CMS Pub. 100-18, ch. 9, § 50.6.6

42 C.F.R. §§ 422.503(b)(4)(vi)(F), 423.504(b)(4)(vi)(F)

Sponsors are responsible for the lawful and compliant administration of the

Medicare Parts C and D benefits under their contracts with CMS, regardless of

whether the sponsor has delegated some of that responsibility to FDRs. The sponsor

must develop a strategy to monitor and audit its first tier entities to ensure that they

are in compliance with all applicable laws and regulations, and to ensure that the

first tier entities are monitoring the compliance of the entities with which they

contract (the sponsors’ “downstream” entities). Sponsors must also monitor any

related entities to ensure those entities are compliant with all applicable laws and

regulations.

Sponsors must include in their work plan the number of first tier entities that will

be audited each year and how the entities will be identified for auditing. It is a best

practice for sponsors to conduct a number of on-site audits.

Sponsors must conduct specific monitoring of first tier entities to ensure they fulfill

the compliance program requirements. When a sponsor has a large number of first

tier entities, making it impractical and/or cost prohibitive to monitor or audit all

first tier entities for all compliance program requirements, the sponsor may

perform a risk assessment to identify its highest risk first tier entities, then select a

reasonable number of first tier entities to audit from the highest risk groups.

Monitoring of first tier entities for compliance program requirements must include

an evaluation to confirm that the first tier entities are applying appropriate

compliance program requirements to downstream entities with which the first tier

contracts.

When FDRs perform their own audits, it is a best practice for sponsors to obtain a

summary of the audit work plan and audit results that relate to the services the

FDR performs. Examples of reports that sponsors should receive and review as

part of their FDR monitoring and auditing efforts include, but are not limited to:

• Payment Reports that detail the amount paid by both the sponsor and the

enrollee; in addition, payment reports identifying the provider, the enrollee and

a description of the drug (including dosage and amount) or service provided.

These reports should be used to identify over and under payments, duplicate

payments, timely payments, and pricing aberrances, and to help verify correct

pricing;

• Drug Utilization Reports that identify the number of prescriptions filled by a

particular enrollee and in particular, numbers of prescriptions filled for suspect

classes of drugs, such as narcotics, to identify possible therapeutic abuse or

illegal activity by an enrollee. Enrollees with an abnormal number of

prescriptions or prescription patterns for certain drugs should be identified in

reports. Likewise, Drug Utilization Management reports from FDRs may be a

useful tool in identifying FWA;

• Provider Utilization Reports that identify the number and types of visits and

services submitted for payment to identify possible spikes and/or irregularities

such as a provider submitting claims for services that would not normally be

performed by the provider’s specialty;

• Prescribing and Referral Patterns by Physician Reports that identify the

number of prescriptions and referrals written by a particular provider and

typically focus on a class or particular type of drug, such as narcotics, or a

specific type of DME, such as scooters. These reports should be generated to

identify possible prescriber and referral/provider, pharmacy fraud and DME

fraud; and

• Geographic ZIP Reports that identify possible doctor shopping schemes or script

mills by comparing the geographic location (ZIP code) of the patient to the

location of the provider that wrote the prescription and should include the

location of the dispensing pharmacy. These reports should generate information

on those enrollees who obtain multiple prescriptions from providers located

more than the normal distance traveled for care (for example, 30 miles).

“Normal distance” should take into account where the enrollee resides (i.e.,

enrollees in rural areas would typically have longer trips to a doctor or

pharmacy than enrollees living in urban areas).

When corrective action is needed, sponsors must ensure that corrective actions are

taken by the entity. Although first tier entities may perform their own internal

auditing, the sponsor remains obligated to perform its own auditing of first tier

entities.