Medicaid; Revisions to State Medicaid Fraud Control Unit Rules

AGENCIES:

Office of Inspector General (OIG) and Centers for Medicare & Medicaid Services (CMS), Department of Health and Human Services (HHS).

ACTION:

Final rule.

SUMMARY:

This final rule amends the regulation governing State Medicaid Fraud Control Units (MFCUs or Units). The rule incorporates statutory changes affecting the Units as well as policy and practice changes that have occurred since the regulation was initially issued in 1978. These changes include a recognition of OIG's delegated authority; Unit authority, functions, and responsibilities; disallowances; and issues related to organization, prosecutorial authority, staffing, recertification, and the Units' relationship with Medicaid agencies. The rule is designed to assist the MFCUs in understanding their authorities and responsibilities under the grant program, clarify the flexibilities the MFCUs have to operate their programs, and reduce administrative burden, where appropriate, by eliminating duplicative and unnecessary reporting requirements.

DATES:

These regulations are effective on May 21, 2019.

FOR FURTHER INFORMATION CONTACT:

Susan Burbach, (202) 708-9789, or Richard Stern, (202) 205-0572, Office of Inspector General.

SUPPLEMENTARY INFORMATION:

Legal Authority

The legal authority for this regulatory action is found in the Social Security Act (the Act) as follows:

Part 1007: Sections 1902(a)(61), 1903(a)(6), 1903(b)(3), 1903(q), and 1102 of the Act.

Part 455: Section 1102 of the Act.

Executive Summary

A. Purpose of Regulatory Action

The mission of the MFCUs, as described in section 1903(q) of the Act, is to investigate and prosecute Medicaid provider fraud and patient abuse or neglect that occurs in health care facilities or board and care facilities. The OIG, on behalf of HHS, has the responsibility to administer a grant award to each of the MFCUs and to provide oversight for MFCU operations. The purpose of this regulatory action is to revise regulations that were initially issued after the inception of the MFCU grant program in 1977.

We are amending this regulation for three specific reasons. First, we are incorporating into the rule statutory changes that have occurred since the 1977 enactment of the Medicare-Medicaid Anti-Fraud and Abuse Amendments (Pub. L. 95-142), which amended section 1903(a) of the Act to provide for Federal participation in the costs attributable to establishing and operating a MFCU. Second, we are aligning the rule with practices and policies that have developed and evolved since the initial version of the rule was issued in 1978, 43 FR 32078 (July 24, 1978), now codified at 42 CFR part 1007. Finally, we are revising the regulation to reduce burden on the Units, when doing so does not undermine OIG's oversight role or the Units' mission.

For ease of reading, we have republished the entirety of part 1007 and incorporated the changes as part of that publication. However, for some sections within part 1007, we did not make substantive changes.

B. Summary of Major Provisions

(1) Statutory Changes. We incorporate statutory changes that have occurred since 1977, including (1) extending funding for State MFCUs by authorizing a Federal matching rate of 90 percent for the first 3 years of operation and a Federal matching rate of 75 percent thereafter, (2) establishing a Medicaid State plan requirement that a State must operate an effective Unit, (3) requiring the Secretary of Health and Human Services to establish standards under which Units must be operated, (4) allowing Units to seek approval from the relevant Inspector General to investigate and prosecute violations of State law related to fraud in any aspect of the provision of health care services and activities of providers of such services under any Federal health care program, including Medicare, as long as the fraud is primarily related to Medicaid, and (5) giving Units the option to investigate and prosecute patient abuse or neglect in board and care facilities, regardless of whether the facilities receive Medicaid payments. With the exception of the establishment of standards, all of these statutory changes were self-implementing and have been operational since their statutory effective dates. Performance standards for MFCU operations were initially published in the Federal Register in 1994 and revised in 2012.

(2) Office of Inspector General Authority. The final rule, in referring to OIG as the oversight agency for the MFCUs, recognizes that the authority for certification and recertification of the Units, as well as the administration of a Federal grant award to operate the Units, was transferred from the predecessor agency of CMS (the Health Care Financing Administration) to OIG on July 27, 1979.

(3) Definition of Key Terms. The final rule adds definitions of key terms that clarify issues related to MFCU authority under the grant. All the definitions are consistent with other regulatory definitions and with longstanding practice.

(4) Organizational Requirements. The final rule clarifies, consistent with OIG policy and longstanding MFCU practice, what it means to be a “single, identifiable entity of State government” as required under the statute. The regulations specify that a MFCU must have a single director to whom all staff report, operate under a budget that is separate from that of its parent agency, and generally have offices in their own contiguous space.

(5) Prosecutorial Authority Requirements. The final rule, consistent with statutory changes and longstanding practice, makes amendments to the prosecutorial authority requirement options to include the prosecution of patient or resident abuse and neglect and to include formal written procedures for making referrals to the State Attorney General or another office with statewide prosecutorial authority.

(6) Agreement with Medicaid Agency. The final rule requires that the agreement with the Medicaid agency establish regular communication, procedures for coordination, and procedures by which the Unit will receive referrals of potential fraud from managed care organizations. This revision is consistent with the recent changes to the Medicaid managed care regulation in 42 CFR part 438 that require managed care organizations to refer potential fraud to the Medicaid agency or to the MFCU.

(7) Duties and Responsibilities. The final rule, consistent with published performance standards, requires that Units submit all convictions to OIG for purposes of program exclusion within 30 days of sentencing or as soon as practicable if a Unit encounters delays from the courts. The final rule also clarifies, consistent with existing practice, the requirement that a Unit make information available to, and coordinate with, OIG investigators and attorneys, or with other Federal investigators and prosecutors, on Medicaid fraud and investigations or prosecutions involving the same suspects or allegations.

(8) Staffing Requirements. The final rule clarifies that Units may choose to employ professional employees as full- or part-time employees so long as they devote their “exclusive effort” to Unit functions. The final rule also establishes that a Unit will employ a director and that all Unit employees will be under the direction and supervision of the Unit director. The rule establishes that Unit professional employees may also obtain outside employment with some restriction and may perform temporary assignments that are not a required function of the Unit, but may not receive Federal financial participation for those assignments. The rule also clarifies that Units may employ employees or consultants with specialized knowledge and skills, but that investigation and prosecution functions may not be outsourced through consultant agreements or other contracts. Finally, the rule requires Units to provide training for professional employees on Medicaid fraud and patient or resident abuse and neglect matters. These requirements all codify and are consistent with current Unit operations and OIG policy on Unit staffing.

(9) Recertification Requirements. The final rule amends the regulation to reflect the Unit recertification process. This includes describing what OIG requires annually as part of recertification, including submission of reapplication materials and statistical data. The final rule also eliminates the requirement to submit an “annual report,” thus reducing burden. The final rule clarifies the factors that OIG considers when recertifying a Unit. The rule also creates a process for notifying the Unit of approval or denial of recertification and procedures for reconsideration should OIG deny recertification.

(10) Federal Financial Participation (FFP). The final rule reflects that, except for Units with OIG approval to conduct data mining under this part, Units may not receive FFP for data mining activities that duplicate surveillance and utilization review responsibilities of State Medicaid agencies, but may engage in activities other than data mining to identify situations in which fraud may exist, such as efforts to increase referrals through program outreach activities.

(11) Disallowance Procedures. The final rule sets forth procedures for OIG disallowances of FFP and for Unit requests for reconsideration and appeal of disallowances. These procedures are consistent with, and prompted by, a 2008 amendment to the Act, adding section 1116(e), which provided States the option to seek reconsideration of a disallowance by an agency prior to an appeal to the Departmental Appeals Board. The procedures are intended to mirror those that were implemented earlier for CMS disallowances to the States, 42 CFR 430.42.

(12) CMS Companion Regulation. To ensure that both the Unit and the Medicaid agency are required to have an agreement with each other, the final rule includes amendments to the CMS regulation at 42 CFR 455.21 to require that the Medicaid agency has an agreement with the Unit. The amendments to this section were developed in collaboration with CMS.

C. Costs and Benefits

There are no significant costs associated with the regulatory revisions, and the revisions do not impose any mandates on State, local, or Tribal governments or on the private sector that would represent significant costs.

I. Background

A. Statutory Changes Since 1977 Implemented by This Rulemaking

(1) Omnibus Reconciliation Act of 1980 (Pub. L. 96-499). The Medicare-Medicaid Anti-Fraud and Abuse Amendments added section 1903(a)(6) of the Social Security Act (the Act), which authorized a Federal matching rate of 90 percent for the establishment and operation of State Medicaid Fraud Control Units (MFCUs) for fiscal years 1978 through 1980. The Omnibus Reconciliation Act of 1980 extended funding for State MFCUs by amending section 1903(a)(6) of the Act to authorize a Federal matching rate of 90 percent for the first 3 years of operation and a Federal matching rate of 75 percent thereafter.

