CMS Pub. 100-08, ch. 4, § 4.7.4.3

Process

(Rev. 13000; Issued: 12-12-24; Effective: 12-10-24; Implementation: 12-10-24)

This section applies to UPICs.

The UPIC shall collaborate with the Medical Review Accuracy Contractor (MRAC) to

assure correct claims payment, and to address situations of potential fraud, waste, and

abuse (FWA). The UPIC shall establishment of a JOA with the MRAC for the purpose

of facilitating an efficient process for communication. The JOA shall be designed to

establish guidelines and shared expectations within which the MRAC and the UPIC will

conduct operations.

In addition to establishing a JOA with the MRAC, the UPICs shall comply with the

processes/guidelines outlined in the steps below. These steps explain the UPIC’s

responsibility to provide the required information/documents for the medical review of

the UPIC’s Medicare and Medicaid claims for Program Integrity (PI) to the MRAC

and/or CMS within the allotted time frames.

Step 1: Submission of Investigations Universe to Accuracy Review Contractor

(Fifth Business Day of the Month)

The UPIC shall supply the MRAC with one file that lists the universe of cases, including

all reviewed claims, that were subjected to MR on a post-payment basis within the

previous 30 calendar days, in accordance with the Deliverable Schedule and the

approved MRAC Reporting Template. This universe shall contain open and closed

Medicare and/or Medicaid cases from the previous 30 calendar days. Claims will only

be selected from a postpayment sample for completed medical review. For Medicaid

claims (excluding any claims reviewed for the Medicaid Managed Care Project), only

include, in the universe, closed audits from the previous 30 calendar days. For medical

review purposes, when a Final Findings Report (FFR) is issued, a Medicaid case is

considered closed after CMS has issued the FFR to the State Medicaid Agency, and the

UPIC has closed the case in UCM. In addition, the following Medicaid cases that were

medically reviewed shall also be included in the universe submitted to the MRAC:

1. Any case that was discontinued (and therefore closed) in the previous 30 calendar

days.

2. Any case that was closed in the previous 30 calendar days due to Insufficient

Potential Recovery (i.e. the case did not qualify for an Initial Findings Report).

3. Any case that required a PEER review (medical review was completed by a specialty

provider). The UPICS shall identify the peer review claims in the universe list that’s

submitted to the MRAC.

For PI reviews, claims that are going through the appeals process/selected by LE will be

excluded from the review. If at any time the UPIC becomes aware that a claim is under

appeal, it shall notify the UPIC COR, the MRAC Point of Contact (POC) and MRAC

COR immediately. The MRAC will stop reviewing the claim(s) and they will be

removed from the universe/sample.

The completed universe of investigations/claims shall be sent via an approved format

designated by CMS (i.e., encrypted CD, email or other CMS system/platform) to the

MRAC with a copy to the MRAC COR and the PI BFL on or before the required

submission date. If the UPIC anticipates a delay, they shall notify the MRAC as well as

their UPIC COR, the MRAC COR and PI BFL by email.

Step 2: Selection of Sample by MRAC (Five Business Days)

Using random sampling, the MRAC shall select a sample of claims to be reviewed from

the universe of investigations/claims submitted by the UPIC. The number of medical

records/claims requested will vary for the purpose of reaching the required number of

medical records/claims as per the MRAC SOW. The MRAC will notify the UPIC of the

sample of investigations selected via an approved format designated by CMS to the

UPIC POCs.

Step 3: Medical Documentation Submission to MRAC (Seven Business Days)

The UPIC shall submit the complete documentation package to the MRAC within seven

business days of receiving the encrypted email for each of the investigations/claims

selected by the MRAC. This documentation package shall include:

1. Medical records and documentation;

2. Summary of findings report for each claim reviewed that includes the MR review

decisions, observations and FWA patterns and/ or trends identified;

3. The UPIC’s UCM notes for each investigation selected;

4. A list of all Medicare references (policies, NCDs, LCDs) used to make the MR

determination for each claim; and

5. A copy of all Medicaid policies and the State’s interpretation (obtained by the

UPIC) to make the MR determination for each claim.

The MRAC will be required to establish user identifications, onboarding, and login

assistance for the UPIC’s points-of-contact (POCs). The UPIC shall update/provide one

(1) POC per contract jurisdiction for onboarding/access to the MRAC SFTP server. The

POC shall be the individual responsible for sending medical records to the MRAC. If the

UPIC has more than one jurisdiction with one POC sending medical records, a back-up

POC may be submitted. This will allow the POC to access a secure folder, only

accessible to their POC(s) and the MRAC, to transfer medical records.

POC information shall include: full name, email address, and direct cell phone number

(for multi-factor authentication). This information shall be emailed to the designation

MRAC POC/email with a cc to the CMS UPIC COR and MRAC COR.

The UPIC’s POC will require the below software to be installed on their workstation to

access the MRAC SFTP server:

• Anti-Virus Software,

• SFTP Client (may require assistance from your IT administrator to install),

• Cisco AnyConnect Client (installation link and instructions will be provided to

the POC during onboarding), and

• CMS NET connection to access MRAC SFTP server. The UPIC’s POC

must work with their IT Team, CMS and MRAC Support team

(mrac_support@religroupinc.com ) to whitelist the required IP addresses to

access the MRAC SFTP server through CMS NET.

