partnership healthplan of california€¦ · 25.10.2016 · partnership healthplan of california ....

MEDICAL REVIEW – SOUTHERN SECTION I – LOS ANGELES AUDITS AND INVESTIGATIONS

DEPARTMENT OF HEALTH CARE SERVICES

Partnership HealthPlan

of California

Contract Number: 08-85215

Audit Period: January 1, 2015 through December 31, 2015

Report Issued: October 25, 2016

TABLE OF CONTENTS I. INTRODUCTION .............................................................................1 II. EXECUTIVE SUMMARY .................................................................2 III. SCOPE/AUDIT PROCEDURES ......................................................4 IV. COMPLIANCE AUDIT FINDINGS Category 1 – Utilization Management ..............................................6 Category 3 – Access and Availability of Care ................................ 10 Category 4 – Member’s Rights ...................................................... 12 Category 5 – Quality Management ................................................ 16 Category 6 – Administrative and Organizational Capacity ............. 18

of 19

I. INTRODUCTION

Partnership HealthPlan of California (the Plan) is a non-profit community based health care organization. The Plan is a County Organized Health System (COHS) established in 1994 in Solano County. The Plan provides managed health care services to Medi-Cal members under the provision of Welfare and Institutions Code, Section 14087.54. The Plan is governed by a Board of Commissioners. The Board is comprised of locally elected officials, provider representatives, and patient advocates. The Plan is licensed in accordance with the provisions of the Knox-Keene Health Care Service Plan Act since 2005. The Plan is not a National Committee on Quality Assurance (NCQA) accredited health plan. Prior to September 2013, the Plan provided health care coverage to six northern California counties: Solano, Napa, Yolo, Sonoma, Marin, and Mendocino. On September 1, 2013, the Plan expanded services to an additional eight counties: Del Norte, Humboldt, Lake, Lassen, Modoc, Shasta, Trinity, and Siskiyou. As of June 30, 2015, the Plan's total Medi-Cal enrollment was approximately 532,042 members, as follows:

• Del Norte 10,681 • Humboldt 46,643 • Lake 27,201 • Lassen 6,878 • Marin 34,820 • Mendocino 34,941 • Modoc 2,861 • Napa 27,056 • Shasta 59,916 • Siskiyou 15,704 • Solano 105,045 • Sonoma 106,205 • Trinity 4,528 • Yolo 49,563

of 19

II. EXECUTIVE SUMMARY This report presents the audit findings of the Department of Health Care Services (DHCS) medical audit for the period of January 1, 2015 through December 31, 2015. The on-site review was conducted from January 25, 2016 through February 5, 2016. The audit consisted of document review, verification studies, and interviews with Plan personnel. An Exit Conference was held on August 26, 2016 with the Plan. The Plan was allowed 15 calendar days from the date of the Exit Conference to provide supplemental information addressing the draft audit report finding. The Plan submitted supplemental information after the Exit Conference which is reflected in this report. The audit evaluated six categories of performance: Utilization Management (UM), Continuity of Care, Access and Availability to Care, Member Rights, Quality Management (QI), and Administrative and Organizational Capacity. The summary of the findings by category follows: Category 1 – Utilization Management The prior authorization and appeal systems had inadequate controls to ensure proper evaluations of prior authorization requests and appeals. The systems had inadequate operational controls to ensure prior authorizations and appeals were appropriately escalated to a physician reviewer. The Plan’s Health Services Department did not have operational oversight to ensure appeal notification letters were sent to members or their authorized representative and that letters were clear and easy to understand. Category 2 – Case Management and Coordination of Care The Plan was compliant with the requirements in this Category. Category 3 – Access and Availability of Care The claims system was not continually configured and updated with current provider information and adjudication procedures. Category 4 – Member’s Rights The Plan did not include all grievance data in their reports submitted to DHCS. The grievance system had inadequate controls to ensure grievances with medical issues were escalated to a physician reviewer with clinical expertise and authority to require corrective action. The system operational controls did not ensure potential quality issues were identified and referred to the quality improvement department.

The Health Insurance Portability and Accountability Act (HIPAA) system did not have oversight to ensure the documentation of accurate dates for suspected HIPAA security incidents/breaches. Category 5 – Quality Management The new provider training system did not have oversight to ensure that new providers received training within the required timeframes. Category 6 – Administrative and Organizational Capacity Prior to the closeout of the 2015 audit, the fraud and abuse system did not have oversight to ensure that all suspected fraud/abuse cases were reported to the DHCS within the required timeframes.

