(a) Pursuant to Public Health Law section 4414, every MCO that participates in public or government sponsored programs with an enrolled population of 10,000 or more persons in the aggregate in any given year shall develop and file with the commissioner within 180 days of the effective date of these regulations a plan for the detection, investigation and prevention of fraudulent activities in this State and those fraudulent and abusive activities affecting policies or State or local department of social services contracts issued or issued for delivery in this State. The plan must include written policies, procedures and standards of conduct that are distributed to all affected employees and appropriate delegated entities, and that articulate the MCO's commitment to comply with all applicable Federal and State standards and identify and address specific areas of risk and vulnerability. The MCO must designate an officer or director who has responsibility and authority for carrying out provisions of the plan, and who reports directly to senior management. Any MCO that has filed and implemented such a plan with the superintendent in compliance with section 409 of the Insurance Law is exempt from the requirements of this section.

1. (1) For the purposes of this section, fraud means any type of intentional deception or misrepresentation made by a person with the knowledge that the deception could result in some unauthorized benefit to himself or some other person in a managed care setting, including any act that constitutes fraud under applicable Federal or State law, committed by an MCO, contractor, subcontractor, provider, beneficiary or enrollee or other person(s). A provider includes any individual or entity that receives funds in exchange for the provision, or arranging for the provision, of health care services to an MCO enrollee.
2. (2) For the purposes of this section, abuse means provider practices that are inconsistent with sound fiscal, business or medical practices and result in an unnecessary cost to the State or Federal government or MCO, or in reimbursement for services that are not medically necessary or that fail to meet professionally recognized standards for health care in a managed care setting, committed by an MCO, contractor, subcontractor, provider, beneficiary or enrollee. It also includes enrollee practices that result in unnecessary cost to the State or Federal government, MCO, contractor, subcontractor or provider. For the purposes of this paragraph, provider includes any individual or entity that receives funds in exchange for providing, or arranging for the provision, of a service.

(b) A fraud and abuse prevention plan shall include the following provisions:

1. (1) the establishment of a full-time special investigation unit, separate and distinct from any other unit or function of the MCO, which shall be responsible for investigation of cases of suspected fraudulent and abusive activity and for implementation of the MCO's fraud and abuse prevention and reduction activities under the MCO's fraud and abuse prevention plan, which shall encompass activities of all contracted providers. All documents related to the activities of the special investigations unit shall be maintained for a period of not less than six years. If the MCO enters into a management contract to perform all or part of this function, the management contract shall be submitted to the department for prior approval and included as part of the fraud and abuse prevention plan. The management contract must provide for specified levels of staffing devoted to the investigation of suspected fraudulent and abusive activities. In the event that investigators employed by the management contractor will be working for more than one MCO or on cases in states other than New York, the plan must apportion and specify the percentage of the investigators' efforts which will be devoted to working for the MCO on its New York cases. The agreement shall also require that the management contractor cooperate fully with the department in any examination of the implementation of the fraud and abuse prevention plan and provide any and all assistance requested by the department, any other law enforcement agency or any prosecutorial agency in the investigation and prosecution of fraud and abuse and related crimes;
2. (2) a description of the organization of the special investigations unit, including the titles and job descriptions of the various investigators and investigative supervisors, the minimum qualifications for employment in these positions in addition to those required by this regulation, the geographical location and assigned territory of each investigator and investigative supervisor, the support staff and other physical resources, including database access available to the unit and the supervisory and reporting structure within the unit and between the unit and the senior management of the MCO. If investigators employed by the unit will be responsible for investigating cases in more than one state, the plan must apportion that percentage of the investigators' efforts which will be devoted to New York cases;
3. (3) the rationale for the level of staffing and resources being provided for the special investigations unit which may include, but is not limited to, objective criteria such as number of enrollees, number of claims received with respect to New York MCOs on an annual basis, volume of suspected fraudulent and abusive New York claims currently being detected, other factors relating to the vulnerability of the MCO to fraud and abuse, and an assessment of optimal caseload which can be handled by an investigator on an annual basis;
4. (4) a description of the relationship between the officer or director responsible for carrying out the provisions of the fraud and abuse prevention plan and the special investigations unit; between such persons and the claims, quality, utilization review and underwriting functions of the MCO; and between such persons and the department, other law enforcement agencies and prosecutors;