(2) Omnibus Budget Reconciliation Act of 1993 (Pub. L. 103-66). The Omnibus Budget Reconciliation Act of 1993 added section 1902(a)(61) to the Act, establishing a Medicaid State plan requirement that a State must operate an effective MFCU, unless the State demonstrates that effective operation of a Unit would not be cost effective and that, in the absence of a Unit, beneficiaries will be protected from abuse and neglect. The statute further requires that the Units be operated in accordance with standards established by the Secretary of Health and Human Services (HHS).

(3) Ticket to Work and Work Incentives Improvement Act of 1999 (Pub. L. 106-170). In the Ticket to Work and Work Incentives Improvement Act of 1999, Congress amended section 1903(q) of the Act to extend the authority of MFCUs in two ways. First, the Units may seek approval from the relevant Federal Inspector General (in most circumstances the HHS Inspector General) to investigate and prosecute violations of State law related to any aspect of fraud in connection with “the provision of health care services and activities of providers of such services under any Federal health care program,” including Medicare, “if the suspected fraud or violation of State law is primarily related to” Medicaid. Second, the law gives Units the option to investigate and prosecute patient abuse or neglect in “board and care facilities,” regardless of whether those facilities receive Medicaid payments.

B. Regulatory, Practice, and Policy Changes to the MFCU Program Since 1978

Prior to the publication of this final rule, the regulation was amended on two occasions. First, the regulation was amended at § 1007.9(e)-(g) (76 FR 5970 (February 2, 2011)) to implement payment suspension provisions found in the Patient Protection and Affordable Care Act, Public Law 111-148. Second, the regulation was modified at § 1007.20 to allow FFP for data mining under certain circumstances (78 FR 29055 (May 17, 2013)). With the exception of these two revisions, the regulation had not received a revision since it was originally published in 1978. In the ensuing years, growth of the MFCU program to 50 Units (49 States and the District of Columbia), as well as changes in MFCU practice, health care, and the workplace, have led to the need to revise the regulation. Further, in 1994, pursuant to section 1902(a)(61) of the Act, the Office of Inspector General (OIG), in consultation with the Units, developed 12 performance standards to be used in assessing the operations of MFCUs. These performance standards have since been revised at 77 FR 32645 (June 1, 2012). OIG uses the performance standards to annually recertify each Unit and to determine if a Unit is effectively and efficiently carrying out its duties and responsibilities. On September 20, 2016, OIG published in the Federal Register (81 FR 64383) a Notice of Proposed Rulemaking (Proposed Rule), which we are finalizing with publication of this final rule.

C. Summary of the 2016 Proposed Rule

The Proposed Rule set forth proposed amendments to the State Medicaid Fraud Control Unit regulations. With respect to definitions, we proposed to modify the current definition of “provider,” eliminate the definition of “employ or employee,” and add definitions for “full-time employee,” “part-time employee,” “professional employee,” “exclusive effort,” “director,” “fraud,” “abuse of patients,” “board and care facility,” “health care facility,” “misappropriation of patient funds,” “neglect of patients,” and “program abuse.”

With respect to requirements for certification, we proposed to define the phrase “single, identifiable entity,” specifically, that a Unit must (1) be a single organization reporting to the single Unit director; (2) operate under its own budget that is separate from that of its parent division or agency; and (3) have the headquarters office and any field offices each in their own contiguous space. We also proposed to clarify that Units must satisfy the definition to be certified and recertified.

With respect to prosecutorial authority requirements, we proposed that the regulation be amended to include the establishment of formal procedures for referring cases of patient abuse and neglect to the appropriate prosecuting authority when there is no State agency with statewide authority and capability for patient abuse prosecutions. We proposed that the regulation be amended to reference the office of the State Attorney General “or another office with statewide prosecutorial authority” and to clarify that the formal procedures should be written procedures.

With respect to the Unit's relationship to and its agreement with the Medicaid agency, in the joint Proposed Rule, OIG and the Centers for Medicare & Medicaid Services (CMS) proposed to add additional guidance to the MFCU rule and the CMS rule to clarify that both the Medicaid agency and the Unit must enter into a written agreement, such as a memorandum of understanding. We also proposed to add to both rules that the written agreement include certain required elements. Finally, we proposed an amendment to require, consistent with changes to the law and regulation governing the referral of credible allegations of fraud, that the Unit provide certification to the Medicaid agency, upon request on a quarterly basis, that any matter accepted on the basis of a referral continues to be under investigation and thus warrants continuation of payment suspension.

With respect to functions and responsibilities of a Unit, we proposed to require the Unit to review complaints involving misappropriation of funds, as we believed that making the review of such complaints mandatory, rather than optional, is consistent with the broad statutory responsibility for patient abuse or neglect. Consistent with the statute, we also proposed to revise the regulation to specify that the MFCU must obtain written permission from the relevant Federal Inspector General to investigate cases of provider fraud in health care programs other than Medicaid and that the Units report annually to OIG on any approvals for extended investigative authority from any Federal Inspector General. To be consistent with the statute, we also proposed to permit investigations of patient abuse or neglect in board and care facilities. We proposed that applicable State laws pertaining to Medicaid fraud include criminal statutes as well as civil false claims statutes or other civil authorities. We further proposed that if no State civil fraud statute exists, Units should make appropriate referrals of meritorious civil cases to Federal investigators or prosecutors, such as the U.S. Department of Justice (DOJ) or the U.S. Attorney's Office, as well as to the OIG Office of Investigations and Office of Counsel to the Inspector General. We proposed to clarify that when a Unit discovers that overpayments have been made to a provider or facility, the Unit must either recover the overpayment as part of its resolution of a fraud case or refer the matter to the proper State agency for collection.

With respect to coordination with Federal partners, we proposed to retain the current requirement that a Unit make available to Federal investigators and prosecutors and OIG attorneys all information in its possession concerning Medicaid fraud and that the Unit coordinate with such officials any Federal and State investigations or prosecutions involving the same suspects or allegations. However, we also proposed to expand the requirement to further ensure effective collaboration between the Units and OIG investigators and attorneys, or other Federal investigators and Federal prosecutors by (1) establishing a practice of regular meetings or communication; (2) making appropriate referrals to OIG investigators and attorneys, other Federal investigators, and Federal prosecutors; and (3) developing written procedures for those coordinating actions.

We proposed to require a Unit to provide adequate safeguards to protect sensitive information and data under the Unit's control, updating a requirement that had largely referred to paper case files and other case-related materials, such as evidence.

We proposed to amend the regulations to require that a Unit transmit to OIG, for purposes of excluding convicted individuals and entities from participation in Federal health care programs under section 1128 of the Act, pertinent documentation on all convictions obtained by the Unit, including those cases investigated jointly with another law enforcement agency, as well as those prosecuted by another agency at the local, State, or Federal level. We proposed that such information be provided within 30 days of sentencing or, if Units are unable to obtain pertinent information from the sentencing court within 30 days, as soon as reasonably practicable.

With respect to staffing requirements, we proposed to revise the regulations to clarify that Unit professional employees do not need to be “full time” to receive FFP, but to retain the longstanding policy and practice that FFP is permitted only for Unit professional employees who are devoted “exclusively” to the MFCU mission except for limited circumstances that are specifically described in the regulation. We also proposed that, to be eligible for FFP, professional employees may not be employed by other State agencies during nonduty hours and that professional employees may obtain employment outside of State government, if State law allows it, but only if the outside employment presents no conflict of interest to Unit activities. We proposed to permit Unit professional employees to engage in temporary assignments that are not within the functions and responsibilities of a Unit only if such assignments are truly limited in duration. Such assignments would not be funded by the Federal MFCU grant. We proposed to add a requirement that the Unit must employ a director who supervises all Unit employees, either directly or through subordinate Unit managers.

We also proposed to clarify that a Unit may not receive FFP when it relies on individuals not employed directly by the Unit for the investigation or prosecution of cases, including individuals retained through consultant agreements or other contractual arrangements, but that Units may receive FFP for the employment, or retention through consultant agreements or other arrangements, of individuals with particular knowledge, skills, and/or expertise that a Unit believes will support the Unit in the investigation or prosecution of cases. We also proposed to add a requirement that, consistent with MFCU performance standards, a Unit must provide training for its professional employees for the purpose of establishing and maintaining proficiency in the investigation and prosecution of Medicaid fraud and patient abuse and neglect. We proposed to clarify that a Unit may hire administrative and support staff on a part-time basis. Finally, we proposed minor clarifications to the qualifications of attorneys, auditors, and the senior investigator.