Page 3 of 19

of 19

III. SCOPE/AUDIT PROCEDURES SCOPE This audit was conducted by the Department of Health Care Services (DHCS) Medical Review Branch to ascertain that medical services provided to the Plan members comply with federal and state laws, Medi-Cal regulations and guidelines, and the State's County Organized Health System Contract. PROCEDURE DHCS conducted an on-site audit of the Plan from January 25, 2016 through February 5, 2016. The audit included a review of the Plan's Contract with DHCS, its policies for providing services, the procedures used to implement the policies, and verification studies of the implementation and effectiveness of the policies. Documents were reviewed and interviews were conducted with the Plan administrators and staff. The following verification studies were conducted: Category 1 – Utilization Management Prior Authorization Requests: Sixteen (16) medical and twenty-two (22) pharmacy prior authorization requests were reviewed for timeliness, consistent application of criteria, appropriateness of review, and communication of results to members and providers. Appeal Procedures: Twenty-six (26) prior authorization appeals were reviewed for appropriateness and timely decision making. Category 2 – Case Management and Coordination of Care Coordination of Care: Five (5) medical records were reviewed for evidence of coordination of care between the Plan, Primary Care Providers (PCP), member, and other services. California Children’s Services (CCS): Five (5) medical records were reviewed for evidence of coordination of care between the Plan and CCS providers. Individual Health Assessment: Twenty (20) medical records were reviewed for completeness and timeliness. Category 3 – Access and Availability of Care Appointment Availability: Thirty (30) contracted providers from the Provider Directories were reviewed for accuracy and appointment availability.

of 19

Claims: Twenty (20) emergency service claims and eighteen (18) family planning claims were reviewed for appropriate and timely adjudication. Category 4 – Member’s Rights Grievance Procedures: Fifty-Five (55) grievances were reviewed for timely resolution, submission to the appropriate level for review, response to complaint, and translation of written notification requirements. Category 6 – Administrative and Organizational Capacity New Provider Training: Ten (10) new provider training records were reviewed for timely Medi-Cal Managed Care program training. A description of the findings for each category is contained in the following report.

COMPLIANCE AUDIT FINDINGS PLAN: Partnership HealthPlan of California

AUDIT PERIOD: January 1, 2015 through December 31, 2015 DATE OF ONSITE: January 25, 2016 through February 5, 2016

Page 6 of 19

CATEGORY 1 - UTILIZATION MANAGEMENT

1.2 PRIOR AUTHORIZATION REVIEW REQUIREMENTS Prior Authorization and Review Procedures: Contractor shall ensure that its pre-authorization, concurrent review and retrospective review procedures meet the following minimum requirements… (as required by Contract) COHS Contract A.5.2.A, B, C, F, H, I

Exceptions to Prior Authorization: Prior Authorization requirements are not applied to Emergency Services, Minor Consent Services, family planning services, preventive services, basic prenatal care, sexually transmitted disease services, and HIV testing. COHS Contract A.5.2.G Timeframes for Medical Authorization Pharmaceuticals: 24 hours or one (1) business day on all drugs that require prior authorization in accordance with Welfare and Institutions Code Section 14185(a)(1). COHS Contract A.5.F Routine authorizations: five (5) working days from receipt of the information reasonably necessary to render a decision (these are requests for specialty service, cost control purposes, out-of-network not otherwise exempt from prior authorization) in accordance with Health and Safety Code Section 1367.01(h)(1), or any future amendments thereto, but, no longer than 14 calendar days from the receipt of the request. The decision may be deferred and the time limit extended an additional 14 calendar days only where the Member or the Member’s provider requests an extension, or the Contractor can provide justification upon request by the State for the need for additional information and how it is in the Member’s interest. Any decision delayed beyond the time limits is considered a denial and must be immediately processed as such. COHS Contract A.5.H

Denial, Deferral, or Modification of Prior Authorization Requests: Contractor shall notify Members of a decision to deny, defer, or modify requests for Prior Authorization by providing written notification to Members and/or their authorized representative…This notification must be provided as specified in Title 22 CCR Sections 51014.1, 51014.2, 53894, and Health and Safety Code Section 1367.01. COHS Contract A.13.8.A

SUMMARY OF FINDINGS: 1.2.1 Prior Authorization Review

The Plan is required to continuously update and improve the Utilization Management (UM) program that ensures appropriate processes are used to review and approve the provision of Medically Necessary Covered Services (Contract, Exhibit A, Attachment 5.1). The Plan is required to ensure that qualified health care professionals supervise review decisions and a qualified Physician will review all denials that are made, whole or in part, on the basis of medical necessity. (Contract, Exhibit A, Attachment 5.2.A and B). The Utilization Management Program Description (October 2014, #MPUD3001) states the Quality/Utilization Advisory Committee (Q/UAC) is responsible for assuring that quality, comprehensive health care, and services are provided to Plan members through an ongoing, systematic evaluation and monitoring process that facilitates continuous quality improvement. The UM Review Criteria is based on sound clinical evidence and relevant clinical information is obtained when making a determination based on medical appropriateness and the treating practitioner is consulted when appropriate. Information collected to support



Page 7 of 19

decision-making is documented. A mechanism exists for evaluation of consistency with which health care professionals make determinations. Plan Policies #MCUP3041: TAR Review Process and #MCRO4018: Pharmacy TAR Review Process states that the Treatment Authorization Request (TAR) review will be based on medical necessity and TARs can be denied, for reasons of medical necessity, by the Chief Medical Officer or Physician Designee. The policies also state that if the TAR is received without sufficient information to render a determination, the Plan staff will contact the provider requesting the specific information and will operate in the regulatory timeframe of submission.