5. (5) procedures for detecting and preventing possible fraud and abuse, as well as procedures for case investigation and detection of patterns of repetitive fraud and abuse involving one or more MCO, including but not limited to the following areas:

   1. (i) provision of preventive services;
   2. (ii) underutilization;
   3. (iii) marketing;
   4. (iv) provision of medically necessary services;
   5. (v) assignment of a PCP; and
   6. (vi) submission of claims for services not provided;
6. (6) criteria for referral of a case to the special investigation unit for evaluation and designation of the individuals authorized to make such a referral; criteria for referral of a case to the department and designation of the individuals authorized to make such referrals; and a policy to avoid duplication of effort due to concurrent referrals by the officer, director or unit to more than one law enforcement agency;
7. (7) provisions for confidential reporting which ensure that the identity of individuals reporting violations of the MCO's standards of conduct, policies and procedures and applicable State and Federal standards, is protected. In addition, the MCO must ensure that no individual who reports such violations or suspected fraud and abuse is subjected to retaliation;
8. (8) for MCOs participating in programs authorized by title XIX, provision for the department and/or the New York State Medicaid Fraud Control Unit (MFCU) to conduct private interviews of MCO personnel, subcontractors and their personnel, witnesses, and enrollees. MCO personnel and subcontractors and their personnel must cooperate fully in making MCO personnel, subcontractors and their personnel available in person for interviews, consultation, grand jury proceedings, pre-trial conference, hearings, trial and in any other process, including investigations at the MCO's and subcontractor's own expense. In addition, the MCO must provide to the department, its authorized representatives, and/or the MFCU, originals and/or copies of all records and information requested, in the form requested, and allow access to the MCO's premises. All copies of records must be provided free of charge;
9. (9) provision for in-service training programs for investigative, claims, quality, utilization management and other personnel in identifying and evaluating instances of suspected fraud and abuse, including an introductory training session and periodic refresher sessions. This provision shall include course descriptions, the approximate number of hours to be devoted to these sessions and their frequency. In addition, the training and education required for the officer or director responsible for carrying out the provisions of the fraud and abuse prevention plan must be described;
10. (10) provision for coordination with other units of the MCO to further fraud and abuse investigations, including a periodic review of claims, underwriting, member services, utilization management and complaint procedures and forms for the purpose of enhancing the ability of the MCO to detect fraud and abuse and to increase the likelihood of its successful prosecution, and for initiation of civil actions when appropriate;
11. (11) provision for prompt response to detected offenses, and for development of corrective action initiatives;
12. (12) provision for establishment and consistent application of appropriate disciplinary policies for all employees who fail to comply with the MCO's standards of conduct, policies and procedures and applicable State and Federal standards, as well as publication and dissemination of the disciplinary policies and the range of disciplinary actions for improper conduct;
13. (13) development of a fraud and abuse awareness program, appropriate for the size of the MCO, focused on the cost and frequency of fraud and abuse, and methods by which the MCO's enrollees, providers and other contractors can prevent it;
14. (14) development of a fraud and abuse detection procedures manual for use by officers, directors, managers, and claims, underwriting, member services, utilization management, complaint, and investigative personnel; and
15. (15) the timetable for the implementation of the fraud and abuse prevention plan, provided however, that the period preceding implementation shall not exceed six months from the date the plan is submitted.

(d) Every MCO required to file a fraud and abuse prevention plan shall file an annual report with the department no later than January 15th of each year on a form approved by the department describing the MCO's experience, performance and cost effectiveness in implementing the plan and its proposals for modifications to the plan, to amend its operations, to improve performance or to remedy observed deficiencies. The MCO must also report at least annually the number of complaints regarding fraud and abuse made to the MCO during the year. In addition, for each confirmed case of fraud and abuse identified through complaints, organizational monitoring, contractors, subcontractors, providers, beneficiaries, enrollees, etc., the following shall be reported to the department on an ongoing basis when the case is confirmed:

1. (1) the name of the individual or entity that committed the fraud or abuse;
2. (2) the source that identified the fraud or abuse;
3. (3) the type of provider, entity or organization that committed the fraud or abuse;
4. (4) a description of the fraud or abuse;
5. (5) the approximate range of dollars involved;
6. (6) the legal and administrative disposition of the case, including actions taken by law enforcement officials to whom the case has been referred; and
7. (7) other data/information prescribed by the department. The reports shall be reviewed and signed by an executive officer of the MCO responsible for the operations of the special investigations unit.