to meet critical processing needs in the event of short or long term
interruption of service; (7) emergency preparedness; and, (8) designation of an agency ADP
security manager.
State agencies must establish and maintain a program for conducting periodic risk analyses to
ensure appropriate, cost effective safeguards are incorporated into new and existing systems.
State agencies must perform risk analyses whenever significant system changes occur. On a
biennial basis State agencies shall review the ADP system security of installations involved in the
administration of HHS programs. At a minimum, the reviews shall include an evaluation of
physical and data security operating procedures, and personnel practices.
Medicaid Management Information System (MMIS)
The MMIS is the mechanized Medicaid benefit claims processing and information retrieval system
that States are required to have, unless this requirement is waived by the Secretary of HHS. HHS
provides general systems guidelines (42 CFR sections 433.110 through 433.131) but it does not
provide detailed system requirements or specifications for States to use in the development of
MMIS systems. As a result, MMIS systems will vary from State to State. The system may be
maintained and operated by the State or a contractor.
The MMIS is normally used to process payments for most medical assistance services and
normally includes edits and controls which identify unusual items for follow up by the utilization
control and program integrity unit. However, the State may use systems other than MMIS to
process medical assistance payments. In many cases the operation of the MMIS is contracted out
to a private contractor. The State plan will describe the administration of each State's claims
processing system.
Generally, the MMIS does not process claims from State agencies (e.g., State operated
intermediate care facility for the mentally retarded (ICF/MR)) and certain selected types of claims.
The claims payments which are not processed through MMIS may be material to the Medicaid
program.
Medicaid Eligibility Quality Control System (MEQC)
Each State is required to operate a MEQC system in accordance with requirements specified by
HCFA. This HCFA-approved system redetermines eligibility for individual sampled cases and
provides national and State measures of the accuracy of eligibility and benefit amount
determinations (commonly referred to as "payment accuracy"), including both underpayments and
overpayments, and of the correctness of decisions to deny benefits. The MEQC system reviews
the determinations of beneficiary eligibility made by a State agency, or its designee, and uses
statistical sampling methods to select claims for review and project the number and dollar impact
of payments to ineligible beneficiaries (42 CFR sections 431.800 through 431.865).
Federal Oversight and Compliance Mechanisms
HCFA oversees State operations through its organization consisting of a headquarters and 10
regional offices.
HCFA program oversight includes budget review, reviews of financial and program reports, and
on-site reviews which are normally targeted to cover a specific area of concern. HCFA conveys
areas of national and local concerns to the States through the regions. Technical assistance is
used extensively to promote improvements in State operation of the program but enforcement
mechanisms are available. HCFA considers the single audit as an important internal control in its
monitoring of States.
Federal program oversight, because of its targeted nature, should not be used as a substitute for
audit evidence gained through transaction testing.
HHS Office of Inspector General (OIG) Fraud Alerts
The HHS OIG issues fraud alerts, some of which relate to the Medicaid program. These alerts
are available on the Internet from the HHS OIG Home Page, Special Fraud Alerts section
(http://www.sbaonline.sba.gov/ignet/internal/hhs/invlist.html#sfa).
III. COMPLIANCE REQUIREMENTS
In developing the audit procedures to test compliance with the requirements for a Federal
program, the auditor should first look to Part 2, Matrix of Compliance Requirements, to
identify which of the 14 types of compliance requirements described in Part 3 are
applicable and then look to Parts 3 and 4 for the details of the requirements.
General Audit Approach for Medicaid Payments
To be allowable, Medicaid costs for medical services must be: (1) covered by the State plan and
waivers; (2) for an allowable service rendered (including supported by medical records or other
evidence indicating that the service was actually provided and consistent with the medical
diagnosis); (3) properly coded; and, (4) paid at the rate allowed by the State plan. Additionally,
Medicaid costs must be net of applicable credits (e.g., insurance, recoveries from other third
parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible
providers, and only provided on behalf of eligible individuals.
Due to the complexity of Medicaid program operations, it is unlikely the auditor will be able to
support an opinion that Medicaid expenditures are in compliance with applicable laws and
regulations (e.g., are allowable under the State plan) without relying upon the systems and
internal controls.) Examples of complexities include:
- Dependence upon large and complex ADP systems to process the large volume of Medicaid transactions. - Medical services are provided directly to an eligible beneficiary, normally without prior approval by the State. - Medical service providers normally determine the scope and medical necessity of the services. - Notice to the State that service is rendered is after-the-fact when a bill is sent. - Payments systems do not include a review of original detailed documentation supporting the claim prior to payment. - Complex billing charge structures and payment rates for medical services, including significance of proper coding of services (e.g., billing by diagnosis related groups (DRG)). - Different types of Medicaid payments (e.g., inpatient hospital, physicians, prescription drugs and
drug rebates).