The Plan has a documented process for the oversight of the prior authorization system. However, deficiencies were noted in its operational control. For four medical and three pharmacy prior authorizations, the Plan did not fully investigate and obtain additional information, causing possible delay in patient care.

RECOMMENDATION: 1.2.1 Improve system controls to ensure proper evaluations of prior authorization requests. Improve operational

controls to ensure prior authorizations are appropriately escalated to a physician reviewer.



Page 8 of 19

1.4 PRIOR AUTHORIZATION APPEAL PROCESS Appeal Procedures: There shall be a well-publicized appeals procedure for both providers and Members. COHS Contract A.5.2.E SUMMARY OF FINDINGS: 1.4.1 Prior Authorization Appeal Process

The Plan is required to ensure that its pre-authorization, concurrent review and retrospective review procedures have a set of written criteria or guidelines for utilization review that is based on sound medical evidence, is consistently applied, regularly reviewed, and updated (Contract, Exhibit A, Attachment 5.2.B and C). The Plan is required to ensure that any grievance involving the appeal of a denial based on lack of Medical Necessity or an appeal that involves clinical issues shall be resolved by a health care professional with appropriate clinical expertise in treating the member’s condition or disease (Contract, Exhibit A, Attachment 14.2.D).

The Utilization Management Program Description (October 2014, #MPUD3001) states the UM Review Criteria is based on sound clinical evidence and relevant clinical information is obtained when making a determination based on medical appropriateness and the treating practitioner is consulted when appropriate. Plan Policies #MCUP3037: Appeals / Expedited Appeals of UM Decisions for Medical Necessity Determination (Non-Administrative) and #CGA019: Medi-Cal Appeal Process states upon receipt of an appeal, Plan staff conducts a preliminary investigation by contacting the treating provider or any appropriate individuals to gather information. Medically-related appeals and all documentation will be referred to the medical director for review. The medical director will order medical records from the primary care providers and/or other treating physicians if needed.

The Plan has a documented process for the oversight of the appeal system. However, deficiencies were noted in its operational control. For three UM provider, three pharmacy provider and five member appeals, the Plan did not fully investigate and obtain additional information, causing possible delay in patient care. Two medical and two pharmacy prior authorizations were denied and appealed were not escalated to a physician reviewer with clinical expertise as the prior authorization level.

1.4.2 Written Notification of Appeal Decision

The Plan is required to notify members of a decision to deny, defer, or modify requests for Prior Authorization by providing written notification to members and/or their authorized representative, regarding any denial, deferral or modification of a request for approval to provide a health care service. The Plan is required to give members a Notice of Action when it results in a termination, suspension, reduction of services, or reduction of previously authorized covered services (Contract, Exhibit A, Attachment 13.8.A and B). The Plan is required to ensure that all written member information is provided to members at a sixth grade reading level or as determined appropriate through the Plan’s group needs assessment and approved by DHCS. The written member information shall ensure members’ understanding of the health plan Covered Services processes and ensure the member’s ability to make informed health decisions (Contract, Exhibit A, Attachment 13.4.C). Decisions resulting in denial, delay, or modification of all or part of the requested health care service shall be communicated to the enrollee in writing, per Health and Safety Code, Section 1367.01(h)(3). The Utilization Management Program Description (October 2014, #MPUD3001) states the Plan will provide written notification of determinations to the facility, attending physician, patient or parents, significant other



Page 9 of 19

or guardian. Plan Policies #MCUP3037: Appeals / Expedited Appeals of UM Decisions for Medical Necessity Determination (Non-Administrative) and #CGA019: Medi-Cal Appeal Process states that the appeals decision is communicated in writing to the provider and member.

The Plan has written policies regarding the notification to members. However, there is a lack of oversight by the Plan’s Health Services Department in sending out the Notice of Action Letters. The Notice of Action Letter for nine UM provider and three pharmacy provider appeals were not sent to the member or their authorized representative, causing members to be unaware of the Plan’s decision and their member rights not transmitted. The denial letters for four pharmacy provider and four member appeals were not written at an understandable level. These letters contained language that was not clear or easy to understand, limiting the member’s ability to make informed health decisions.