With respect to certification, we proposed to clarify that initial certification will be based on the information and documentation specified in the initial application and to eliminate the requirement that an initial application include a projection of caseload.

With respect to recertification, we proposed to revise regulations to reflect the recertification process that has evolved since the program began. Specifically, we proposed that the regulation would (1) describe the information that must be provided to OIG on an annual basis, including the recertification application and statistical data; (2) describe other information considered for recertification; (3) clarify the basis for recertification by OIG; (4) create a procedure in which OIG notifies the Unit whether the reapplication is approved or denied by the Unit's recertification date; (5) clarify that an approved reapplication may be subject to special conditions; and (6) establish basic procedures for reconsideration of an OIG denial of recertification. We also proposed modifications to the annual report.

With respect to FFP rates and eligible costs, we proposed to modify the regulation to reflect that, under law, FFP is available at the rate of 90 percent during the first 12 quarters of a Unit's operation and at 75 percent thereafter, beginning with the 13th quarter of a Unit's operation. We also proposed to clarify that each quarter of reimbursement at the 90 percent matching rate is counted in determining when the 13th quarter begins and that quarters of Unit operation do not have to be consecutive to accumulate for purposes of determining when the 90 percent matching period has ended. Additionally, we proposed to clarify in regulation that a Unit may receive FFP for its efforts to increase referrals through program outreach activities. We also proposed to clarify the prohibition on the ability of Units to receive FFP to “identify situations in which a question of fraud may exist” by clarifying the ability of Units to engage in activities, other than data mining, to identify potential civil or criminal fraud in the Medicaid program.

In addition, we proposed to clarify that the longstanding FFP prohibition for beneficiary fraud (unless the suspected fraud involves conspiracy with a provider) is narrowly focused on cases involving the establishment of eligibility for Medicaid, such as the suspected fraudulent statement of assets and income. On the other hand, consistent with OIG policy, the proposed revision would permit FFP for the investigation or prosecution of cases in which a beneficiary is alleged to have submitted, or caused the submission of, a fraudulent claim to the program for particular items or services that are unrelated to the beneficiary's status as a beneficiary. One scenario in which such cases may arise involves Medicaid personal care services “self-directed” programs, where the beneficiary may submit claims and receive payment from Medicaid, may be responsible for hiring his or her own caregivers, and may be required to monitor the activities of caregivers.

With respect to disallowance procedures, we proposed to amend the regulation to establish procedures for taking formal disallowances of FFP, for Units to request reconsideration of disallowances, and to appeal to the HHS Departmental Appeals Board.

Finally, we proposed to update the listing of other applicable HHS regulations that were amended after the MFCU regulations were initially promulgated.

II. Summary of Public Comments and OIG Responses

A. General

We received responsive comments from 10 distinct commenters, including trade associations (such as the national association that represents the MFCUs), individual Units, a health plan, and a State medical society. Some of the commenters provided comments on multiple topics. Commenters generally supported our proposals, but many of them recommended certain changes and requested certain clarifications. We have divided the public comment summaries and our responses into sections pertaining to the part of the regulation to which they apply.

B. Definition of Fraud and Other Criminal Conduct

Comment: One commenter expressed concern that OIG, in its Proposed Rule, both adopted State law definitions for types of criminal conduct, including “abuse of patients,” “fraud,” “misappropriation of patient funds,” and “neglect of patients,” and provided examples of the essential elements of the crime. The commenter stated that the definitions are “overly expansive and inappropriate” and that “[e]ach MFCU must be able to defer to its state law definitions and not be expected to comply with overarching federal definitions.” The commenter recommended that OIG delete all of the proposed language in each of the definitions following the reference to State law.

Response: We proposed to define “fraud” as any act that constitutes criminal fraud under applicable State law including the deception, concealment of material fact, or misrepresentation made by a person intentionally, in deliberate ignorance of the truth or in reckless disregard of the truth.

It was not our intent to require States to comply with an overarching definition, and this is the reason we defer to the definitions contained in State law. The purpose in describing the elements of the crime was to provide guidance on those elements that are typically contained in State law.

Therefore, as specified in § 1007.1 of our regulations, we are finalizing the definition of fraud by retaining the first sentence of the proposed definition of fraud as contained in the Proposed Rule but have revised the language in the second sentence to clarify that the crime “may” include the noted elements. We have also made a technical change in eliminating the phrase “by a person” since the crime could be committed by an organization as well. We have made similar revisions to the other definitions that rely on State law definitions: “abuse of patients or residents” and “neglect of patients or residents.”

C. Definition of Abuse of Patients

Comment: Concerning the proposed definition of “abuse of patients,” one commenter raised three concerns regarding the definition. First, the commenter observed that the reference to abuse of a “patient” is too narrow, since Unit authority may extend to residents of facilities who are not considered “patients” under State law. The commenter recommended that the definition be expanded to include “patient and/or resident of a care facility” and that, whenever the term “patient” is used throughout the regulation, the word “resident” be added as well. Secondly, the commenter believed that the term “willful” is problematic for States that define “abuse” as conduct that is not willful, such as reckless conduct. Finally, the commenter observed the wide variation in what constitutes abuse under State law and recommended that we eliminate the examples entirely in the definition.

Response: We agree with the comments regarding the definition of abuse. Under section 1903(q)(4) of the Act—as implemented by § 1007.11(b)(2) of this rulemaking—the Units may receive FFP for abuse or neglect cases arising in “board and care facilities.” Expanding the definition to include abuse of “residents,” in addition to “patients,” is consistent with the statutory definition of “board and care facility” in section 1903(q)(4)(B) of the Act. Adding the reference to “residents” is also consistent with the Units' longstanding lack of statutory authority to receive FFP for the investigation and prosecution of cases of patient abuse or neglect that occur in the home or other nonfacility settings.

We have also revised the definition to eliminate reference to “willful” conduct and to provide examples of what constitutes abuse.

We have made a similar revision to include both patients and residents in the definition of “neglect of patients” to § 1007.11(b) as well, which describes a Unit's responsibilities regarding abuse or neglect.

D. Definition of Data Mining

Comment: One commenter expressed a concern that the proposed definition at § 1007.1 of “data mining” did not consider the analysis of data that might occur during the course of an investigation, rather than as part of activities designed to identify new potential cases. For example, the commenter stated that in the course of investigations, it is often necessary to conduct a “peer comparison” between or among providers and present that information to a jury or other fact finder for the purpose of demonstrating what is usual and customary. The commenter stated that the activities related to such analysis should be considered as eligible for FFP without receiving a waiver from OIG to conduct data mining.

Response: We agree with the commenter that the use of data analysis in an ongoing case should not be subject to the prohibition on FFP for data mining and that Units need not receive a data mining waiver to conduct such activities.

We believe, however, that the existing regulatory definition permits such case-related activities by describing those activities that require a data mining waiver from OIG to be limited to:

. . . the practice of electronically sorting Medicaid or other relevant data, including, but not limited to, the use of statistical models and intelligent technologies, to uncover patterns and relationships within that data to identify aberrant utilization, billing, or other practices that are potentially fraudulent.

By limiting the activities needing a waiver to those which involve the “sorting [of] Medicaid or other relevant data,” we believe that the existing definition excludes the type of case-related activities referred to by the commenter. This position is consistent with the 2013 preamble to the rulemaking establishing the data mining waiver authority. In a response to a comment, we stated:

We agree that the intent of the regulation is not to limit other types of Medicaid data analysis being conducted in the normal course of an investigation. Units may analyze relevant Medicaid data as part of the evidence-gathering process while investigating a particular possible fraud. In some instances, this data analysis conducted as part of a particular investigation might allow the Unit to identify other potential targets, which would result in opening new fraud cases. Such data analysis is an accepted part of a MFCU's investigative function and does not implicate the prohibition contained in § 1007.19(e)(2).

78 FR 29055, 29057 (May 17, 2013).

E. Definition of Director

Comment: One commenter agreed that the proposed definition of “director” is beneficial but suggested that the role of the director would be clarified, and the working relationship between the Unit and OIG improved, by amending the definition to also state that the director “serves as the chief liaison with OIG for all Unit-related activities.”

Response: We agree with the commenter about the importance of maintaining effective working relationships between the Units and OIG. However, while the director plays the role of liaison with OIG in most Units, we decline to modify the definition to require this, as other Units may choose to designate another individual or individuals to play that role. Also, even if the director plays the role of primary liaison, some Units may choose to designate another individual to be the liaison to OIG for particular Unit activities, such as investigation-related activities.

