Summary

August 2014 California Department of Health Care Services Its Failure to Properly Administer the Drug Medi-Cal Treatment Program Created Opportunities for Fraud Report 2013-119 COMMITMENT INTEGRITY LEADERSHIP The first five copies of each California State Auditor report are free. Additional copies are $3 each, payable by check or money order. You can obtain reports by contacting the California State Auditor’s Office at the following address: California State Auditor 621 Capitol Mall, Suite 1200 Sacramento, California 95814 916.445.0255 or TTY 916.445.0033 OR This report is also available on our Web site at www.auditor.ca.gov. The California State Auditor is pleased to announce the availability of an online subscription service. For information on how to subscribe, visit our Web site at www.auditor.ca.gov. Alternate format reports available upon request. Permission is granted to reproduce reports. For questions regarding the contents of this report, please contact Margarita Fernández, Chief of Public Affairs, at 916.445.0255. For complaints of state employee misconduct, contact the California State Auditor’s Whistleblower Hotline: 1.800.952.5665. Elaine M. Howle State Auditor Doug Cordiner Chief Deputy August 19, 2014 2013‑119 The Governor of California President pro Tempore of the Senate Speaker of the Assembly State Capitol Sacramento, California 95814 Dear Governor and Legislative Leaders: As requested by the Joint Legislative Audit Committee, the California State Auditor presents this audit report concerning the California Department of Health Care Services’ (Health Care Services) administration of the Drug Medi‑Cal Treatment Program (program). The program provides substance abuse services to Medi‑Cal beneficiaries when physicians determine they are medically necessary. To provide these services, Health Care Services must coordinate with the counties and certify substance abuse clinics, which we refer to as providers. The program provides five types of services, including outpatient drug‑free treatment services (outpatient drug‑free services), which are the focus of this report. Before July 2012 Health Care Services negotiated an interagency agreement with the California Department of Alcohol and Drug Programs (ADP) to administer the program. Effective July 1, 2012, state law transferred to Health Care Services the responsibility of administering the program. This report concludes that Health Care Services’ and ADP’s failure to properly administer the program created opportunities for fraud. Using five high‑risk indicators that we believe are symptomatic of fraud, our analysis of four years of statewide program claims billing data identified $93.7 million in payments that Health Care Services and ADP authorized for more than 2.6 million outpatient drug‑free services that are potentially indicative of fraudulent activity. Our testing of 338 of these services in the counties of Fresno, Los Angeles, and Sacramento found that providers could not produce complete patient records for services they purportedly rendered. In total, we identified roughly $60,000 in deficiencies for these providers. In addition, our analysis of statewide program claims billing data for outpatient drug‑free services provided between July 1, 2008, and December 31, 2013, found that the State approved nearly $1 million to potentially ineligible providers, the majority of which Health Care Services believes was recovered through a subsequent cost‑settlement process. This report also concludes that neither Health Care Services nor ADP implemented an effective provider certification process during our audit period, nor did they enforce laws and regulations designed to prevent fraudulent provider applicants from obtaining program certification. Moreover, neither Health Care Services nor ADP consistently followed their own certification processes. Consequently, our review of the files of 25 program provider applicants found serious deficiencies in each. Despite the weaknesses in their screening processes, neither Health Care Services nor ADP took steps to strengthen the program recertification requirements until mandated to do so by the federal government in March 2011. Health Care Services’ 2013 internal review highlighted numerous weaknesses and inefficiencies in its administration of the program, including the need to improve the coordination between the department staff responsible for administering the program and coordination with the counties. However, Health Care Services has yet to implement recommendations critical to ensuring its ability to address fraud in a timely manner and effectively mitigate the State’s financial and legal risks. Respectfully submitted, ELAINE M. HOWLE, CPA State Auditor 621 Capitol Mall, Suite 1200 Sacramento, CA 95814 916.445.0255 916.327.0019 fax www.auditor.ca.gov Blank page inserted for reproduction purposes only. California State Auditor Report 2013-119 v August 2014 Contents Summary 1 Introduction 7 Chapter 1 The State and Counties Approved Millions of Dollars in Questionable Outpatient Drug‑Free Treatment Services 19 Recommendations 34 Chapter 2 The State’s Weak Certification Process May Have Caused It to Certify Ineligible Outpatient Drug‑Free Treatment Providers 37 Recommendations 50 Chapter 3 The State’s Ineffective Coordination Within Its Own Divisions and With the