RECOMMENDATIONS: 1.4.1 Improve system controls to ensure proper investigation of prior authorization appeals. Improve operational

controls to ensure appeals are appropriately escalated to a physician reviewer. 1.4.2 Develop and implement oversight to ensure notification letters are sent to members or their authorized

representative and the letters are clear and easy to understand.



Page 10 of 19

CATEGORY 3 – ACCESS AND AVAILABILITY OF CARE

3.5 EMERGENCY SERVICES AND FAMILY PLANNING CLAIMS Emergency Service Providers (Claims) Contractor is responsible for coverage and payment of emergency services and post stabilization care services and must cover and pay for emergency services regardless of whether the provider that furnishes the services has a contract with the plan. COHS Contract A.8.12.A

Contractor shall pay for Emergency Services received by a Member from non-contracting providers. COHS Contract A.8.12.C

At a minimum, Contractor must reimburse the non-contracting emergency department and, if applicable, its affiliated providers for Physician services at the lowest level of emergency department evaluation and management CPT (Physician's Current Procedural Terminology) codes, unless a higher level is clearly supported by documentation, and for the facility fee and diagnostic services such as laboratory and radiology. COHS Contract A.8.12.D

For all non-contracting providers, reimbursement by Contractor or by a subcontractor who is at risk for out-of-plan Emergency Services, for properly documented claims for services rendered on or after January 1, 2007 by a non-contracting provider pursuant to this provision shall be made in accordance with provision 4, Claims Processing, above, and 42 USC Section 1396u-2(b)(2)(D). COHS Contract A.8.12.E

Contractor shall cover emergency medical services without prior authorization pursuant to Title 28 CCR Section 1300.67(g)(1). COHS Contract A.9.6.A

Family Planning (Claims) Contractor shall reimburse non-contracting family planning providers at no less than the appropriate Medi-Cal FFS rate…. COHS Contract A.8.8

Claims Processing Contractor shall pay all claims submitted by contracting providers in accordance with this provision, unless the contracting provider and Contractor have agreed in writing to an alternate payment schedule.

A. Contractor shall pay all claims submitted by contracting providers in accordance with this provision….Contractor shall comply with 42 USC Section 1396a(a)(37) and Health and Safety Code Sections 1371 through 1371.39.

B. Contractor shall pay 90 percent of all clean claims from practitioners who are in individual or group practices or who practice in shared health facilities, within 30 days of the date of receipt and 99 percent of all clean claims within 90 days. The date of receipt shall be the date Contractor receives the claim, as indicated by its date stamp on the claim. The date of payment shall be the date of the check or other form of payment….

COHS Contract A.8.4



Page 11 of 19

3.5 EMERGENCY SERVICES AND FAMILY PLANNING CLAIMS

Claims Processing Time for Reimbursement. A plan and a plan's capitated provider shall reimburse each complete claim, or portion thereof, whether in state or out of state, as soon as practical, but no later than thirty (30) working days after the date of receipt of the complete claim by the plan or the plan's capitated provider, or if the plan is a health maintenance organization, 45 working days after the date of receipt of the complete claim by the plan or the plan's capitated provider, unless the complete claim or portion thereof is contested or denied, as provided in subdivision (h). CCR, Title 28, Section 1300.71(g)

SUMMARY OF FINDINGS:

3.5.1 Claims Process The Plan is required to reimburse each complete claim, or portion thereof, whether in state or out of state no later than 45 working days after the date of receipt of the claim by the Plan or the Plan’s capitated provider (Title 28, CCR, Section 1300.71(g)).

The Plan has written policies for the processing of emergency services and family planning claims. However, deficiencies were noted in the updating of auto adjudication procedures in their claims system. Five family planning and three emergency care claims were inappropriately denied or paid late due to information not being continually updated and configured in their system. For example, four of these claims were denied due to providers being identified incorrectly as Non-Medi-Cal. These system issues resulted in the delay of paid claims and caused financial hardship on service providers.

RECOMMENDATION: 3.5.1 Continually update claims system configuration with current provider information and adjudication

procedures.