F. Definition of Health Care Facility

Comment: One commenter objected to the definition of “health care facility,” for purposes of the Units' investigations of patient abuse or neglect, as a provider that “furnishes . . . services to four or more persons unrelated to the proprietor.” The commenter suggested that the definition be revised to include providers who furnish services to two or more persons. The commenter acknowledged that facilities with fewer than four residents could be investigated under the “board and care” authority, but that the authority for board and care cases is optional, and the authority to investigate patient abuse or neglect at a health care facility is mandatory.

Response: We do not believe it is appropriate to establish our own definition of health care facility for purposes of the MFCU program. The definition of health care facility was adopted from the CMS definition, contained in 42 CFR 447.10(b), of a “facility” as “an institution that furnishes health care services to inpatients” and 42 CFR 435.1010, which defines an “institution” as “an establishment that furnishes (in single or multiple facilities) food, shelter, and some treatment or services to four or more persons unrelated to the proprietor . . . .”

We therefore decline to revise the definition of health care facility.

G. Definition of Program Abuse

Comment: One commenter expressed concern that the proposed definition of “program abuse” at § 1007.1, in providing examples such as an “unnecessary cost to Medicaid” and “reimbursement for services that are not medically necessary,” blurs the line between administrative misconduct on the one hand and criminal conduct on the other.

Response: We agree with the commenter that the examples cited do not clearly illustrate the distinction between administrative and criminal misconduct. In revising the definition, we are not including the examples. We also simplified the definition, as suggested by the commenter, and revised the definition to refer to civil or criminal fraud under “State law,” rather than “Federal and State law,” since the Units' statutory function extends only to “violations of all applicable State laws . . . .”

H. Definition of Provider

Comment: One commenter stated that the proposed definition of “provider” insufficiently addresses the wide range of providers whose actions fall within the scope of the Units' authority. The commenter suggested that, along with several other definitions contained in the Proposed Rule, the definition be expanded to incorporate definitions of “provider” that would be accepted under a State's laws.

The commenter also suggested that the definition be expanded to include “prescribing” physicians, in addition to “ordering” or “referring” physicians, since State law may authorize the ability to prescribe as distinct from ordering or referring.

Response: We agree that the definition for “provider” should be expanded to reflect varying definitions under State law for health care providers, as well as to clarify that it applies to “prescribing physicians” as one example of a provider. We are therefore expanding the definition of provider to include “any individual or entity that may operate as a health care provider under applicable State law” as well as “an individual or entity that is required to enroll in a State Medicaid program, such as an ordering, prescribing, or referring physician.”

Comment: Two commenters expressed concern that the definition of provider be expanded to specifically reference providers who provide items or services in a managed care setting, as well as managed care companies themselves, which do not provide items or services directly but instead provide management services for other providers. The commenters suggested that the definition of provider refer specifically to managed care plans as well as individuals or entities that provide items or services in a managed care network and who subcontract with those plans.

Response: With respect to providers operating in a managed care network, we agree and have clarified in the definition that a provider includes individuals and entities that are part of a managed care network. We had intended in the Proposed Rule that such providers were included as “an individual or entity that furnishes items or services for which payment is claimed under Medicaid,” but have added the specific reference to managed care organizations (MCOs) and other contracting entities because of the increasing role of managed care networks in providing Medicaid items and services.

With respect to MCOs themselves, we decline to expand the definition to specifically mention MCOs as a type of provider. While MCOs play an integral and growing role in most State Medicaid programs, they do not appear to be universally regarded as a type of “provider.” However, MCOs may play varying roles depending on the terms of their contract with the State. To the extent that an MCO's actions (or those of other entities or persons) are implicated in the potentially fraudulent submission of claims by or on behalf of a Medicaid provider, they may be the subject of a MFCU investigation or prosecution, regardless of their own status as a provider.

Comment: One commenter objected that the regulation would expand the definition of provider to include ordering and referring physicians, arguing that this is not appropriate, since such physicians do not participate in the program, may render services free of charge, and have little or no reason or opportunity to game the system. Therefore, the commenter expressed the view that these physicians should not be subject to the administrative requirements of the program.

Response: The definition of provider describes those individuals or entities who may be subject to an investigation, but does not expand the current authority of the Units. The MFCU mission is the “investigation and prosecution of violations of all applicable State laws regarding any and all aspects of fraud in connection with . . . any aspect of the provision of medical assistance and the activities of providers of such assistance . . . .” To the extent that an ordering or referring physician violates State law regarding Medicaid fraud, the Units currently have the authority to include ordering or referring physicians as the subject of an investigation or prosecution.

MFCU investigative authority is not limited to participating providers or to individuals who may have an obvious financial incentive to defraud the program. Fraud is an intent-based crime, so an investigation or ultimate prosecution would reveal whether an ordering or referring physician had the requisite intent to commit fraud. By excluding ordering or referring physicians from the definition of provider, Units might be unable to hold responsible under State law those individuals responsible for a fraudulent claim to the program.

We therefore do not believe that the comment warrants a change to the definition of “provider.”

I. Single Identifiable Entity Requirements

Comment: Two commenters expressed concerns with the proposed requirement at § 1007.5(b)(3) that all Units “[h]ave the headquarters office and any field offices each in their own contiguous space.”

One commenter stated that, while this arrangement is a best practice for Unit operations, “some Units may need special exceptions based on the history of their respective Units and unique difficulties recruiting employees.” The commenter suggested that OIG grant an exception to existing Units with other arrangements on either a temporary or permanent basis.

Another commenter requested that the proposed rule be rewritten to allow flexibility in the physical location of Unit employees while still requiring effective, multidisciplinary collaboration. The commenter requested that the wording of § 1007.5(b)(3) be revised to require that Unit offices be in their own contiguous space, “or otherwise ensure that all employees have a work location arrangement that allows for real-time collaboration with the other professional disciplines within the Unit, that non-Unit personnel have no unauthorized access to Unit files, and that Unit personnel exert 100 percent of their efforts on Unit business.” Alternatively, the commenter requested, similar to the request of the other commenter on this topic, that existing Units with noncontiguous space arrangements be granted an exception when the arrangement allows for effective collaboration.

Response: Our purpose in proposing a requirement regarding physical office space was to ensure that Units exist as a “single, identifiable entity” and to reflect our observation that Units generally exist in contiguous space that is separate from the other parts of the Office of Attorney General or other parent organization. As stated in the Proposed Rule, we believe that having Unit offices in a single space contributes to the team concept of the Units and helps to ensure that employees are devoted exclusively to the mission of the Unit.

We recognize, however, that there can be extenuating circumstances for locating staff in noncontiguous space when there are advantages for Unit operations in such an arrangement. Therefore, as suggested by both commenters, we have provided Units with the opportunity to demonstrate to OIG that certain employees warrant a different arrangement. OIG will review arrangements and approve or disapprove of exceptions to the contiguous space requirement based on a demonstration by the Unit that circumstances warrant a different arrangement for certain employees. We have not provided a “grandfathering” process, but we are prepared to review any existing arrangements that do not comport with a single space requirement.

Therefore, we have revised the requirement in § 1007.5 to specify that the headquarters office and any field offices must have their own contiguous space unless the Unit demonstrates to OIG that circumstances warrant a different arrangement for certain employees.

In considering exceptions to the space requirement, OIG would consider favorably the following situations as examples of when employees could be located in noncontiguous space:

• Employees working at home on a temporary or long-term basis.
• Employees sharing space with OIG or other agencies that provide advantages to the Unit's collaboration with those agencies.
• Employees assigned to small offices, including field offices, where space is limited and the only available office space is not contiguous.

J. Relationship With Medicaid Agency

Comment: One commenter suggested several clarifications, not contained in the sections of the Proposed Rule proposed to be modified by OIG. Specifically, the commenter requested that we clarify the current regulation at § 1007.9(b).

The commenter expressed that the language of the paragraph should be revised to clarify that (1) the phrase “Medicaid agency” is intended to refer to the agency in the same State in which the Unit exists, (2) the proscription on the Medicaid agency to not “review or overrule the referral of a suspected criminal violation” be expanded to refer to “decisions” of the Unit in addition to referrals, and (3) the Medicaid agency's and the Unit's respective roles be clear and distinct, particularly with regard to decisions as to “which law enforcement or prosecutorial authority is best for a given matter.”

Response: We generally agree with the substance of the commenter's concerns but decline to make the suggested revisions.

