§ 363-d. Provider compliance program. 1. The legislature finds that medical assistance providers may be able to detect and correct payment and billing mistakes and fraud if required to develop and implement compliance programs. It is the purpose of such programs to organize provider resources to resolve payment discrepancies and detect inaccurate billings, among other things, as quickly and efficiently as possible, and to impose systemic checks and balances to prevent future recurrences. The legislature accordingly declares that it is in the public interest that providers within the medical assistance program implement compliance programs. The legislature also recognizes the wide variety of provider types in the medical assistance program and the need for compliance programs that reflect a provider's size, complexity, resources, and culture. For a compliance program to be effective, it must be designed to be compatible with the provider's characteristics. At the same time, however, the legislature determines that there are key components that must be included in every compliance program and such components should be required if a provider is to be a medical assistance program participant. Accordingly, the provisions of this section require providers to adopt effective compliance program elements, and make each provider responsible for implementing such a program appropriate to its characteristics.

2. Every provider of medical assistance program items and services that is subject to subdivision four of this section shall adopt and implement a compliance program. The office of Medicaid inspector general shall create and make available on its website guidelines, which may include a model compliance program, that reflect the requirements of this section. Such compliance programs shall meet the requirements included in this subdivision as a condition of payment from the medical assistance program. The compliance program required pursuant to this section may be a component of more comprehensive compliance activities by the medical assistance provider so long as the requirements of this section are met. Every provider shall adopt and implement an effective compliance program, which shall include measures that prevent, detect, and correct non-compliance with medical assistance program requirements as well as measures that prevent, detect, and correct fraud, waste, and abuse. The compliance program shall include the following requirements:

(a) Written policies, procedures, and standards of conduct that:

(1) articulate the organization's commitment to comply with all applicable federal and state standards;

(2) describe compliance expectations as embodied in the standards of conduct;

(3) implement the operation of the compliance program;

(4) provide guidance to employees and others on dealing with potential compliance issues;

(5) identify how to communicate compliance issues to appropriate compliance personnel;

(6) describe how potential compliance issues are investigated and resolved by the organization;

(7) include a policy of non-intimidation and non-retaliation for good faith participation in the compliance program, including but not limited to reporting potential issues, investigating issues, conducting self-evaluations, audits and remedial actions, and reporting to appropriate officials; and

(8) all requirements listed under 42 U.S.C.1396-a(a)(68).

(b) Designation of a compliance officer and a compliance committee who report directly and are accountable to the organization's chief executive or other senior management.

(c)(1) Each provider shall establish and implement effective training and education for its compliance officer and organization employees, the chief executive and other senior administrators, managers and governing body members.

(2) Such training and education shall occur at a minimum annually and shall be made a part of the orientation for a new employee and new appointment of a chief executive, manager, or governing body member.

(d) Establishment and implementation of effective lines of communication, ensuring confidentiality, between the compliance officer, members of the compliance committee, the organization's employees, managers and governing body, and the organizations first tier, downstream, and related entities. Such lines of communication shall be accessible to all and allow compliance issues to be reported including a method for anonymous and confidential good faith reporting of potential compliance issues as they are identified.

(e) Well-publicized disciplinary standards through the implementation of procedures which encourage good faith participation in the compliance program by all affected individuals.

(f) Establishment and implementation of an effective system for routine monitoring and identification of compliance risks. The system should include internal monitoring and audits and, as appropriate, external audits, to evaluate the organization's compliance with the medical assistance program requirements and the overall effectiveness of the compliance program.

(g) Establishment and implementation of procedures and a system for promptly responding to compliance issues as they are raised, investigating potential compliance problems as identified in the course of self-evaluations and audits, correcting such problems promptly and thoroughly to reduce the potential for recurrence, and ensure ongoing compliance with the medical assistance programs requirements.

3. Upon enrollment in the medical assistance program, a provider shall certify to the department that the provider satisfactorily meets the requirements of this section. Additionally, the commissioner of health and Medicaid inspector general shall have the authority to determine at any time if a provider has a compliance program that satisfactorily meets the requirements of this section.