Medicaid has required control systems that should aid the auditor in obtaining sufficient audit
evidence for Medicaid expenditures. These control systems are discussed in the preceding
Program Procedures under Control Systems and are: (1) utilization control and program integrity;
(2) inpatient hospital and long term care facility audits; (3) ADP risk analyses and system security
reviews (e.g, of the MMIS); and (4) the MMIS normally includes edits and controls that identify
unusual items for follow up by the utilization control and program integrity function. The first
three are generally performed by specialists retained by the State Medicaid agency. The following
table indicates the major types of Medicaid payments to which these controls will likely relate:
Each of the above Medicaid payment types are tested for compliance with applicable laws and
regulations under either "A. Activities Allowed or Unallowed;" "B. Allowable Costs/Cost
Principles;" or "E. Eligibility." Based upon the assessed level of control risk, the auditor should
design appropriate tests of the allowability of Medicaid payments. Testing likely will include tests
of medical records, in which case the auditor should consider the need for assistance of specialists.
The auditor may consider using the same specialists used by the State.
The auditor should consider the following in planning and performing tests of controls and
compliance:
1. Section "N. Special Tests and Provisions," includes required internal control, which are
compliance requirements (i.e., controls (1), (2), and (3) above), and audit objectives and
procedures for each. The audit procedures will entail tests of work performed by the State
Medicaid agency.
2. Tests of compliance with laws and regulations relating to sections A, B, and E below, and the
compliance requirements enumerated in Section N should be coordinated.
A. Activities Allowed or Unallowed
1. Allowability of Specific Transactions and Activities
a. Funds can only be used for Medicaid benefit payments (as specified in the State plan, Federal
regulations, or an approved waiver), expenditures for administration and training, expenditures for
the State Survey and Certification Program, and expenditures for State Medicaid Fraud Control
Units (42 CFR sections 435.10, 440.210, 440.220, and 440.180).
b. Case Management Services - The State plan may provide for case management services as an
optional medical assistance service. The term case management services means services which
will assist individuals eligible under the plan in gaining access to needed medical, social,
educational, and other services.
Medicaid case management services are divided into two separate categories:
Administrative case management - Services must be identifiable with Title-XIX benefit (e.g.,
outreach services provided by public school districts to Medicaid recipients).
Medical/Targeted case management - Services must be provided to an eligible Medicaid
recipient. Services do not have to be specifically medical in nature and can include securing
shelter, personal needs, etc. (e.g., services provided by community mental health boards, county
offices of aging).
Case management services is an area of risk because of the high growth of expenditures, the relative newness of the provision that allows these expenditures to be claimed, and prior experience which indicates problems with the documentation of case management expenditures. With the exception of case management services provided through capitation (a process in which
payment is made on a per beneficiary basis) or prepaid health plans, Federal regulations typically
require the following documentation for case management services: date of service; name of
recipient; name of provider agency and person providing the service; nature, extent, or units of
service; and, place of service (P.L. 99-272, Section 9508; 42 CFR part 434).
c. Managed Care - A State may obtain a waiver of statutory requirements in order to develop a
system that more effectively addresses the health care needs of its population. For example, a
waiver may involve the use of a program of managed care for selected elements of the client
population or allow the use of program funds to serve specified populations that would be
otherwise ineligible (Sections 1115 and 1915 of the Social Security Act). Managed care
providers must be eligible to participate in the program at the time services are rendered,
payments to managed care plans should only be for eligible clients for the proper period, and the
capitation payment should be properly calculated. Medicaid medical services payments (e.g.,
hospital and doctors charges) should not be made for services that are covered by managed care.
States should ensure that capitated payments to providers are discontinued when a benificiary is
no longer enrolled for services. Requirements related to beneficiaries' access to managed care
services are covered under N.6., Special Tests and Provisions, Managed Care.
d. Medicaid Health Insurance Premiums - A State may enroll certain Medicare-eligible recipients
under Medicare Part B and pay the premium, deductibles, cost sharing, and other charges (42
CFR section 431.625).
e. Disproportionate Share Hospital - Federal financial participation is available for aggregate
payments to hospitals that serve a disproportionate number of low income patients with special
needs. The State plan must specifically define a disproportionate share hospital and the method of
calculating the rate for these hospitals. Specific limits for the total disproportionate share
hospital payments for the State and the individual hospitals are contained in the legislation
(Section 1923 of the Social Security Act and 42 USC 1396(r)).
f. Home Health Care - A State may obtain a waiver of statutory requirements to provide an array
of home and community-based services which may permit an individual to avoid
institutionalization (42 CFR part 441 subpart G). The HHS OIG has issued a special fraud alert
concerning home health care. Problems noted include cost report frauds, billing for excessive
services or services not rendered, and use of unlicensed staff. The full alert was published in the
Federal Register on August 10, 1995 (page 40847) and is available on the Internet from the HHS
OIG Home Page, Special Fraud Alerts section
(http://www.sbaonline.sba.gov/ignet/internal/hhs/invlist.html#sfa).