Page 12 of 19

CATEGORY 4 – MEMBER’S RIGHTS 4.1 GRIEVANCE SYSTEM Member Grievance System and Oversight: Contractor shall implement and maintain a Member Grievance system in accordance with Title 28 CCR Section 1300.68 (except Subdivision 1300.68(c)(g) and (h)), 1300.68.01(except Subdivision 1300.68.01(b) and (c)), Title 22 CCR Section 53858, Exhibit A, Attachment 13, Provision 4, paragraph D.13, and 42 CFR 438.420(a)(b) and (c). Contractor shall resolve each grievance and provide notice to the Member as quickly as the Member’s health condition requires, within 30 calendar days from the date Contractor receives the grievance. Contractor shall notify the Member of the grievance resolution in a written member notice. COHS Contract A.14.1

Contractor shall implement and maintain procedures…to monitor the Member’s Grievance system and the expedited review of grievances required under Title 28 CCR Sections 1300.68 and 1300.68.01 and Title 22 CCR Section 53858…. (as required by Contract) COHS Contract A.14.2

Contractor shall maintain, and have available for DHCS review, grievance logs, including copies of grievance logs of any sub-contracting entity delegated the responsibility to maintain and resolve grievances. Grievance logs shall include all the required information set forth in Title 22 CCR Section 53858(e). COHS Contract A.14.3.A

SUMMARY OF FINDINGS: 4.1.1 Grievance Data

The Plan is required to report quarterly, the number of calls received by call type: questions, grievances, access to services, request for health education, etc. (Contract, Exhibit A, Attachment 13.3). The Plan is also required to maintain, and have available for DHCS review, grievance logs, including copies of grievance logs of any sub-contracting entity delegated the responsibility to maintain and resolve grievances. The Plan is required to submit quarterly grievance reports to DHCS (Contract, Exhibit A, Attachment 14.3.A and B).

The Plan’s call center reports are submitted to DHCS with no grievance data. The Plan states that the template required by MCQMD does not include grievances and is not included in their reports. Exempt grievance data is maintained separately by the Plan and not reported to DHCS. Quarterly grievance reports submitted to DHCS contain only formal grievance data. The Plan indicates that the report format does not account for exempt grievances and is not included in their logs or reports.

4.1.2 Grievance System

The Plan is required to ensure that the grievance submitted is reported to an appropriate level. To this end, the Plan shall ensure that any grievance involving the appeal of a denial based on lack of Medical Necessity, appeal of a denial of a request for expedited resolution of a grievance, or an appeal that involves clinical issues shall be resolved by a health care professional with appropriate clinical expertise in treating the member’s condition or disease. The Plan is required to ensure the participation of individuals with authority to require corrective action. Grievances related to medical quality of care issues shall be referred to the Plan’s Medical Director. The Plan is required to ensure that the person making the final decision for the proposed resolution of a grievance has not participated in any prior decisions related to the grievance and is a health care professional with clinical expertise (Contract, Exhibit A, Attachment 14.2.D and E).



Page 13 of 19

Grievances received over the telephone that are not coverage disputes, disputed health care services involving medical necessity or experimental or investigational treatment, and that are resolved by the close of the next business day, are exempt from the requirement to send a written acknowledgment and response (Title 28, CCR, Section 1300.68,d(8)).

Plan Policy #CGA003: Medi-Cal Member Grievance System states the Plan takes member complaints, appeals and state hearings seriously and strives to reach a fair resolution after a thorough evaluation of each issue. If the complaint is about quality of care, denial of care, diagnosis or treatment, or other medical quality issues, grievance staff will consult with the grievance clinical lead and/or medical director. The grievance clinical lead will refer any Potential Quality Issues (PQI) to the Quality Improvement Department for review and escalation to the Chief Medical Officer or physician reviewer designee through the peer-review process.

The Plan has a documented process for the oversight of the grievance system. However, deficiencies were noted in its operational controls. Eight formal and eleven exempt grievances were not escalated to a physician reviewer with clinical expertise and the authority to require corrective action. For example, a member complained of ongoing sores on her legs and expressed concerns of losing her legs. Eleven exempt grievances did not meet criteria as exempt due to the presence of a medical/clinical issue, as required in Title 28, CCR, Section 1300.68,d(8). For example, a member had seizures due to a previous head injury and complained of not being able to schedule an appointment. The Plan changed her PCP and did not address the medical issue. Five formal and eleven exempt grievances did not identify and refer Potential Quality Issues to the Quality Improvement Department. The Plan’s response is that missing PQI opportunities for exempt grievances would be uncommon and would be discovered during their daily operations.

RECOMMENDATION: 4.1.1 Develop and implement procedures to ensure all grievance data, including exempt grievances, are reported

in the Call Center Reports and Quarterly Grievance Reports submitted to DHCS. 4.1.2 Monitor and continually improve system controls to ensure grievances with medical/clinical issue are

escalated to a physician reviewer with clinical expertise and authority to require corrective action. Monitor and continually improve operational controls to ensure Potential Quality Issues are identified and referred to the Quality Improvement department.