(a) A compliance program that is accepted by the federal department of health and human services office of inspector general and remains in compliance with the standards promulgated by such office shall be deemed in compliance with the provisions of this section, so long as such plans adequately address medical assistance program risk areas and compliance issues.

(b) A compliance program that meets Federal requirements for managed care provider compliance programs, as specified in the contract or contracts between the department and the Medicaid managed care provider shall be deemed in compliance with the provisions in this section, so long as such programs adequately address medical assistance program risk areas and compliance issues. For purposes of this section, a managed care provider is as defined in paragraph (c) of subdivision one of section three hundred sixty-four-j of this chapter, and includes managed long term care plans.

(c) In the event that the commissioner of health or the Medicaid inspector general finds that the provider does not have a satisfactory program within ninety days after the effective date of the regulations issued pursuant to subdivision four of this section, the provider may be subject to any sanctions or penalties permitted by federal or state laws and regulations, including revocation of the provider's agreement to participate in the medical assistance program.

(d)(1) In the first instance of the Medicaid inspector general's determination that the provider, including a Medicaid managed care provider, that has failed to adopt and implement a compliance program which satisfactorily meets the requirements of this section, the Medicaid inspector general may impose a monetary penalty of five thousand dollars per calendar month, for a maximum of twelve calendar months against a provider, including Medicaid managed care providers.

(2) The Medicaid inspector general may impose a monetary penalty of up to ten thousand dollars per calendar month, for a maximum of twelve calendar months against a provider, including a Medicaid managed care provider, that has failed to adopt and implement a compliance program which satisfactorily meets the requirements of this section, if a penalty was previously imposed under subparagraph one of this paragraph within the previous five years.

(e) A provider, including a Medicaid managed care provider, against whom a monetary penalty is imposed pursuant to paragraph (d) of this subdivision shall be entitled to notice and an opportunity to be heard, including the right to request a hearing pursuant to section twenty-two of this chapter.

4. Providers that shall be subject to the provisions of this section include, but are not limited to:

(a) those subject to the provisions of articles twenty-eight and thirty-six of the public health law;

(b) those subject to the provisions of articles sixteen and thirty-one of the mental hygiene law;

(c) notwithstanding the provisions of § 4414 of the public health law, managed care providers, as defined in section three hundred sixty-four-j of this title and includes managed long-term care plans; and

(d) other providers of care, services and supplies under the medical assistance program for which the medical assistance program is a substantial portion of their business operations.

5. (a) The Medicaid inspector general, in consultation with the department of health, shall promulgate any regulations necessary to implement this section.

(b) The Medicaid inspector general shall accept programs and processes implemented pursuant to § 4414 of the public health law as satisfying the obligations of this section and the regulations promulgated thereunder when such programs and processes incorporate the objectives contemplated by this section.

6. (a) If a person has received an overpayment under the medical assistance program, the person shall:

(1) report and return the overpayment to the department; and

(2) notify the Medicaid inspector general in writing of the reason for the overpayment.

(b) An overpayment shall be reported and returned under paragraph (a) of this subdivision by the later of: (1) the date which is sixty days after the date on which the overpayment was identified; or (2) the date any corresponding cost report is due, if applicable. A person has identified an overpayment when the person has or should have through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment. A person should have determined that the person received an overpayment and quantified the amount of the overpayment if the person fails to exercise reasonable diligence and the person in fact received an overpayment.

(c) The deadline for returning overpayments shall be tolled when the following occurs:

(1) the Medicaid inspector general acknowledges receipt of a submission to the Medicaid inspector general's self-disclosure program under subdivision seven of this section, and shall remain tolled until such time as a self-disclosure and compliance agreement, pursuant to subdivision seven of this section is fully executed, the person withdraws from the self-disclosure program, the person repays the overpayment and any interest due, or the person is removed from the self-disclosure program by the Medicaid inspector general; or

(2) in the absence of a finding of fraud a person may repay an overpayment through installment payments as described in subdivision seven of this section and shall remain tolled until such time as the provider repays the overpayment and any interest due, the Medicaid inspector general rejects the installment payment schedule requested by the provider, or the provider fails to comply with the terms of the installment payment schedule.