2. Allowability of Activities for Subrecipients - Normally this is not applicable because most
States do not use subrecipients in the Medicaid program. However, if a State uses a subrecipient
for Medicaid, this may be applicable.
B. Allowable Costs/Cost Principles
Recoveries, Refunds, and Rebates (Costs must be the net of all applicable credits)
1. States must have a system to identify medical services that are the legal obligation of third
parties, such as private health or accident insurers. Such third party resources should be
exhausted prior to paying claims with program funds. Where a third party liability is established
after the claim is paid, reimbursement from the third party should be sought (42 CFR sections
433.135 through 433.154).
2. The State is required to credit the Medicaid program for (1) State warrants that are canceled
and uncashed checks beyond 180 days of issuance (escheated warrants) and (2) overpayments
made to providers of medical services within specified time frames. In most cases, the State must
refund provider overpayments to the Federal Government within 60 days of identification of the
overpayment, regardless of whether the overpayment was collected from the provider (42 CFR
sections 433.300 through 433.320 and 433.40).
3. Section 1903 (w)(1) of the Social Security Act (as amended by P.L. 102-234) provides that,
effective January 1, 1992, before calculating the amount of Federal financial participation, certain
revenues received by a State will be deducted from the State's medical assistance expenditures.
The revenues to be deducted are (1) donations made by health providers and entities related to
providers (except for bona fide donations and, subject to a limitation, donations made by
providers for the direct costs of out stationed eligibility workers); and (2) impermissible health
care-related taxes that exceed a specified limit ( 42 USC 1396(b)(w) and 42 CFR section 433.57).
"Provider related donations" are any donations or other voluntary payments (in-cash or in-kind)
made directly or indirectly to a State or unit of local government by (1) a health care provider, (2)
an entity related to a health care provider, or (3) an entity providing goods or services under the
State plan and paid as administrative expenses. "Bona fide provider-related donations" are
donations that have no direct or indirect relationship to payments made under Title XIX (42 USC
1396, et seq.) to (1) that provider, (2) providers furnishing the same class of items and services as
that provider, or (3) any related entity (42 CFR sections 433.58(d) and 433.66(b)).
Permissible health care-related taxes are those taxes which are broad-based taxes, uniformly
applied to a class of health care items, services, or providers, and which do not hold a taxpayer
harmless for the costs of the tax, or a tax program for which HCFA has granted a waiver. Health
care-related taxes that do not meet these requirements are impermissible health care-related taxes
(42 CFR section 433.68(b)).
The provisions of P.L. 102-234 apply to all 50 States and the District of Columbia, except those
States whose entire Medicaid program is operated under a waiver granted under section 1115 of
the Social Security Act (42 CFR part 433; Federal Register published August 13, 1993, 58 FR
43156-43183).
4. Section 1927 of the Social Security Act allows States to receive rebates for drug purchases the
same as other payers receive. Drug manufacturers are required to provide a listing to HCFA of
all covered outpatient drugs and, on a quarterly basis, are required to provide their average
manufacturer's price and their best prices for each covered outpatient drug. Based upon these
data, HCFA calculates a unit rebate amount for each drug which it then provides to States. No
later than 60 days after the end of the quarter, the State Medicaid agency must provide to
manufactures drug utilization data. Within 30 days of receipt of the utilization data from the
State, the manufacturers are required to pay the rebate or provide the State with written notice of
disputed items not paid because of discrepancies found.
E. Eligibility
1. Eligibility for Individuals
The State Medicaid agency or its designee is required to determine client eligibility in accordance
with eligibility requirements defined in the approved State plan (42 CFR section 431.10). States
have a high degree of flexibility in designating who will determine eligibility.
The State is required to operate a MEQC system in accordance with requirements specified by HCFA. The MEQC system reviews the determinations of beneficiary eligibility made by State Medicaid agencies, or their designee, and uses statistical sampling methods to select claims for review and project the number and dollar impact of incorrect payments to ineligible beneficiaries (42 CFR sections 431.800 through 431.865). As discussed in the General Audit Approach for Medicaid Payments, the auditor will likely
combine Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Eligibility
testing. Therefore, compliance requirements related to amounts provided to or on behalf of
eligibles were combined with Activities Allowed or Unallowed.