Counties May Compromise the Integrity of the Drug Medi‑Cal Treatment Program 53 Recommendations 60 Appendix A Services Potentially Indicative of Fraudulent Activity 63 Appendix B Status of Recommendations From the California Department of Health Care Services’ Limited Scope Review of the Drug Medi‑Cal Treatment Program 69 Response to the Audit California Department of Health Care Services 81 California State Auditor’s Comments on the Response From the California Department of Health Care Services 101 vi California State Auditor Report 2013-119 August 2014 Blank page inserted for reproduction purposes only. California State Auditor Report 2013-119 1 August 2014 Summary Results in Brief Audit Highlights . . . California participates in the federal Medicaid program through Our audit of the California Department of the California Medical Assistance Program, or Medi‑Cal. The Health Care Services’ and the California Medi‑Cal program provides beneficiaries with substance abuse Department of Alcohol and Drug services when medically necessary through the Drug Medi‑Cal Programs’ administration of the Drug Medi‑Cal Treatment Program (program). The program provides five types Treatment Program (program) highlighted of services, including outpatient drug‑free treatment services the following: (outpatient drug‑free services), which are the focus of this audit. Although the California Department of Health Care Services » Between July 1, 2008, and December 31, 2013, (Health Care Services) is the single state agency responsible for the State approved nearly $1 million to administering the Medi‑Cal program, beginning in 1980 it entered potentially ineligible substance abuse into interagency agreements with the California Department of clinics (providers). Alcohol and Drug Programs (ADP) to administer the program. » We found 323 instances amounting to more However, in July 2012, state law transferred the responsibility of than $10,000 in which the State reimbursed administering the program and the employees performing its providers for services they purportedly rendered functions to Health Care Services. to deceased beneficiaries. In July 2013 the media reported significant issues regarding the » Our analysis of four years of program claims integrity of the program in Los Angeles County. According to these billing data identified $93.7 million in reports, counties approved payments to substance abuse clinics authorized payments that were potentially in southern California during fiscal years 2011–12 and 2012–13 indicative of fraudulent activity. that showed signs of having engaged in deception or questionable » Neither department implemented an effective billing practices. These substance abuse clinics, commonly referred provider certification process, nor did they to as providers, rendered outpatient drug‑free services and other enforce laws and regulations designed to program services to Medi‑Cal beneficiaries under an agreement prevent fraudulent provider applicants from with either the county or the State. Health Care Services has since obtaining certification. suspended or terminated many of these providers’ contracts. » Neither department consistently followed its Our analysis of claims that outpatient drug‑free services own certification processes—we found serious providers submitted for reimbursement between July 1, 2008, deficiencies in each of the files of 25 program and December 31, 2013, found that the State approved nearly $1 provider applicants we reviewed. million to potentially ineligible providers, the majority of which Health Care Services believes was recovered through a subsequent » The departments only took steps to cost‑settlement process. However, because Health Care Services did strengthen the program recertification not provide the supporting documentation for the cost‑settlement process when mandated to do so by the process until after the conclusion of our fieldwork, we were unable federal government. to complete the procedures needed to verify this assertion. We also found 323 instances amounting to more than $10,000 in which the State reimbursed providers for services they purportedly rendered to deceased beneficiaries. This occurred because Health Care Services and ADP lacked adequate processes to identify ineligible providers and deceased beneficiaries when they processed these claims for payment. Although both Health Care Services and ADP could have accessed the data necessary to prevent these payments, they failed to use the information available to them in a timely manner. 2 California State Auditor Report 2013-119 August 2014 In addition, our analysis of four years of statewide program claims billing data identified $93.7 million in payments that Health Care Services and ADP authorized for more than 2.6 million outpatient drug‑free services that are potentially indicative of fraudulent activity. Specifically, we used five high‑risk indicators to identify claims statewide that we believe are symptomatic of fraud. We developed these indicators using our professional judgment and our knowledge of known cases of fraudulent activity, interviews with Health Care Services, and background information for the audit— including the media reports already referenced. Although we could not review the more than 2.6 million outpatient drug‑free services to verify their validity, we visited