CMS Pub. 100-08, ch. 3, § 3.6.4

This section applies to the MACs, RACs, UPICs, and I-MEDIC, as indicated.

A. General

UPICs and the I-MEDIC may use Kiteworks to facilitate the secure exchange of records

and information between contractors, providers/suppliers, and MACs. Kiteworks is

authorized in the Federal Risk and Authorization Management Program (FedRAMP) for

secure file transfer and sharing functions. The UPICs and I-MEDIC, including all

approved subcontractors, shall continue to ensure Federal Information Security

Management Act (FISMA)/FedRAMP compliance in accordance with the CMS Office of

Information Technology’s (OIT) security requirements.

The exchange of records and information may include, but is not limited to:

• Additional Documentation Request (ADR),

• Overpayment/education letters,

• Post-payment medical review outcomes documentation,

• Administrative actions notices, and

• Statistical sample spreadsheets and methodologies.

At the conclusion of postpayment review, the MACs shall send a Review Results Letter

to the provider even if no overpayment determination is made. If the MACs choose to

send a Review Results Letter separately from the demand letter they shall do so within

the timeframes listed in PIM chapter 3, §3.3.1.1F. Likewise, the RACs shall issue a

Review Results Letter for all audits as outlined in their SOW requirements.

UPICs shall comply with the requirements listed below when issuing Review Results

Letters. Each Review Results Letter shall include:

• Identification of the provider or supplier—name, address, and NPI;

• Reason for conducting the review or good cause for reopening;

• A narrative description of the overpayment situation that states the specific

issues involved in the overpayment as well as any recommended corrective

actions;

• The review determination for each claim in the sample, including a specific

explanation of why any services were determined to be non-covered, or

incorrectly coded and if others were payable;

• A list of all individual claims that includes the actual non-covered amount, the

reason for non-coverage, the denied amounts, under/overpayment amounts, the

§1879 and §1870 of the Act determinations made for each specific claim, along

with the amounts that will and will not be recovered from the provider or

supplier;

• Any information required by PIM chapter 8, §8.4 for statistical sampling for

overpayment estimation reviews;

• Total underpayment amounts;

• Total overpayment amounts that the provider or supplier is responsible for;

• Total overpayment amounts the provider or supplier is not responsible for

because the provider or supplier was found to be without fault;

• MACs shall include an explanation that subsequent adjustments may be made at

cost settlement to reflect final settled costs;

• An explanation of the procedures for recovery of overpayments including

Medicare’s right to recover overpayments and charge interest on debts not repaid

within 30 days (not applicable to RACs or UPICs);

• The provider’s or supplier’s right to request an extended repayment schedule

(not applicable to RACs or UPICs);

• The MACs and UPICs shall include limitation of liability and appeals

information in the provider notices;

• The MACs shall include appeals information in the provider notices;

• The MACs shall include the provider or supplier financial rebuttal rights under

PIM chapter 3, §3.6.5; and

• For MAC Review Results Letter only, a description of any additional corrective

actions or follow-up activity the MAC is planning (i.e., prepayment review, re-review in 6 months).

If a claim is denied through prepayment review, the MACs and UPICs are encouraged to

issue a notification letter to the provider but may use a remittance notice to meet this

requirement. However, if a claim is denied through postpayment review, the MAC and

RAC shall notify the provider by issuing a notification letter to meet this requirement.

The UPIC shall use discretion on whether to issue a notification letter.

The CERT contractor is NOT required to issue provider notices for claims they deny.

Instead, the CERT contractor shall communicate sufficient information to the MAC to

allow the MAC to develop an appropriate provider notice.

B. MACs

The MACs need provide only high-level information to providers when informing them

of a prepayment denial via a remittance advice. In other words, the shared system

remittance advice messages are sufficient notices to the provider. However, for medical

record review, the provider should be notified through the shared system, but the MAC

shall retain more detailed information in an accessible location so that upon written or

verbal request from the provider, the MAC can explain the specific reason the claim was

denied as incorrectly coded or otherwise inappropriate.

C. RACs

For overpayments detected through medical record review, the RAC shall send a review

results letter as indicated in the RAC SOW. In addition, the RAC shall communicate

sufficient information to the MAC so that the MAC can send a remittance advice to the

provider and collect the overpayment.

For underpayments, the RAC shall notify the provider as indicated in the RAC SOW. In

addition, the RAC shall communicate sufficient information to the MAC so that the MAC

can send a remittance advice to the provider and pay back the underpayment.

D. UPICs

For overpayments detected through medical record review, and after coordination

between the UPIC and OIG, the UPIC shall send a review results letter (the MAC sends

the demand letter). In addition, the UPIC shall communicate sufficient information to the

MAC so that the MAC can send a demand letter to the provider and collect the

overpayment. The UPIC shall use discretion on whether to send the review results letter.

E. Indicate in the Denial Notice Whether Records Were Reviewed

For claims where the MAC or UPIC had sent an ADR letter and no timely response was

received, they shall issue a denial and indicate in the provider denial notice, that the

denial was made without reviewing the documentation because the requested

documentation was not received or was not received within the allowable time frame

(§1862(a) (1) of the Act). This information will be useful to the provider in deciding

whether to appeal the decision. When denying the claims, contractors shall use Group

Code: CO - Contractual Obligation and Claim Adjustment Reason Code (CARC) 50 -

these are non-covered services because this is not deemed a “medical necessity” by the

payer and Remittance Advice Remark Code (RARC) M127 - Missing patient medical

record for this service.

For claims where the reviewer makes a denial following medical record review, the

reviewer has the discretion to indicate in the denial notice, using Group Code: CO -

Contractual Obligation and Claim Adjustment Reason Code (CARC) 50 - these are non-covered services because this is not deemed a “medical necessity” by the payer that the

denial was made after review of submitted documentation. This includes those claims

where the provider submits documentation along with the claim and the reviewer selects

that claim for review.