First, in the Proposed Rule OIG did not propose to modify the paragraph of the regulation relating to the role of the Medicaid agency in reviewing the activities of the Unit, so the comment is beyond the scope of the Proposed Rule.

Secondly, in referring to the “Medicaid agency” throughout the regulation, OIG is referring to the Medicaid agency for the same State in which the Unit exists, not that of another State. We do not believe that text of the regulation needs to be modified to clarify this.

With respect to whether the proscription on interference by the Medicaid agency should refer to “decisions” of the Unit in addition to “activities,” we agree that the Medicaid agency does not have the authority to interfere with decisions pertaining to the investigation or prosecution of a Unit's cases. On the other hand, we note that there may be administrative actions in which both the Unit and Medicaid agency are both involved. For example, a Unit as part of a criminal or civil case may make a decision or recommendation regarding an administrative remedy or action. Such decisions may in fact be subject to some type of review by the Medicaid agency. As another example, for those Units with authority to conduct data mining under § 1007.20, the decision of whether to develop a data mining algorithm is subject to review and input by the Medicaid agency.

We therefore decline to expand the proscription on interference by the Medicaid agency to include all “decisions” by the Unit.

Finally, with regard to the respective roles of the Medicaid agency and the Unit, we agree that law enforcement decisions pertaining to the appropriate investigative and prosecutorial authority for a particular case are the province of the Unit, not the Medicaid agency. We believe this separation of roles is widely understood in the MFCU and State agency community and is how OIG interprets the existing language of § 1007.9(b).

K. Role of Managed Care Organizations (MCOs) in the Agreement With the Medicaid Agency

Comment: Several commenters observed the important role of MCOs in those States that provide Medicaid services in a managed care setting and suggested that the section of the regulation addressing the relationship of the MFCU to the Medicaid agency, 42 CFR 1007.9, be expanded to describe the role of MCOs. One commenter observed that activities to combat Medicaid fraud, waste, and abuse would be more effective if Units collaborated with MCOs on a routine basis to share information. Another commenter, noting the important role of MCOs, suggested that the proposed regulation's provision regarding regular communication between the Unit and the Medicaid agency be expanded to include managed care plans. The commenter specifically requested that MCO Special Investigation Units (SIUs) be permitted to attend the meetings between the Unit and the Medicaid agency, since SIUs can contribute valuable information to the meetings.

Response: We agree about the critical role of MCOs in those States that have chosen to provide Medicaid services in this manner. We also believe it is a best practice that the Unit or State program integrity officials collaborate with the MCO SIUs and that SIU officials attend regular meetings on referral issues. However, we are also mindful that States should have the discretion to define the relationship with MCOs within the confines of existing law and regulation. States should have the ability to choose the manner in which the Unit and Medicaid program integrity unit communicate with the MCOs.

Comment: Another commenter requested more narrowly regarding § 1007.9 that the written agreement between the Unit and the Medicaid agency include a provision regarding how the Unit will receive referrals of potential fraud from MCOs either directly or through the Medicaid agency.

Response: Medicaid regulations pertaining to MCOs, 42 CFR 438.608(a)(7), require that MCOs, under the terms of their contracts with the Medicaid agency, refer any case of potential fraud, waste, or abuse to the Medicaid agency's program integrity unit or any potential fraud directly to the Unit. Also, under 42 CFR 455.21, the Medicaid agency must refer all cases of suspected provider fraud to the Unit.

Consistent with these requirements, we agree that the inclusion of a provision in the written agreement between the Unit and the Medicaid agency regarding referrals from MCOs would be consistent with other requirements and would be an appropriate addition to the MFCU regulations and the CMS companion regulation. We have thus modified the rules to include such a provision.

L. Payment Suspension

Comment: One commenter requested that, to effectuate MCO involvement in the payment suspension process, payment suspension information be communicated to MCOs in a timely manner. The commenter also requested that clarification of MCO responsibilities with respect to payment suspension be included in this final rule.

Response: These suggestions are outside the scope of this rulemaking. State Medicaid agencies, not the Units, suspend payments.

M. Civil Authorities

Comment: One commenter stated that § 1007.11(a)(3), in defining applicable State laws to include both criminal statutes “as well as civil false claims statutes or other civil authorities,” seems misplaced, affecting the flow of the description of the fraud-focused mission of the Units. The commenter recommended instead that the regulation, in describing the broad function of the Units in paragraph (a), be expanded to state “[t]he Unit must conduct a statewide program for investigating and prosecuting (or referring for prosecution) violations of all applicable State laws, including criminal statutes as well as civil false claims statutes or other civil authorities . . . .”

Response: We agree and have modified the rule.

N. Misappropriation of Patient or Resident Funds

Comment: A commenter expressed concern about language in the Proposed Rule that would make mandatory the review of complaints of “misappropriation of a patient's funds . . .” when that review is currently optional for the Units. The commenter noted that the current regulation at § 1007.11(b)(1) states that the “Unit will also review complaints alleging abuse or neglect of patients in health care facilities . . .,” but the Unit “may review complaints of the misappropriation of patient's private funds in such facilities.” In the Proposed Rule, those two clauses are combined and would require in paragraph (b)(2) that the Unit “must also review complaints alleging abuse or neglect of patients, including complaints of the misappropriation of a patient's funds, in health care facilities receiving payments under Medicaid.” The commenter expressed concern that making financial cases mandatory “may stretch already scare resources within the Units.”

Response: We have accepted the comment and have retained language in the final rule to the effect that Units “may” review complaints of misappropriation of a patient's or resident's private funds. In addition to the concern about workload, we believe this language is consistent with the changes we are making to the definition of abuse of patients or residents, where we have recognized the existence of differing State legal definitions of what constitutes abuse.

Although we have retained the option for financial misappropriation cases, we continue to believe that financial misappropriation is a significant issue and that Units should continue to devote resources to such cases. Financial misappropriation may arise when family members or others are granted power of attorney for a patient or resident and abuse the patient's or resident's trust by diverting funds to their own or another's benefit. Financial misappropriation may arise in conjunction with physical abuse or may occur in isolation.

O. MFCU Authority in Board and Care Facilities

Comment: Several commenters expressed policy concerns about the expansion of MFCU authority in board and care facilities, which typically do not participate in State Medicaid programs or receive Medicaid funding.

Response: The authority to investigate patient abuse or neglect in non-Medicaid board and care facilities is a feature of the Ticket to Work and Work Incentives Improvement Act of 1999. The addition to the MFCU regulations merely codifies that statutory requirement. The policy concerns raised by the commenters are therefore outside the scope of this rulemaking.

P. Duties and Responsibilities of Units

Comment: In the Proposed Rule, we proposed at § 1007.11(a), (b)(1), (b)(3), (b)(4), (c), and (d) to replace the word “will” with “must” to highlight the mandatory nature of the responsibilities of a Unit. A commenter expressed reservations about this change and requested that we retain the term “will” in the paragraphs. The commenter stated that the word “will” would make the responsibilities of the Unit sufficiently clear. The commenter also expressed that the term “will” would provide the appropriate discretion for a Unit in determining whether to accept a referral, thus promoting the Unit's efficient use of resources.

Response: We have retained the term “will” in § 1007.11 and, for consistency, in other parts of the regulation, including § 1007.13, for staffing requirements. We did not intend to propose a revision to the mandatory nature of a Unit's responsibilities and agree that retaining the term “will” would avoid confusion in this regard.

Comment: One commenter noted that proposed § 1007.11(c) addresses the responsibilities of the Units to recover overpayments or refer the overpayment recovery to an appropriate “State” agency. The commenter noted that there are governmental programs in various States which process and expend Medicaid dollars at the local level (county or city). For instance, some States operate single- or multi-county special needs programs or mental health programs. If an overpayment is identified in one of these county-administered programs, for example, the responsibility for the recovery may more appropriately rest with county officials rather than State officials. The commenter suggested that the last clause in § 1007.11(c) should include “or refer the matter to an appropriate agency for collection” [emphasis added].

Response: We agree with the suggestion and have modified the regulation text.

Comment: One commenter expressed a technical concern with a longstanding provision in the regulations at § 1007.11(d) that requires Units, for cases that are tried by non-Unit prosecutors, to provide the prosecutors with “the fullest opportunity to participate in the investigation from its inception.” The commenter, while not disputing the importance of cooperating with non-Unit prosecutors, suggested that this section, as written, is not consistent with patient confidentiality obligations as required by performance standards. The commenter suggested that Units, consistent with those obligations, must have the discretion to determine what cases will be investigated and when to notify the prosecuting authority to control the flow of confidential information outside of the Unit. Therefore, the commenter suggested that the original regulation language of § 1007.11(d) be rewritten to eliminate the language about participation in the investigations from their inception: Specifically, the commenter stated that the language should specify that where a prosecuting authority other than the Unit is to assume responsibility for the prosecution of a case investigated by the Unit, the Unit will ensure that those responsible for the prosecutorial decision and the preparation of the case for trial are provided all necessary assistance.