(d) Any overpayment retained by a person after the deadline for reporting and returning the overpayment under paragraph (b) of this subdivision shall be subject to a monetary penalty pursuant to subdivision four of section one hundred forty-five-b of this article.

(e) For purposes of this subdivision, "person" means a provider of services or supplies, managed care provider, as defined in paragraph (b) of subdivision one of section three hundred sixty-four-j of this title and includes managed long-term care plans, and does not include recipients of the medical assistance program.

7. Self-disclosure program. (a) Notwithstanding the provisions of any other law to the contrary, there is hereby established a voluntary self-disclosure program to be administered by the Medicaid inspector general, in consultation with the commissioner, for all persons described in this section owing any overpayment to the medical assistance program.

(b) For purposes of this subdivision, "person" means any person providing services or receiving payment under the medical assistance program, a managed care provider as defined in paragraph (b) of subdivision one of section three hundred sixty-four-j of this title, including managed long-term care plans, and any subcontractors or network providers thereof.

(c) In order to be eligible to participate in the self-disclosure program, a person shall satisfy the following conditions:

(1) the person is not currently under audit, investigation or review by the Medicaid inspector general, unless the overpayment and the related conduct being disclosed does not relate to the Medicaid inspector general's audit, investigation or review;

(2) the person is disclosing an overpayment and related conduct that the Medicaid inspector general has not determined, calculated, researched or identified at the time of the disclosure;

(3) the overpayment and related conduct is reported by the deadline specified in subdivision six of this section; and

(4) the person is not currently a party to any criminal investigation being conducted by the deputy attorney general for the Medicaid fraud control unit or an agency of the United States government or any political subdivision thereof.

(d) Notwithstanding subdivision three of section one hundred forty-five-b of this article, the Medicaid inspector general may waive interest on any overpayment reported, returned, and explained by an eligible person under this subdivision. Furthermore, an eligible person's good faith participation in the self-disclosure program may be considered as a mitigating factor in the determination of an administrative enforcement action.

(e) To participate in the self-disclosure program, an eligible person shall apply by submitting a self-disclosure statement in the form and manner prescribed by the Medicaid inspector general. The statement shall contain all the information required by the Medicaid inspector general to effectively administer the self-disclosure program.

(f) (1) The eligible person shall pay the overpayment amount determined by the Medicaid inspector general to the department within fifteen days of the Medicaid inspector general notifying the person of the amount due.

(2) In the event the Medicaid inspector general is satisfied that the person cannot make immediate full payment of the disclosed overpayment, the Medicaid inspector general may permit the person to repay the overpayment and any interest due through installment payments. The Medicaid inspector general may require a financial disclosure statement setting forth information concerning the person's current assets, liabilities, earnings, and other financial information before entering into an installment payment plan with the person.

(3) If the person and the overpayment are eligible under the self-disclosure program, the Medicaid inspector general shall be authorized to enter into a self-disclosure and compliance agreement with the person. The self-disclosure and compliance agreement shall be in a form to be established by the Medicaid inspector general and include such terms as the Medicaid inspector general shall require for the repayment of the person's disclosed overpayment and enable and require the person to comply with the requirements of the medical assistance program in the future. The person shall execute the self-disclosure and compliance agreement within fifteen days of receiving said agreement from the Medicaid inspector general, or such other timeframe permitted by the Medicaid inspector general, provided however, that such other period is not less than fifteen days.

(4) If the person provides false material information or omits material information in his or her submissions to the Medicaid inspector general, or attempts to defeat or evade an overpayment due pursuant to the self-disclosure and compliance agreement executed under this subdivision, or fails to comply with the terms of the self-disclosure and compliance agreement, or refuses to execute the self-disclosure and compliance agreement in the timeframes specified under this section, such agreement shall be deemed rescinded and the provider's participation in the self-disclosure program terminated.

(5) A person against whom a self-disclosure and compliance agreement is rescinded and participation in the self-disclosure program is terminated pursuant to subparagraph four of this paragraph shall be entitled to notice.

(g) The Medicaid inspector general, in consultation with the commissioner, may promulgate regulations, issue forms and instructions, and take any and all other actions necessary to implement the provisions of the self-disclosure program established under this section to maximize public awareness and participation in such program.