Page 14 of 19

4.3 CONFIDENTIALITY RIGHTS Health Insurance Portability and Accountability Act (HIPAA) Responsibilities:

A. Responsibilities of Business Associate. 2. Safeguards. To implement administrative, physical, and technical safeguards that reasonably and

appropriately protect the confidentiality, integrity, and availability of the PHI, including electronic PHI, that it creates, receives, maintains, uses or transmits on behalf of DHCS, in compliance with 45 CFR sections 164.308, 164.310 and 164.312, and to prevent use or disclosure of PHI other than as provided for by this Agreement. Business Associate shall implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications and other requirements of 45 CFR section 164, subpart C, in compliance with 45 CFR section 164.316….(as required by Contract)

J. Breaches and Security Incidents. During the term of this Agreement, Business Associate agrees to

implement reasonable systems for the discovery and prompt reporting of any breach or security incident, and to take the following steps: 1. Notice to DHCS. (1) To notify DHCS immediately by telephone call plus email or fax upon the

discovery of a breach of unsecured PHI or PI in electronic media or in any other media if the PHI or PI was, or is reasonably believed to have been, accessed or acquired by an unauthorized person, or upon the discovery of a suspected security incident that involves data provided to DHCS by the Social Security Administration. (2) To notify DHCS within 24 hours by email or fax of the discovery of any suspected security incident, intrusion or unauthorized access, use or disclosure of PHI or PI in violation of this Agreement and this Addendum, or potential loss of confidential data affecting this Agreement. A breach shall be treated as discovered by Business Associate as of the first day on which the breach is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing the breach) who is an employee, officer or other agent of Business Associate….

2. Investigation and Investigation Report. To immediately investigate such security incident, breach, or unauthorized access, use or disclosure of PHI or PI. Within 72 hours of the discovery, Business Associate shall submit an updated “DHCS Privacy Incident Report” containing the information marked with an asterisk and all other applicable information listed on the form, to the extent known at that time, to the DHCS Program Contract Manager, the DHCS Privacy Officer, and the DHCS Information Security Officer:

3. Complete Report. To provide a complete report of the investigation to the DHCS Program Contract Manager, the DHCS Privacy Officer, and the DHCS Information Security Officer within ten (10) working days of the discovery of the breach or unauthorized use or disclosure….

COHS Contract G.III.C, J

SUMMARY OF FINDINGS: 4.3.1 Discovery of a Breach or Suspected Security Incident Dates

The Plan is required to implement reasonable systems for the discovery and prompt reporting of any breach or security incident. The Plan is required to notify DHCS of the discovery of any suspected security incident, intrusion or unauthorized access, use or disclosure of Protected Health Information (PHI) or Personal Information (PI). There are different timelines depending on the type of unsecured PHI. The contract states, A breach shall be treated as discovered by the Business Associate as of the first day on which the breach is



Page 15 of 19

known, or by exercising reasonable diligence would have been known, to any person who is an employee, officer or other agent of business associate (Contract, Exhibit G, Attachment III.C.J.1). Plan Policy #CMP18: Reporting Privacy Issues states the Plan establishes the process for Plan staff, providers, and business associates to report potential privacy issues to the Privacy Officer. Through training and in-service, all plan staff, providers, and business associates are informed of privacy laws and importance of identifying and reporting any privacy issues. The Plan has written policies for the documenting of breach / suspected security incident dates. However, deficiencies were noted in the oversight of the system. The dates of discovery for six Health Insurance Portability and Accountability Act (HIPAA) files disagree with the dates in the Privacy Incident Log and Compliance and Privacy Reporting Forms. For three HIPAA files, there were no documented dates showing when the HIPPA incident was received. The lack of oversight and consistency in recording breach/suspected security incident dates causes inaccurate reporting to DHCS regarding suspected HIPPA Incidents. Interviews with the Plan staff indicated the inconsistency was due to the Plan using the date the Compliance Department received the incident report, instead of using the date discovered by their business associates.

RECOMMENDATION: 4.3.1 Develop and implement oversight to ensure the documentation of accurate dates for suspected security

incidents/breaches.



Page 16 of 19

CATEGORY 5 – QUALITY MANAGEMENT 5.2 PROVIDER QUALIFICATIONS Credentialing and Re-credentialing: Contractor shall develop and maintain written policies and procedures that include initial credentialing, recredentialing, recertification, and reappointment of Physicians including Primary Care Physicians and specialists in accordance with the MMCD, Credentialing and Recredentialing Policy Letter, MMCD Policy Letter 02-03. Contractor shall ensure those policies and procedures are reviewed and approved by the governing body, or designee. Contractor shall ensure that the responsibility for recommendations regarding credentialing decisions will rest with a credentialing committee or other peer review body. COHS Contract A.4.12