Response: While we generally agree with the commenter's position that the Units must have the discretion to determine what cases will be investigated and when to notify an outside prosecuting authority, we cannot make the requested change, as we did not propose to modify this provision. We also do not believe the suggested change is necessary to address the commenter's concern. While the current provision permits non-Unit prosecutors the fullest opportunity to participate in the MFCU's investigation, it is the Unit's responsibility to determine if that participation is appropriate or would interfere with the effective investigation of a case. We thus believe that the current provision affords the Unit discretion in determining when to involve prosecutors, as long as there is full cooperation.

Q. Coordination With Federal Authorities

Comment: One commenter expressed concern with a provision of the Proposed Rule that requires a Unit to disclose case information to Federal investigators and attorneys not involved with a particular case. Proposed § 1007.11(e)(1), similar to the existing requirement contained in paragraph (e), states that the Unit, if requested, will make available to OIG investigators and attorneys, other Federal investigators, and prosecutors all information in the Unit's possession concerning investigations or prosecutions conducted by the Unit.

Existing paragraph (e) reads the same, except that it does not clarify that information be provided “if requested.”

The commenter agreed that case information should be shared with Federal investigators and attorneys working jointly on a case, but expressed concern about broadly requiring the Unit to disclose case information to Federal officials who have no involvement in the case. The commenter noted that case information could include confidential grand jury or other information with legal restrictions on its disclosure. Therefore, the commenter suggested that proposed § 1007.11(e)(1) should be revised to state that the Unit, if requested, will make available to OIG investigators and attorneys, or other Federal investigators and prosecutors, on the case, all information in the Unit's possession concerning investigations or prosecutions conducted by the Unit.

Response: We do not agree that a revision is necessary to the longstanding requirement contained in § 1007.11(e) that Unit information be shared with Federal investigators and attorneys. We agree there could be State grand jury and other information that, because of criminal law restrictions on the use of the information, may not be disclosed to Federal investigators and attorneys who are not involved with a case. However, the Unit, OIG, and DOJ have contemporaneous jurisdiction for all allegations of Medicaid provider fraud. While unusual, we believe there could be situations in which OIG or DOJ personnel would have a legitimate need to seek information about an ongoing investigation or prosecution.

Comment: At proposed § 1007.11(e)(1) and (2), Units are required to make all information pertaining to Medicaid fraud available to Federal investigators, prosecutors, and OIG attorneys, and subsequently the Unit must coordinate with such officials on any Federal and State investigations or prosecutions involving the same suspects or allegations. One commenter noted that MCOs are very likely to possess information to assist in fraud detection and requested that Units be required to make information available to MCOs during fraud investigations. The commenter also requested that MCOs be included in the coordination of investigations and prosecutions by asking prosecutors to include MCO encounter information, and not only State fee-for-service claims, in investigated and/or charged conduct. In addition, the commenter asked for clarification as to the disposition of MCO funds recovered as a result of investigations, civil suits, and prosecutions.

Response: We decline these suggestions. We have observed that MCOs in many States are successfully included in the sharing of information about ongoing and potential fraud cases and believe that this participation by MCOs is a best practice. However, MCOs are private, nongovernmental entities, and States should have the ability to restrict the sharing of information with them. The suggestions about including MCO encounter information in prosecutions and the disposition of MCO recoveries are beyond the scope of this regulation.

Comment: One commenter noted that proposed § 1007.11(e)(2) does not clearly state what it means to “coordinate with” Federal investigators, Federal attorneys, and Federal prosecutors. The commenter noted that coordination can include deconfliction of case lists and joint investigative activities, including avoiding duplication of efforts in joint cases.

Response: We agree with this comment and believe that the commenter has described appropriate examples of coordination—deconfliction of case lists and joint investigative activities. We decline to further revise § 1007.11(e) beyond the expectation that the Unit establish a practice of regular meetings or communication with OIG investigators and Federal prosecutors. Our intention is for Units to have flexibility to coordinate in a manner that is appropriate for that State, as coordination may look different depending on variables such as the type of case, size of the State, or the presence or absence of Federal partners in the State.

Comment: Another commenter noted ambiguity in the language of proposed § 1007.11(e)(2) where we proposed that the Unit will coordinate with OIG investigators and attorneys, other Federal investigators, and prosecutors on any Unit cases involving the same suspects or allegations.

Specifically, the commenter was unclear as to which “prosecutors” are the focus of this provision. The commenter also believed that OIG should be permitted latitude to manage at its discretion those circumstances in which OIG's resources are limited and other Federal agencies are summoned to assist or supplement assistance as appropriate. To address these comments, the commenter recommended that § 1007.11(e)(2) be revised to state that the Unit will coordinate with OIG investigators and OIG attorneys, as OIG and the Unit deem appropriate, joint activities involving other Federal investigators and Federal prosecutors on Unit cases and Federal cases that involve the same suspects, providers, or allegations.

Response: We agree that the proposed provision does not make clear to which prosecutors the provision refers. We intended to specify “Federal” prosecutors and have modified the regulation text at paragraph (e)(2) as well as paragraph (e)(1) to remove the ambiguity. We also added wording to paragraph (e)(2) to improve clarity. However, we did not modify the text in paragraph (e)(2) to include the commenter's suggested language regarding “as OIG and the Unit deem appropriate” because we believe that considering the appropriateness of involvement in a case would be part of coordinating. We are also reluctant to limit coordination to “joint activities” involving the same suspects or allegations because we believe Units need to coordinate with their Federal counterparts even on cases not being worked jointly. Thus, we are modifying paragraph (e)(2) to state that the Unit will coordinate with OIG investigators and attorneys, or with other Federal investigators and prosecutors, on any Unit cases involving the same suspects or allegations that are also under investigation or prosecution by OIG or other Federal investigators or prosecutors [emphasis added].

Comment: Proposed § 1007.11(e)(3) specifies that a Unit establish a practice of regular meetings or communication with OIG investigators and Federal prosecutors. One commenter recommended that the SIUs of MCOs be permitted to attend these meetings, or that similar meetings be held with the SIUs of MCOs. The commenter also requested that at § 1007.11, paragraphs (a) through (c), MCOs also be included under references to “Medicaid” for which the Unit is responsible.

Response: We believe that attendance by MCOs at meetings may be a best practice, but we decline to identify in regulation those participants required at particular meetings. As noted previously, MCOs are private, nongovernmental entities, and States should have the ability to restrict the sharing of information with them.

Comment: One commenter noted that proposed § 1007.11(e)(5) requires the Unit to “establish written procedures” but leaves unclear the level of detail or depth of such written procedures. The commenter expressed concern about this paragraph posing a potential burden. To permit greater discretion, the commenter recommended revising the regulation to require Units to establish “policy” rather than written procedures.

Response: We agree with the suggestion that Units establish “policy” rather than the more prescriptive “written procedures.” We have revised the paragraph accordingly. This revision will reduce burden on Units and enhance Unit flexibility.

Comment: One commenter expressed support for proposed § 1007.11(g)(3) for the accommodation granted in allowing Units to transmit the requested information “as soon as practicable” due to the specified delays. However, the commenter observed that Units have encountered delays that are not due directly to the “[receipt of] . . . information” from the “sentencing court,” but that remained beyond the Unit's control or capacity. For example, long queues at court clerks' offices, sometimes in locations far away from the Unit, can compromise a Unit's ability to communicate effectively and timely with court staff, which can further delay the Unit's efforts to finalize sentencing-related dispositions. As such, the commenter requested that the term “court” replace the term “sentencing court” so that the paragraph states that such information will be transmitted to OIG within 30 days of sentencing, or as soon as practicable if the Unit encounters delays, such as in receiving the necessary information from the court [emphasis added].

Response: OIG agrees that Units could encounter delays that are more broadly described as “court delays” rather than the more specific delays in receiving information from the “sentencing court” and accepts the commenter's suggestion. However, we do not intend for delays “in receiving the necessary information from the court” to be an example of a possible delay, but to be the only acceptable reason that transmitting information to OIG should be delayed. Therefore, we are replacing the term “sentencing court” with “court,” but we are not including the phrase “such as” as part of the paragraph.