three counties—Fresno, Los Angeles, and Sacramento—and reviewed providers’ documentation for a total of 338 of these services. We found that 10 of the 16 providers we visited could not locate the patient records or provide adequate documentation to support 74 of the services they purportedly rendered. We also determined that seven of the 10 providers could not support an additional 1,784 services because of deficiencies such as missing the sign‑in sheets for six months of group‑counseling sessions. In total, the State authorized roughly $60,000 for these 1,858 improperly documented services. When providers cannot produce complete patient records, they cannot demonstrate that beneficiaries received the services and the State or counties can then recover any payments for these services. The State’s failure to establish an adequate provider certification process may have contributed to the questionable billings that we found. Neither Health Care Services nor ADP implemented an effective provider certification process during our audit period, nor did they enforce laws and regulations designed to prevent fraudulent provider applicants from obtaining program certification. For example, federal regulations require provider applicants to disclose the names of their owners and managing employees, as well as those individuals’ histories of fraud, abuse, medical license suspensions, or related convictions, if applicable. However, Health Care Services and ADP did not ensure the accuracy and completeness of the provider applicants’ information, and they did not always conduct mandated database searches to verify the information applicants provided. Further, Health Care Services failed to fully implement federal regulations that require it to assign risk levels to all provider applicants, which prevents it from accurately assessing the appropriate amount of screening it should use to certify a provider applicant. Moreover, neither Health Care Services nor ADP consistently followed its own certification processes. Consequently, our review of the files of 30 program provider applicants found serious deficiencies in each. Five of the 30 provider applicant files we selected were missing altogether, which may impede the State’s California State Auditor Report 2013-119 3 August 2014 ability to take action against these providers in the future because Health Care Services will be unable to prove the providers’ original ownership, for instance. Other application files were missing critical checklists and important documentation. Further, for a five‑month period in 2011, ADP certified six of the provider applicants using a modified certification process that limited its ability to ensure their compliance with state and federal laws and regulations. Despite these weaknesses in their screening processes, neither Health Care Services nor ADP took steps to strengthen the program recertification process until mandated to do so by the federal government. As of March 25, 2011, federal regulations require the recertification of all program providers every five years. However, before this change in federal regulations, Health Care Services’ program certification standards did not require the recertification of a provider unless it changed (1) its ownership, (2) its scope of services or hours of treatment, (3) its physical space through remodeling, or (4) its location. As a result, Health Care Services and ADP essentially certified providers indefinitely unless they experienced one of the four changes described above. Further, we found that neither Health Care Services nor ADP had a mechanism in place to monitor all of these recertification‑triggering events. Health Care Services has identified areas in which it can improve its administration of the program. Specifically, its Audits and Investigations Division (investigations division) conducted an internal review in 2013 that highlighted numerous gaps in Health Care Services’ administration of the program.1 The investigations division made a number of recommendations to improve the program. Thirteen of these recommendations related specifically to improving the coordination between the department staff responsible for administering the program. Our review found that Health Care Services has fully implemented four of these recommendations but is still in the process of implementing the other nine. The implementation of these remaining recommendations is critical to ensuring its ability to address fraud in a timely manner and effectively mitigate the State’s financial and legal risks. Health Care Services is also in the process of attempting to improve its coordination with the counties, which also play a major role in the program’s administration. Specifically, Health Care Services generally contracts with the counties to provide program services, 1 The investigations division defined gaps as internal control weaknesses; inefficient or ineffective business practices; and the lack of statutory or regulatory authority to meet performance expectations, ensure program integrity, and effectively mitigate Health Care Services’ financial or legal risks. 