Standards: All providers of Covered Services, including physicians and specialists, must be qualified in accordance with current applicable legal, professional, and technical standards and appropriately licensed, certified or registered and have a valid National Provider Identifier (NPI) number. COHS Contract A.4.12.A Medi-Cal Managed Care Provider Training: Contractor shall ensure that all Primary Care Providers receive training regarding the Medi-Cal Managed Care program in order to operate in full compliance with the Contract and all applicable Federal and State statutes and regulations. Contractor shall ensure that provider training relates to Medi-Cal Managed Care services, policies, procedures and any modifications to existing services, policies or procedures. Contractor shall conduct training for all providers no later than 10 (ten) working days after the Contractor places a newly contracted provider on active status and shall complete the training within 30 calendar days of placing on active status…. COHS Contract A.7.5

Delegated Credentialing: Contractor may delegate credentialing and recredentialing activities. If Contractor delegates these activities, Contractor shall comply with Provision 6. Delegation of Quality Improvement Activities… COHS Contract A.4.12.C

Disciplinary Actions: Contractor shall implement and maintain a system for the reporting of serious quality deficiencies that result in suspension or termination of a practitioner to the appropriate authorities. Contractor shall implement and maintain policies and procedures for disciplinary actions including reducing, suspending, or terminating a practitioner’s privileges. Contractor shall implement and maintain a provider appeal process. COHS Contract A.4.12.E

Medi-Cal and Medicare Provider Status: The Contractor will verify that their subcontracted providers, including physicians and specialists, have not been terminated as Medi-Cal or Medicare providers or have not been placed on the Suspended and Ineligible Provider list. Terminated providers in either Medicare or Medi-Cal/Medicaid or on the Suspended and Ineligible Provider list, cannot participate in the Contractor’s provider network. COHS Contract A.4.12.F



Page 17 of 19

SUMMARY OF FINDINGS: 5.2.1 New Providers Training Timeframes

The Plan is required to conduct training for all providers no later than 10 working days after the Plan places a newly contracted provider on active status and shall complete the training within 30 calendar days of placing on active status (Contract, Exhibit A, Attachment 7.5). Plan Policy #MPPRO1102: Contracted Provider Education states that the Provider Relations Department is responsible to ensure that newly contracted providers are educated within 10 days of approval by the Plan’s Credentialing Committee. If the provider education is not completed within the timeframe, the reason for the delay has to be documented and noted on the training schedule.

The Plan has written policies identifying the required 10 day timeframe. However, the Plan’s Policy #MPPRO 1102 did not document the contract requirement to complete the training within 30 calendar days of placing a new provider on active status. Four providers did not receive the training within the required 10 working day timeframe. Two of those providers did not complete their training within the 30 calendar day requirement. One provider completed the training 86 calendar days after the credentialed date with no documentation of the reason for delay. The Plan has no oversight of the new provider training system.

RECOMMENDATION: 5.2.1 Develop and implement oversight to ensure new providers receive training within the required timeframes.

Revise Policy #MPPRO 1102 to include contract requirement.



Page 18 of 19

CATEGORY 6 – ADMINISTRATIVE AND ORGANIZATIONAL CAPACITY

6.3 FRAUD AND ABUSE Fraud and Abuse Reporting B. Contractor shall meet the requirements set forth in 42 CFR 438.608 by establishing administrative and

management arrangements or procedures, as well as a mandatory compliance plan, which are designed to guard against fraud and abuse. These requirements shall be met through the following: 4. Fraud and Abuse Reporting

Contractor shall report to DHCS all cases of suspected fraud and/or abuse where there is reason to believe that an incident of fraud and/or abuse has occurred by subcontractors, members, providers, or employees. Contractor shall conduct, complete, and report to DHCS, the results of a preliminary investigation of the suspected fraud and/or abuse within ten (10) working days of the date Contractor first becomes aware of, or is on notice of, such activity….

5. Tracking Suspended Providers Contractor shall comply with Title 42 CFR Section 438.610. Additionally, Contractor is prohibited from employing, contracting or maintaining a contract with Physicians or other health care providers that are excluded, suspended or terminated from participation in the Medicare or Medi- Cal/Medicaid programs. A list of suspended and ineligible providers is maintained in the Medi-Cal Provider Manual, which is updated monthly and available on line and in print at the DHCS Medi-Cal website (www.medi-cal.ca.gov) and by the Department of Health and Human Services, Office of Inspector General, List of Excluded Individuals and Entities (http://oig/hhs.gov). Contractor is deemed to have knowledge of any providers on these lists. Contractor must notify the Medi-Cal Managed Care Program/Program Integrity Unit within ten (10) State working days of removing a suspended, excluded, or terminated provider from its provider network and confirm that the provider is no longer receiving payments in connection with the Medicaid program.