R. Staffing Requirements

Comment: One commenter suggested that, in addition to modifying the attorney role in § 1007.13(b)(1) to more specifically convey the prosecution and advisory role of Unit attorneys, OIG should revise the description of the investigator role as well. Specifically, the commenter suggested that we clarify that investigators should be capable of conducting investigations of Medicaid fraud and patient abuse and neglect matters.

Response: We agree with the comment and have modified the final regulatory language.

Comment: One commenter expressed concern that the proposed minor change at § 1007.13(b)(2) concerning the qualifications of auditors did not include information on how the auditors would perform operational audits of health care entities.

Response: MFCU auditors do not conduct operational audits of health care entities. Units are restricted at § 1007.19(e)(1) from receiving FFP for expenditures attributable to cases involving “program abuse or other failures to comply with applicable laws and regulations.” Therefore, we decline to make modifications to the rule to address operational auditing.

Comment: A commenter expressed concern about the limitation in the proposed rule at § 1007.13(g)(2) that a Unit may not “rely on individuals not employed directly by the Unit for the investigation or prosecution of cases.” The commenter asked that we clarify that a Unit “may hire special counsel or other investigative or litigation support services to work jointly with the Unit to assist in specific, discrete investigations or cases, where the Unit can demonstrate that additional assets or expertise may be needed for the discrete case.”

Response: We agree with the concern that Units should be able to hire experts to support the investigative and prosecutorial work of the Units, as long as the experts do not actually conduct investigations and prosecutions of Medicaid fraud or of patient or resident abuse or neglect. We believe, however, that this need is addressed by proposed paragraph (g)(1), which stated that the Unit may employ, or have available through consultant agreements or other contractual arrangements, individuals who have forensic or other specialized skills that support the investigation and prosecution of cases.

We believe that the proposed regulatory language provides the right distinction that Units may not “rely” on contractors to investigate or prosecute cases, but may have contracts or consultant agreements with experts who may “support” the investigation and prosecution.

S. Recertification Requirements

Comment: Proposed § 1007.17(a)(2)(iv) states that Units are to submit statistical reports on staffing, caseload, and outcomes, including monetary recoveries. A commenter made technical comments on the definitions of the types of monetary recoveries reported.

Response: While we appreciate the comments, we do not believe that addressing detailed technical comments about statistical reporting is appropriate in the rule itself. We will consider the commenter's concerns outside of the rulemaking.

Comment: Proposed § 1007.17(b)(2) requires the Units to provide “other information OIG deems necessary or warranted.” One commenter noted that in the past the Units have been asked to provide additional information to OIG, but the requested data is not routinely kept by the Units. The commenter also noted that while not every contingency can be predicted, a request for “other information” without prior notice is cumbersome and potentially void of a high level of accuracy. The commenter suggested adding language that advance notice would be provided to the Unit for other information OIG deems necessary and warranted.

Response: While we decline to accept this level of prescription in the final rule, we agree about the need to provide Units advance notice of information requests. OIG needs to maintain the ability to collect information from the Units but will always strive to provide advance notice and to be sensitive to requesting data that is not routinely kept by the Units.

T. Federal Financial Participation

Comment: A commenter endorsed the approach of the Proposed Rule to limit those situations, other than through “data mining,” in which FFP would be prohibited for the identification of potential fraud cases. The Proposed Rule accomplished this by proposing to modify the language in § 1007.19(e)(2), which currently prohibits FFP for “efforts to identify [other than through an approved data mining waiver] situations in which a question of fraud may exist, including the screening of claims and analysis of patterns of practice . . .” with “efforts to identify situations of fraud . . . by the screening of claims and analysis of patterns of practice . . .” [emphasis added]. The purpose of the change was to acknowledge ways in which a Unit may identify possible fraud that would not interfere with activities of the Medicaid agency, such as undercover operations. The commenter also suggested that we further clarify the issue by adding the following sentence to this preamble:

This subsection is not intended to limit the Unit's ability to engage in activities, other than routine verification of services received and data mining, to identify potential civil or criminal fraud in the Medicaid program.

Response: We agree that the suggested additional sentence correctly describes those activities to identify potential fraud, in addition to an approved data mining program, that would be permissible for purposes of receiving FFP, and we adopt the sentence here. This clarification is consistent with the proposed changes to the subsection and does not require a change to the text of the regulation.

Comment: A commenter expressed concern with the longstanding prohibition, modified in the Proposed Rule at § 1007.19(e)(5), that a Unit may not receive FFP for cases “involving a beneficiary's eligibility for benefits, unless the suspected fraud also involves conspiracy with a provider.” The existing regulation similarly prohibits FFP for the “investigation or prosecution of cases of suspected beneficiary fraud not involving suspected conspiracy with a provider.” The commenter expressed that the language in § 1007.19(e)(5) is too limiting regarding the types of permissible beneficiary fraud cases because the word “suspected” modifies the word “fraud.” The commenter observed that there are cases that involve conspiracy between a beneficiary and provider but that may involve suspected conduct other than fraud, such as alleged identity theft. The commenter suggested that the prohibition be modified to refer to conspiracy involving “joint criminal conduct” rather than narrowly to “fraud.”

Response: We decline to make the proposed revision regarding the reference to “suspected fraud.” We agree that identity theft (or other activities not strictly involving fraudulent billing to the program) could be identified as integral to, or evidence of, a conspiracy between a beneficiary and provider. However, the underlying conduct, consistent with the authority of the Unit to receive FFP, must involve “fraud.” As long as the other criminal conduct identified as part of the conspiracy, such as identity theft, has a connection to the fraud allegations, the Unit may receive FFP for the investigation and prosecution of the case. To promote clarity, we have amended the provision to refer to the investigation or prosecution of “fraud” cases involving a beneficiary's eligibility for benefits, unless the suspected fraud “cases” also involve conspiracy with a provider.

U. Disallowances of FFP

Comment: One commenter suggested that the language proposed in § 1007.21(a), regarding OIG's determination that a claim or portion of a claim for grant funding is not allowable, should be consistent with the contents of the Federal regulation to which it refers, 42 CFR 430.42(a), by clarifying that OIG's determination should be made “promptly.”

Response: We agree and have included the word “promptly” in the final regulation. The proposed changes were intended to mirror the disallowance procedures in 42 CFR 430.42(a), including that OIG's determination be made “promptly.”

III. Provisions of the Final Rule

This final rule incorporates most of the provisions in the Proposed Rule but with some substantive and technical changes to the regulatory text that are described in this section and in section II above.

We are finalizing, with certain revisions described in section II, all of the proposed definitions. We made revisions to the definitions of several kinds of conduct, such as “fraud” and “abuse of patients or residents,” to more clearly adopt those definitions of conduct as contained in applicable State laws. We also similarly expanded the definition of “provider” to adopt applicable State law, as well as to reference managed care and prescribing physicians. We also expanded references to abuse and neglect of patients to include “residents.”

We are finalizing the characteristics of what it means to be a single, identifiable entity at § 1007.5. We included a clarification to the requirement that the headquarters office and any field offices should each have their own contiguous space, unless a Unit demonstrates to OIG that circumstances may warrant a different arrangement for certain employees.

We are finalizing the proposed changes to the prosecutorial authority requirements of a Unit at § 1007.7, with one additional modification. At § 1007.7(b), we are finalizing the requirement for a Unit to establish formal written procedures for referring cases of patient or resident abuse and neglect prosecutions, in addition to fraud cases, to the appropriate prosecuting authority, when there is no State agency with statewide authority and capability for patient or resident abuse prosecutions. Similarly, we are making a technical amendment to § 1007.7(a) to clarify that if a Unit is located in the office of the State Attorney General or another office with statewide prosecutorial authority, it must have the authority to prosecute individuals for violations of criminal laws with respect to patient or resident abuse and neglect in addition to fraud.

We are finalizing the provisions pertaining to the Unit's relationship and agreement with the Medicaid agency at both § 1007.9 and the companion CMS regulation at § 455.21(c), with one additional provision. As described in detail in section II, we are adding a new paragraph at § 1007.9(d)(3) and at § 455.21(c)(3) requiring the Unit and the Medicaid agency to agree to establish procedures by which the Unit will receive referrals of potential fraud from MCOs, as applicable, either directly or through the Medicaid agency.

We are finalizing a number of provisions proposed, some with certain modifications, related to the duties and responsibilities of a Unit found at § 1007.11. However, for reasons explained above, we are not finalizing the proposal to make mandatory the review of complaints of misappropriation of patients' or residents' funds and have retained language in the final rule to continue that authority as optional. We are also not finalizing the word “must” to describe a Unit's responsibilities at § 1007.11(a), (b)(1), (b)(3), (b)(4), (c), and (d), and are retaining the word “will” in the final rule.