4 California State Auditor Report 2013-119 August 2014 and the counties in turn contract with providers. Consequently, the investigations division recommended that Health Care Services transfer some of its monitoring responsibilities to the counties, which it considers the front line of defense to ensure that providers deliver services appropriately. State regulations require counties to process the providers’ reimbursement claims and ensure that providers bill for reimbursements that are within the established rates. To meet this requirement, the counties we visited conduct site reviews of their providers to identify areas of noncompliance and other types of deficiencies. Health Care Services is currently revising its contract with the counties to establish a more coordinated process for monitoring providers; however, it has not completed the necessary changes. Further, the counties have expressed the need for greater communication from Health Care Services about providers it certifies. Recommendations To ensure that the providers receive reimbursement for only valid services, Health Care Services should immediately do the following: • Coordinate with the counties to recover inappropriate payments to ineligible providers and for services purportedly rendered to deceased beneficiaries. • Develop and implement new procedures for routinely identifying and initiating recovery efforts for payments that it authorizes between the effective date of a provider’s decertification and the date it became aware of the decertification, in addition to the payments it authorizes between a beneficiary’s date of death and its receipt of the death record. • Direct its investigations division to determine whether it should recover any overpayments for the services that are potentially indicative of fraudulent activity that we identified statewide. Based on its findings, Health Care Services should take the appropriate disciplinary action against the providers, such as suspension or termination. • Direct its fiscal management and accountability branch to work with Fresno, Los Angeles, and Sacramento counties to recover the specific overpayments we identified during our visits. California State Auditor Report 2013-119 5 August 2014 To prevent the certification of ineligible providers, Health Care Services should immediately do the following: • Instruct its staff to compare the names of the managing employees whom applicant providers identify in their program applications to those whom they identify in their disclosure statements. • Instruct its Provider Enrollment Division to conduct all required database searches of individuals that provider applicants identify as their owners or managing employees. • Designate risk levels for all provider applicants in accordance with federal regulations. To ensure that it appropriately and consistently reviews provider applications, Health Care Services should do the following: • Direct its certification staff to follow the procedures that it has put in place to screen provider applicants’ eligibility. • Retain the documentation, such as checklists, that it uses to support its certification decisions in accordance with its retention policy. To improve the coordination between its divisions and branches and ensure that it addresses allegations of fraud in a timely manner, to the extent possible, Health Care Services should fully implement the investigations division’s recommendations. To strengthen the coordination between the State and the counties, Health Care Services should amend the State‑county contract to address any gaps in their collective monitoring efforts. Agency Comments Health Care Services agreed with our findings and recommendations. Health Care Services stated it has taken actions or plans to take actions to implement the recommendations. 6 California State Auditor Report 2013-119 August 2014 Blank page inserted for reproduction purposes only. California State Auditor Report 2013-119 7 August 2014 Introduction Background The federal Medicaid program provides funds to states to pay for the medical treatment of the needy. The State of California participates in the federal Medicaid program through its California Medical Assistance Program, known as Medi‑Cal, which provides health care services to the aged, disabled, and indigent. The California Department of Health Care Services (Health Care Services) is the single state agency responsible for administering the Medi‑Cal program. State statute and regulations require the Medi‑Cal program to provide beneficiaries with substance abuse services when physicians determine they are medically necessary. It provides these services through the Drug Medi‑Cal Treatment Program (program). To provide these substance abuse services, Health Care Services must coordinate with counties. Specifically, state law allows Health Care Services to enter into program contracts with each county to oversee the provision of services within its own service area. The counties must negotiate contracts only with providers that Health Care Services has certified to provide program services.2 These providers are typically substance abuse clinics. If a county decides not to enter into or terminates its program contract with Health Care Services, Health Care Services must contract directly with certified providers in the county as necessary to ensure beneficiary access to the program services. We refer to these contracts as direct provider contracts. Table 1 on the following page shows the type and description of the substance abuse services that the program provides to Medi‑Cal eligible beneficiaries when the services are determined to be medically necessary by a physician. Table 1 also shows the number of providers and the dollar amounts that Health Care Services approved for payment, by type of service, in fiscal year 2012–13. 