COHS Contract E.2.27.B

SUMMARY OF FINDINGS: 6.3.1 Preliminary Investigation of Suspected Fraud and/or Abuse Cases

The Plan shall conduct, complete and report to DHCS Compliance Unit the results of a preliminary investigation of the suspected fraud and/or abuse within ten (10) working days of the date the Plan first becomes aware of such activity (Contract, Exhibit E, Attachment 2.27.B.4). Plan Policy #CD-01: FWA Processing states all cases will receive a minimum workup based on the allegations in the complaint. The workup must not delay a notification to regulatory agencies beyond the notification timeframes. MC 609 reports are to be made no later than 10 working days that the Plan is first aware or is notified of fraud and abuse activity. The Plan has written policies for identifying the process for reporting the results of a preliminary investigation of suspected fraud/abuse to DHCS. However, deficiencies were noted in the oversight of the system. The Plan did not report the results of three preliminary investigations to the DHCS Compliance Unit within the required timeframe. In one case, the Plan did not submit the results of the preliminary investigation to DHCS until 47 days after the identification of the event. The Compliance Committee Minutes for September 1, 2015, indicated that the Plan will implement new desk top procedures, update policies, hire additional personnel and create detailed trackers for proper timelines to be met and personnel notified. The Plan stated that their Compliance Auditor will begin to conduct random audits on timeliness and documentation of fraud and abuse cases starting September 2016.



Page 19 of 19

RECOMMENDATION: 6.3.1 Develop and implement oversight to ensure all suspected fraud/abuse cases are reported to DHCS within

the required timeframes.

MEDICAL REVIEW – SOUTHERN SECTION I – LOS ANGELES AUDITS AND INVESTIGATIONS

DEPARTMENT OF HEALTH CARE SERVICES

Partnership HealthPlan of California

Contract Number: 08-85222 State Supported Services

Audit Period: January 1, 2015 through December 31, 2015

Report Issued: October 25, 2016

TABLE OF CONTENTS I. INTRODUCTION .............................................................................1 II. COMPLIANCE AUDIT FINDINGS ...................................................2

1

I. INTRODUCTION

This report presents the audit findings of Partnership HealthPlan of California’s (The Plan) State Supported Services Contract No.: 08-85222. The State Supported Services Contract covers abortion services with the Plan. The onsite audit was conducted from January 25, 2016 through February 5, 2016. The audit period is January 1, 2015 through December 31, 2015 and consisted of document review of materials supplied by the Plan and interviews conducted onsite.

2

COMPLIANCE AUDIT FINDINGS (CAF)

PLAN: Partnership HealthPlan of California AUDIT PERIOD: January 1, 2015 through December 31, 2015 DATE OF AUDIT: January 25, 2016 through February 5, 2016

STATE SUPPORTED SERVICES CONTRACT REQUIREMENTS

Abortion Contractor agrees to provide, or arrange to provide, to eligible Members the following State Supported Services: Current Procedural Coding System Codes*: 59840 through 59857 HCFA Common Procedure Coding System Codes*: X1516, X1518, X7724, X7726, Z0336 *These codes are subject to change upon the Department of Health Services’ (DHS’) implementation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) electronic transaction and code sets provisions. Such changes shall not require an amendment to this Contract. State Supported Services Contract Exhibit A.1 SUMMARY OF FINDINGS:

Abortion is a sensitive service covered by the Medi-Cal program without prior authorization for out-patient abortions. In-patient abortions require a prior authorization. The Plan must provide members pregnancy termination procedures from in-or-out of network providers. The Plan’s policies and procedures indicate that members may receive abortion-related services from any family planning provider, including those not contracted with the Plan, without authorization. Providers must be made available to members receiving this care after hours and must have made arrangements with a suitable facility when emergency surgical intervention is necessary, including after hours. Members are notified of sensitive services through the Evidence of Coverage (EOC) Member Handbook. Members may receive family planning services, including abortion, without prior approval. Minor Consent Services include services of a sensitive nature for minors that do not need parental consent or permission to access, including abortion services. The Plan’s website provides information regarding Sensitive Services which includes abortion counseling and services which do not require a prior authorization. Members may go to their primary care physician or any Medi-Cal provider for sensitive services. Providers are notified that prior authorizations are not required for sensitive services through the Plan’s policies and procedures, website, and provider in-services. The Plan’s claims system has no configuration to indicate that a prior authorization is needed for the sensitive services claims. The sensitive service claims are processed the same as the family planning claims. The Plan’s policies and procedures include the Health Care Common Procedure Coding System (HCPCS) Codes S0190 (Mifepristone, 200 mg), S0191 (Misoprostol, 200 mcg), and S0199 (Medical Abortion); Current Procedural Terminology (CPT) Codes 59840 – 59857, and International Classification of Diseases (ICD-9) Codes 635.00 – 635.92 to be used for billing medical abortions. There were no sensitive service grievances during the review period. The Plan provides or arranges to provide eligible members with the required State Supported Services and is in compliance with contract requirements. RECOMMENDATION:

None