We are finalizing the provision to clarify that applicable State laws pertaining to Medicaid fraud include criminal statutes as well as civil false claims statutes and other civil authorities, but we have incorporated the clarification into § 1007.11(a) in the final rule, rather than in the proposed paragraph (a)(3). We are finalizing the provision at § 1007.11(c), with a slight modification, to clarify that when a Unit discovers that overpayments have been made to a provider or facility, the Unit will either recover the overpayment as part of its resolution of a fraud case or refer the matter to the appropriate agency for collection.

We are finalizing provisions pertaining to coordination with Federal investigators and attorneys at § 1007.11(e), with slight modifications to the proposed language. At paragraph (e)(5), we have modified the final rule such that a Unit will establish written policy consistent with paragraph (e), rather than establish written procedures.

We are finalizing a provision at § 1007.11(g) requiring a Unit to transmit to OIG, for purposes of excluding convicted individuals and entities from participation in Federal health care programs under section 1128 of the Act, pertinent documentation on all convictions obtained by the Unit. We made a minor modification to paragraph (3) requiring transmission of information within 30 days of sentencing, or as soon as practicable if the Unit encounters delays in receiving the necessary information from the “court,” rather than the “sentencing court” as was proposed.

We are finalizing all of the provisions in the Proposed Rule related to the staffing requirements of a Unit at § 1007.13, with the following modifications. We are finalizing clarifications at § 1007.13(b) to the qualifications of attorneys, auditors, and investigators, but we made one modification to paragraph (3) to specify that the investigators be capable of conducting investigations of health care fraud and patient or resident abuse and neglect matters. Additionally, we are not finalizing the use of the word “must” to describe a Unit's staffing requirements at § 1007.13(c), (d)(1), (d)(4), and (h) and have modified the final rule to use the sufficiently prescriptive word “will.” For consistency with the other paragraphs, we have modified paragraph (b) to use the word “will” rather than the original rule's use of “must.”

In § 1007.17, to reduce burden on the Units, we are eliminating the specific requirement of providing an “annual report” to OIG. However, we continue to receive information from the Units that allows OIG to evaluate the Unit's performance for purposes of recertification.

Finally, we have made editorial and other nonsubstantive changes to the final rule, where appropriate, to clarify our meaning.

IV. Regulatory Impact Statement

We have examined the impact of this rule, as required by Executive Order 12866 on Regulatory Planning and Review (September 30, 1993), Executive Order 13563 on Improving Regulation and Regulatory Review (January 18, 2011), the Regulatory Flexibility Act (RFA) (September 19, 1980, Pub. L. 96-354), section 1102(b) of the Social Security Act, section 202 of the Unfunded Mandates Reform Act of 1995 (March 22, 1995, Pub. L. 104-4), Executive Order 13132 on Federalism (August 4, 1999), the Congressional Review Act (5 U.S.C. 804(2)), and Executive Order 13771 on Reducing Regulation and Controlling Regulatory Costs (January 30, 2017).

Executive Orders 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects; distributive impacts; and equity). A regulatory impact analysis (RIA) must be prepared for major rules with economically significant effects ($100 million or more in any 1 year). This rule does not reach the economic threshold, and thus is not considered a major rule. Since the regulation only implements current practice and policy, we believe the economic impact to be negligible.

The RFA requires agencies to analyze options for regulatory relief of small entities. For purposes of the RFA, small entities include small businesses, nonprofit organizations, and small governmental jurisdictions. Most hospitals and most other providers and suppliers are small entities, either by nonprofit status or by having revenues of $7.5 million to $38.5 million in any 1 year. Individuals and States are not included in the definition of a small entity. We did not prepare an analysis for the RFA because we have determined, and the Secretary of Health and Human Services certifies, that this final rule will not have a significant economic impact on a substantial number of small entities.

In addition, section 1102(b) of the Act requires us to prepare a RIA if a rule may have a significant impact on the operations of a substantial number of small rural hospitals. This analysis must conform to the provisions of section 604 of the RFA. For purposes of section 1102(b) of the Act, we define a small rural hospital as a hospital that is outside of a Metropolitan Statistical Area for Medicare payment regulations and has fewer than 100 beds. We did not prepare an analysis for section 1102(b) of the Act because we have determined, and the Secretary of Health and Human Services certifies, that this final rule will not have a significant impact on the operations of a substantial number of small rural hospitals.

Section 202 of the Unfunded Mandates Reform Act of 1995 also requires that agencies assess anticipated costs and benefits before issuing any rule whose mandates require spending in any 1 year of $100 million in 1995 dollars, updated annually for inflation. This rule has no consequential effect on State, local, or Tribal governments or on the private sector.

Executive Order 13132 establishes certain principles and criteria that an agency must follow when it implements a regulation or other policy that has Federalism implications, defined in Order 13132 to mean that the regulation or policy has substantial direct effects on the States, on the relationship between the National Government and the States, or on the distribution of power and responsibilities among the various levels of government. Order 13132 also requires a level of consultation with State or local officials when an agency formulates and implements a regulation that has Federalism implications, imposes substantial direct compliance costs on State and local governments, and is not required by statute.

We do not believe that this regulation has Federalism implications as it does not have a substantial direct effect on the States or on the relationship or distribution of power and responsibilities among levels of government. Nor do we believe the regulation imposes substantial direct compliance costs on States. Rather, the regulation reflects certain statutory changes governing operation of the Units that have already been implemented and codifies policy and practice involving the organization and operation of the Units. We believe the content of the regulation is consistent with the partnership between the Federal and State Governments that has been established for the financing and administration of the larger Medicaid program. We further believe that any costs related to compliance with the regulation are minimal and not substantial.

However, to the extent that that the regulation is seen as having Federalism implications, the regulation is consistent with the principles and criteria established in Order 13132. The regulation would strictly adhere to constitutional principles and would be deferential to the States with respect to the policymaking and administration of State operations related to the investigation and prosecution of Medicaid provider fraud and patient or resident abuse or neglect. With regard to consultation, the policies contained in the regulation were developed in consultation and collaboration with the States.

Executive Order 13771 requires an agency to identify at least two deregulatory actions for each new regulation that the agency proposes or otherwise promulgates. Any new incremental costs associated with a new regulation must, to the extent permitted by law, be offset by the elimination of existing costs through deregulatory actions. It has been determined that this rule is a deregulatory action.

In accordance with the provisions of Executive Order 12866, this regulation was reviewed by the Office of Management and Budget.

V. Paperwork Reduction Act

This rule revises the scope of our annual collection of information at 42 CFR 1007.17. Under the Paperwork Reduction Act of 1995 (PRA), Federal agencies generally must take certain steps, such as seeking public comment on proposed collections of information and submitting proposed collections for review and approval by the Office of Management and Budget, before requiring or requesting information from the public. Accordingly, we solicited public comment on the information required in proposed 42 CFR 1007.17 for OIG's annual review and recertification of Units. After we published the Proposed Rule, however, the Inspector General Empowerment Act of 2016 (Empowerment Act), Public Law No. 114-317, was signed into law on December 16, 2016. Section 2 of the Empowerment Act added subsection (k) to section 6 of the Inspector General Act of 1978. Under new subsection (k), the PRA does not apply to “the collection of information during the conduct of an audit, investigation, inspection, evaluation, or other review conducted by . . . any Office of Inspector General . . . .” As a result, the collection of information under 42 CFR 1007.17 of this rule is exempt from the requirements of the PRA.

List of Subjects

42 CFR Part 455

• Fraud
• Grant programs-health
• Health facilities
• Health professions
• Investigations
• Medicaid
• Reporting and recordkeeping requirements

42 CFR Part 1007

• Administrative practice and procedure
• Fraud
• Grant programs-health
• Medicaid
• Reporting and recordkeeping requirements

The Centers for Medicare & Medicaid Services (CMS) and the Office of Inspector General (OIG), respectively, amend 42 CFR part 455 and 1007 as follows:

PART 455—PROGRAM INTEGRITY: MEDICAID

1. The authority citation for part 455 continues to read as follows:

Authority: Sec. 1102 of the Social Security Act (42 U.S.C. 1302).

2. Section 455.21 is amended by adding paragraph (c) to read as follows:

3. Part 1007 is revised to read as follows:

PART 1007—STATE MEDICAID FRAUD CONTROL UNITS

Authority: 42 U.S.C. 1302, 1396a(a)(61), 1396b(a)(6), 1396b(b)(3), and 1396b(q).

Subpart A—General Provisions and Definitions

Subpart B—Requirements for Certification

Subpart C—Federal Financial Participation (FFP)

Subpart D—Other Provisions