2 State law defines a provider as any individual, partnership, group, association, corporation, institution, or entity, and the officers, directors, owners, managing employees, or agents of any partnership, group association, corporation, institution, or entity, that has been enrolled in the Medi‑Cal program and provides services, goods, supplies, or merchandise, directly or indirectly, to a Medi‑Cal beneficiary. As of January 1, 2013, the term also includes those who order, refer, or prescribe to a Medi‑Cal beneficiary. 8 California State Auditor Report 2013-119 August 2014 Table 1 Drug Medi-Cal Treatment Program Substance Abuse Services AMOUNT OF NUMBER OF SERVICES APPROVED PROVIDERS IN FOR PAYMENT IN SERVICE TYPE SERVICE DESCRIPTION FISCAL YEAR 2012–13* FISCAL YEAR 2012–13 Outpatient drug‑free treatment An outpatient service directed at stabilizing and rehabilitating 419 $60,724,308 persons with substance abuse diagnoses. Narcotic treatment program An outpatient service using methadone or 122 107,080,936 levoalphacetymethadol directed at stabilizing and rehabilitating persons who are opiate‑addicted and have a substance abuse diagnosis. However, the program does not include detoxification treatment. Day care habilitative Outpatient counseling and rehabilitative services provided at 124 29,689,306 least three hours per day, three days per week to persons with substance abuse diagnoses who are pregnant or postpartum. Perinatal residential substance abuse A noninstitutional, nonmedical, residential program that 14 1,756,308 provides rehabilitation services to pregnant and postpartum women with substance abuse diagnoses. Naltrexone treatment An outpatient treatment service directed at serving detoxified 0 0 opiate addicts who have substance abuse diagnosis by using the drug Naltrexone, which blocks the euphoric effects of opiates and helps prevent relapse to opiate addiction. Sources: California Code of Regulations, Title 22, Section 51341.1, and the California Department of Health Care Services’ unaudited provider and approved for payment data. * In some instances the providers’ Drug Medi‑Cal Treatment Program certification allows them to provide more than one type of service. In addition, this number includes the providers’ parent sites but does not include their satellite sites. The Joint Legislative Audit Committee (audit committee) specifically directed the California State Auditor (state auditor) to audit outpatient drug‑free treatment services (outpatient drug‑free services), which has the highest number of program providers, as shown in Table 1. In fiscal year 2012–13, the program reimbursed providers for perinatal outpatient drug‑free services at the rates of $101.99 for an individual counseling session and $61.33 per person for group‑counseling sessions.3 The program reimbursed providers for nonperinatal outpatient drug‑free services at the rates of $71.25 for an individual counseling session and $30.28 per person for group‑counseling sessions. The State’s Administration of the Program Beginning in 1980 Health Care Services negotiated interagency agreements with the former California Department of Alcohol and Drug Programs (ADP) to provide substance abuse treatment services to Medi‑Cal beneficiaries by administering the program. The departments’ final interagency agreement in 2004 incorporated state regulations that required ADP to provide administrative and fiscal oversight, monitoring, and auditing of program services; to conduct 3 Perinatal outpatient drug‑free services address treatment and recovery issues specific to pregnant and postpartum women, such as relationships, sexual and physical abuse, and development of parenting skills. California State Auditor Report 2013-119 9 August 2014 on‑site post‑service post‑payment utilization reviews; and to demand recovery of overpayments made to program providers. Effective July 1, 2012, state law transferred to Health Care Services the responsibility of administering the program and the employees performing its functions.4 Although the State bears much of the responsibility for managing the program, the counties play a major role in its administration. State regulations require the counties to implement and maintain a system of fiscal disbursement and controls over the program services rendered by providers that contract with them. Under the State‑county contract, the counties assume the financial risk of reimbursing claims that Health Care Services may later reject during its claims adjudication process. Table 2 summarizes the program responsibilities of Health Care Services, ADP, and the counties. Table 2 State and Counties’ Responsibilities for Administering the Drug Medi-Cal Treatment Program CALIFORNIA DEPARTMENT OF HEALTH CARE CALIFORNIA DEPARTMENT OF ALCOHOL AND RESPONSIBILITY SERVICES (HEALTH CARE SERVICES) DRUG PROGRAMS (ADP) COUNTIES Administrative oversight Health Care Services contracted Before fiscal year 2012–13, ADP Counties contracting with program out administrative oversight of the handled the administrative oversight providers are responsible for ensuring