The UPIC’s POC must work with their IT Team to edit their local host configuration file

to resolve the IP address of the SFTP server.

The UPIC’s POC must have direct access to a cellular phone for multi-factor

authentication when logging in. Instructions and user login credentials will be provided

to the POC during onboarding.

For any individuals that are new to this process or would like a re-fresher, a virtual

training/technical demonstration for accessing the SFTP server and ensuring all users are

able to connect successfully will occur at a date and time to be determined once

onboarding of POCs is in progress.

Technical assistance issues can be sent via email to mrac_support@religroupinc.com or

via phone at (443) 961-2549. MRAC Technical Support will be available Monday-Friday 8:30AM - 5:30PM EST.

All files uploaded must still be encrypted and password protected, meeting all applicable

CMS data security parameters. Notification after upload shall still be submitted to

mracmail@religroupinc.com with a copy to the MRAC COR and your UPIC COR.

Step 4: MRAC Accuracy Review of Investigations (20 Business Days)

The MRAC will conduct reviews of the sampled claims, utilizing the documentation

applied by the UPIC in reaching its decision, to evaluate the accuracy of the UPIC

medical record review determination. In other words, the independent reviewers will re-review these claims to determine whether the UPIC made accurate claim decisions in

compliance with Medicare and/or Medicaid coverage, coding, payment, and billing

policies and noted whether Medicare and Medicaid claims contained patterns and/or

trends which may support an allegation of potential FWA.

The MRAC will review each investigation in the representative sample and determine

whether the UPIC’s payment decision was correct and whether claims contain patterns

and/or trends which may support an allegation of potential FWA, such as, evidence of

alterations including, but not limited to: obliterated sections, missing pages, inserted

pages, white out, and excessive late entries.

If the MRAC detects patterns and/or trends which may support an allegation of potential

FWA during the review of records for any of the UPICs that was not recognized or

documented, this will be documented as a finding for the UPIC and referred back to the

UPIC COR, MRAC COR and PI BFL for review/follow-up with the specific UPIC. The

portion of the review process related to the detection of these patterns/trends will be

evaluated/reported as pass or fail for each investigation. The MRAC will complete these

reviews within 20 business days.

Step 5: Results of the MRAC Accuracy Review of Investigations (Five Business

Days)

When the MRAC disagrees with the UPIC’s payment decision or MR rationale on a

claim, or identifies unaddressed patterns and/or trends (i.e. the UPIC failed the FWA

review portion of the investigations) which may support an allegation of potential FWA,

the MRAC will report the results of the accuracy reviews via the Accuracy Review

Disagreement Worksheet. The disagreement worksheets will be sent to the MRAC

COR/PI BFL via encrypted CD within five business days. If a problem is identified, the

PI BFL will notify the UPIC COR.

Step 6: The Rebuttal Process (Five Business Days)

The UPIC has five business days, from the day it receives the disagreement worksheet(s)

from the MRAC to submit their rebuttal to the MRAC POC via an approved format with

a copy to the PI BFL, the MRAC COR/Alternate COR. The MRAC will have seven

business days from receipt of the rebuttal to complete the review. Once it’s completed,

the MRAC will send the Accuracy Review Disagreement worksheets to the UPICS and

MRAC COR/PI BFL. The MRAC will also provide CMS with the medical records. If

the UPIC requires additional time to submit the rebuttal, the UPIC shall submit a request

for extension with justification to the MRAC COR/PI BFL for approval. The UPIC COR

shall be included in all correspondence.

Step 7: Disputing MRAC/CMS Decisions (Five Business Days)

The UPIC has five business days from the day it receives the disagreement worksheets

from the MRAC to submit their rebuttal to the MRAC POC via email with a copy to the

PI BFL, the MRAC COR and the UPIC’s COR. If the MRAC upholds its decision, the

UPIC has five business days to request a dispute review with CMS. Once a final

determination is made, the UPIC and the MRAC POC will be notified via email by

CMS.

In addition to the processes above, the COR shall request assistance from the PI BFL to

review a representative sample of agree and disagree claims to evaluate the accuracy of

the MRACs’ medical record review decisions including the identification of FWA

patterns/trends.

If the UPIC’s claim decision is found to be erroneous through the accuracy review

process and the UPIC has verified with the MAC or SMA that the claim has not been

appealed, CMS suggests that for Medicare claims, the UPIC reaches out to their MAC to

inform them of the revised claim decision. For Medicaid claims, the UPIC shall reach

out to their Medicaid BFL and COR for next steps. Regardless of the claim type, it is up

to the MAC or SMA to decide if a claim warrants a re-review. If the claim has been

appealed, the appeal decision shall be considered the final decision of the claim. If the

investigation has been referred to/accepted by LE, all overpayment activities will be at

the direction of LE and shall be referred to the BFL for further guidance.