1. Eligibility of Group of Individuals or Area of Service Delivery - Not Applicable
2. Eligibility for Subrecipients - Not Applicable
G. Matching, Level of Effort, Earmarking
1. Matching
The State is required to pay part of the costs of providing health care to the poor and part of the
costs of administering the program. Different State participation rates apply to medical assistance
payments. There are also different Federal financial participation rates for the different types of
costs incurred in administering the Medicaid program, such as administration, family planning,
training, computer, and other costs (42 CFR sections 433.10 and 433.15). The auditor should
refer to the State plan for the matching rates.
2. Level of Effort
A State waiver may contain a level of effort requirement.
3. Earmarking
A State waiver may contain an earmarking requirement.
L. Reporting
1. Financial Reporting
a. SF-269, Financial Status Report - Not applicable b. SF-270, Request for Advance or Reimbursement - Not applicable c. SF-271, Outlay Report and Request for Reimbursement for Construction Program - Not applicable d. SF-272, Federal Cash Transaction Report - Not applicable
e. HCFA-64, Quarterly Statement of Expenditures for the Medical Assistance Program (OMB
No. 0938-0067) - Required to be used in lieu of the Financial Status Report (FSR) SF-269 and is
required to be prepared quarterly and submitted electronically to HCFA within 30 days after the
end of the quarter.
f. PMS-272, Quarterly Cash Transactions Report (OMB No. 0937-0200) - Required in lieu of the
Federal Cash Transaction Report (SF-272).
2. Performance Reporting - Not Applicable
3. Special Reporting - Not Applicable
N. SPECIAL TESTS AND PROVISIONS
1. Utilization Control and Program Integrity
Compliance Requirements - The State plan must provide methods and procedures to safeguard
against unnecessary utilization of care and services, including long term care institutions. In
addition, the State must have: (1) methods or criteria for identifying suspected fraud cases; (2)
methods for investigating these cases; and, (3) procedures, developed in cooperation with legal
authorities, for referring suspected fraud cases to law enforcement officials (42 CFR parts 455,
456, and 1002).
Suspected fraud should be referred to the State Medicaid Fraud Control Units (42 CFR part
1007).
The State Medicaid agency must establish and use written criteria for evaluating the
appropriateness and quality of Medicaid services. The agency must have procedures for the
ongoing post-payment review, on a sample basis, of the need for and the quality and timeliness of
Medicaid services. The State Medicaid agency may conduct this review directly or may contract
with a PRO.
Audit Objectives - To determine whether the State has established and implemented procedures
to (1) safeguard against unnecessary utilization of care and services, including long term care
institutions, (2) identify suspected fraud cases, (3) investigate these cases, and (4) refer those
cases with sufficient evidence of suspected fraud cases to law enforcement officials.
Suggested Audit Procedures
a. Obtain and evaluate the adequacy of the procedures used by the State Medicaid agency to
conduct utilization reviews and identifying suspected fraud.
1. Consider the qualifications of the personnel conducting the reviews and identifying suspected
fraud. Ascertain that the individuals possess the necessary skill or knowledge by considering the
following: (1) professional certification, license, or specialized training; (2) the reputation and
standing of licensed medical professionals in the view of peers; and, (3) experience in the type of
tasks to be performed.
2. Consider the personnel performing the utilization review and identifying suspected fraud are
sufficiently organized outside the control of other Medicaid operations to objectively perform
their function.
3. Ascertain if the sampling plan implemented by the State Medicaid agency or the PRO was
properly designed and executed.
b. Test a sample of the cases examined by State Medicaid agency or the PRO and ascertain if such
examinations were in accordance with the agency's procedures.
c. Test a sample of the identified suspected cases of fraud and ascertain if the agency took
appropriate steps to investigate and, if appropriate, make a referral.
d. Based on the above procedures, consider the degree of reliance that can be placed on the
utilization review and identification of suspected fraud in performing tests under sections A, B,
and E.
2. Inpatient Hospital and Long-Term Care Facility Audits
Compliance Requirement - The State Medicaid agency pays for inpatient hospital services and
long term care facility services through the use of rates that are reasonable and adequate to meet
the costs that must be incurred by efficiently and economically operated providers. The State
Medicaid agency must provide for the filing of uniform cost reports for each participating
provider. These cost reports are used to establish payment rates. The State Medicaid agency
must provide for the periodic audits of financial and statistical records of participating providers.
The specific audit requirements will be established by the State Plan (42 CFR section 447.253).