Drug Medi‑Cal Treatment Program of the program. Specifically, ADP that those providers comply with the (program) until fiscal year 2012–13. was responsible for ensuring requirements in the State‑county Nevertheless, Health Care Services that all providers and counties contract, all relevant state and federal remained the single state agency that participated in the program laws and regulations, and the county’s primarily responsible for the overall properly contracted for the provision contract requirements. The counties are administration of the program during of program services and that all also responsible for safeguarding any this time. providers and counties complied confidential information pertaining to the with all relevant state and federal program and its beneficiaries. When the Legislature transferred laws and regulations. the program to Health Care Services in fiscal year 2012–13, The Legislature transferred the Health Care Services assumed program to Health Care Services in all of ADP’s administrative fiscal year 2012–13, ending ADP’s oversight responsibilities. administration of it. Fiscal oversight When the Legislature transferred Until fiscal year 2012–13, ADP was Counties contracting with program the program to Health Care Services responsible for the fiscal oversight providers are responsible for in fiscal year 2012–13, Health Care of the program. Specifically, ADP submitting provider claims, complying with Services assumed the responsibility developed the process for claims the Drug Medi-Cal Billing Provider Manual, for its fiscal oversight, which ADP had submission and processing, reviewing claims to determine if they are previously handled. provided training to counties on within reimbursable rates, and submitting claims submission, reviewed claims annual cost‑settlement reports to the State. to determine if they were within reimbursable amounts, and sought recovery of overpayments. continued on next page . . . 4 State law requires that whenever a function or the administration of a law is transferred from one state agency to another state agency, all persons serving in state civil service and engaged in the performance of the function or the administration of law must be transferred to that state agency. 10 California State Auditor Report 2013-119 August 2014 CALIFORNIA DEPARTMENT OF HEALTH CARE CALIFORNIA DEPARTMENT OF ALCOHOL AND RESPONSIBILITY SERVICES (HEALTH CARE SERVICES) DRUG PROGRAMS (ADP) COUNTIES Monitoring When the Legislature transferred Until fiscal year 2012–13, ADP was Counties contracting with program the program to Health Care Services responsible for monitoring the providers are responsible for monitoring in fiscal year 2012–13, Health Care program. Specifically, ADP was providers to ensure that they comply with Services assumed all program responsible for monitoring county all contractual requirements, program monitoring responsibilities, which ADP compliance with the implementation requirements, and any relevant laws and had previously handled. of the program at the local level and regulations. In order to ensure accessibility for ensuring that providers complied to program services, the counties monitor with all the program requirements, and evaluate beneficiary wait times. The laws, and regulations. counties are also responsible for submitting treatment data to the State on a monthly basis. Auditing From fiscal year 2008–09 until the Until fiscal year 2012–13, ADP was Counties contracting with program Legislature transferred the program responsible for program audits. providers typically conduct financial audits to Health Care Services, ADP was Specifically, ADP was responsible of the providers as part of their contracting responsible for auditing program for conducting annual program practices. The program treatment standards providers. However, Health Care audits of a sufficient number require the providers to have an audit Services oversaw program appeal of county providers and direct of the program operations at least every hearings regarding program audits contract providers to ensure that the two years. during this time. payments the State made to each was in accordance with state and When the Legislature transferred federal requirements. the program to Health Care Services in fiscal year 2012–13, Health Care Services assumed all of ADP’s auditing responsibilities. Post‑service post‑payment When the Legislature transferred Until fiscal year 2012–13, ADP was After the State conducts its utilization utilization reviews the program to Health Care Services responsible for utilization reviews. reviews, the counties are responsible for (utilization reviews) in fiscal year 2012–13, Health Specifically, ADP reviewed providers making sure that the providers address Care Services assumed all of ADP’s to ensure that they maintained any findings and implement corrective utilization review responsibilities. required documentation in their action plans. individual patient records, that beneficiaries met the admissions criteria, that treatment plans existed for each beneficiary, and that the providers rendered the services they claimed for reimbursement. Sources: California Welfare and Institutions Code, sections 14021.6, 14041.5, 14124.23, and 14124.24; California Code of Regulations, Title 22, sections 51341.1, 51490.1, and 51516.1; Assembly Bill 