Audit Objectives - To determine whether the State Medicaid agency performed inpatient
hospital and long term care facility audits as required.
Suggested Audit Procedures
a. Review the State Plan and State Medicaid agency operating procedures and document the types
of audits performed (e.g., desk audits, field audits) and the methodology for determining when
audits are conducted, and the objectives and procedures of the audits.
b. Through examination of documentation, ascertain that the sampling plan was carried out as
planned.
c. Select a sample of audits and ascertain if the audits were in compliance with the State Medicaid
agency's audit procedures.
d. Based on the above, consider the degree of reliance that can be placed on the inpatient hospital
and long term care facility audits in performing tests under sections A, B, and E.
3. ADP Risk Analysis and System Security Review
Compliance Requirement - State agencies must establish and maintain a program for conducting
periodic risk analyses to ensure that appropriate, cost effective safeguards are incorporated into
new and existing systems. State agencies must perform risk analyses whenever significant system
changes occur. State agencies shall review the ADP system security installations involved in the
administration of HHS programs on a biennial basis. At a minimum, the reviews shall include an
evaluation of physical and data security operating procedures, and personnel practices. The State
agency shall maintain reports on its biennial ADP system security reviews, together with pertinent
supporting documentation, for HHS onsite reviews (45 CFR section 95.621).
Audit Objective - To determine whether the State Medicaid agency has performed the required
ADP risk analyses and system security reviews.
Suggested Audit Procedures
a. Review the State Medicaid agency's policies and procedures and document the frequency,
timing, and scope of ADP security reviews. This should include any reviews following Statement
on Auditing Standards No. 70 (SAS 70) which may have been performed on outside processors.
b. Consider the appropriateness and extent of reliance on such reviews based on the qualifications
of the personnel performing the risk analyses and security reviews and their organizational
independence from the ADP systems.
c. Review the work performed during the most recent risk analysis and security review.
d. Based on the above, consider the degree of reliance that can be placed on the ADP Risk
Analysis and System Security Reviews in performing tests under sections A, B, and E.
4. Provider Eligibility
Compliance Requirement - In order to receive Medicaid payments, providers of medical
services furnishing services must be licensed in accordance with Federal, State, and local laws and
regulations to participate in the Medicaid program (42 CFR sections 431.107 and 447.10; and
section 1902(a)(9) of the Social Security Act) and the providers must make certain disclosures to
the State (42 CFR subpart B).
Audit Objective - To determine whether providers of medical services are licensed to participate
in the Medicaid program in accordance with Federal, State, and local laws and regulations, and
whether the providers have made the required disclosures to the State.
Suggested Audit Procedures
a. Obtain an understanding of the State plan's provisions for licensing and entering into
agreements with providers.
b. Select a sample of providers receiving payments and ascertain if:
(1) The provider is licensed in accordance with the State Plan.
(2) The agreement with the provider complies with the requirements of the State Plan, including
the disclosure requirements of 42 CFR 455 subpart B.
5. Provider Health and Safety Standards
Compliance Requirement - Providers must meet the prescribed health and safety standards for
hospital, nursing facilities, and ICF/MR (42 CFR part 442). The standards may be modified in the
State plan.
Audit Objective - To determine whether the State ensures that hospitals, nursing facilities, and
ICF/MR that serve Medicaid patients meet the prescribed health and safety standards.
Suggested Audit Procedures
a. Obtain an understanding of the State Plan provisions which ensure that payments are made only
to institutions which meet prescribed health and safety standards.
b. Select a sample of payments for each provider type (i.e., hospitals, nursing facilities, and
ICF/MR) and ascertain if the State Medicaid agency has documentation that the provider has met
the prescribed health and safety standards.
6. Managed Care
Compliance Requirement - A State may obtain a waiver of statutory requirements in order to
develop a system that more effectively addresses the health care needs of its population. A waiver
may involve the use of a program of managed care for selected elements of the client population
or allow the use of program funds to serve specified populations that would be otherwise
ineligible (Sections 1115 and 1915 of the Social Security Act).
Audit Objective - To determine whether the State is operating managed care in compliance with
the approved State plan waiver.
Suggested Audit Procedures
a. Obtain an understanding of the State plan's managed care waiver.
b. Perform tests to ascertain if the State has a system to handle beneficiary complaints of not
receiving necessary care and provider complaints of not receiving payments for services provided
to Medicaid recipients.
c. Perform tests to ascertain if the State has a system to ensure beneficiaries have adequate access to health care from managed care organizations which are being paid premiums on the beneficiaries' behalf.
The Budget | Legislative Information | Management Reform/GPRA |