106, June 29, 2011; Drug Medi-Cal Certification Standards for Substance Abuse Clinics; Standards for Drug Treatment Programs; Drug Medi-Cal Billing Provider Manual; Interagency Agreement between Health Care Services and ADP; and interviews with and documents provided by Health Care Services and the three counties we visited—Fresno, Los Angeles, and Sacramento. In addition to the responsibilities shown in Table 2, Health Care Services is responsible for certifying and decertifying program providers by reviewing their applications for substance abuse clinics and satellites, as well as for perinatal residential substance abuse programs. Health Care Services is also responsible for conducting on‑site facility inspections in accordance with established certification standards. ADP was responsible for these same duties before July 1, 2012. Figure 1 shows the program certification process from July 1, 2008 through December 31, 2013. California State Auditor Report 2013-119 11 August 2014 Figure 1 Drug Medi-Cal Treatment Program’s Certification Processes From July 1, 2008 Through December 31, 2013 STATE ENTITY RESPONSIBLE FOR CERTIFICATION (July 1, 2008 – December 31, 2013) PROVIDER California Department of Alcohol and Drug APPLICANT Programs (ADP) California Department of Health Care Services (Health Care Services) The provider July 1, 2008 – June 30, 2012 July 1, 2012 – December 31, 2013 applicant submits Policy and Program Support Branch Drug Medi-Cal Certification Unit (certification unit) its application and (support branch) After ADP merged with Health Care Services in July 2012, Medi-Cal disclosure From July 2008 to April 2011, the support Health Care Services created a separate unit that was responsible statement to the branch was responsible for certifying for performing program certifications. responsible state Drug Medi-Cal Treatment Program entity for its review. (program) providers. Licensing and Certification Branch (certification branch) In July 2013 Health Care Services moved the certification unit Field Operations Branch to the certification branch. This branch performed program In May 2011 ADP dissolved the support certifications until January 1, 2014, when Health Care Services branch and transferred its certification transferred the responsibility for processing applications to the responsibilities to the field operations branch. Provider Enrollment Division (enrollment division). APPLICATION ADP HEALTH CARE SERVICES REVIEW PROCESS July 1, 2008 – June 30, 2012 July 1, 2012 – December 31, 2013 July 1, 2008 – PROCESS 1 PROCESS 2 PROCESS 3 PROCESS 4 December 31, 2013 Drug Medi-Cal Parent Compliance Agreement Summary Checklist Parent Checklist Application Checklist From January 2011 through From June 2011 through From July 2012 through (parent checklist) May 2011, ADP required provider June 2012, ADP required December 2013, both From July 2008 through applicants to attest that they had provider applicants to the certification unit and January 2011, ADP used the required documentation by submit more documentation certification branch returned a comprehensive signing a compliance agreement. upfront than it had under to the comprehensive parent checklist, referred to The provider applicants were to the compliance agreement. checklist. In addition, as as the parent checklist. prepare all of the documents Under this process, ADP of September 2013, the The parent checklist previously required by the parent required analysts to review certification branch began determines the checklist and have them ready for the remaining documents using an enrollment division completeness of review by ADP during the site visit, during the site visit. checklist that incorporated the application. if requested. federal requirements. The responsible state entity notifies the provider YES applicant of any identified documentation deficiencies NO Does the and gives it 60 days to address those deficiencies. If the application or provider applicant does not address all deficiencies If all deficiencies are cleared, Medi-Cal disclosure within the specified timeline, then the responsible then the responsible state statement have state entity terminates the application. entity conducts a facility review. deficiencies? ADP HEALTH CARE SERVICES FACILITY REVIEW July 1, 2008 – June 30, 2012 July 1, 2012 – December 31, 2013 July 1, 2008 – PROCESS 1 PROCESS 2 PROCESS 3 PROCESS 4 December 31, 2013 Facility Review Compliance Agreement Field Facility Review Facility Review From July 2008 through Facility Review From June 2011 through From July 2012 through January 2011, ADP visited From February 2011 through June 2012, ADP conducted a December 2013, Health Care the provider applicants' May 2011, ADP conducted a facility review and required Services returned to sites to ensure that the facility review and required analysts to review the conducting the facility review. facilities met certain safety, provider applicants to have remaining documents not accessibility, and records their application documents reviewed under the retention standards. ready for review, if requested, summary checklist process during site visits. during the site visit. The responsible state entity notifies the provider YES Does the provider applicant of any identified facility deficiencies and NO applicant’s site gives it 30 days to address those deficiencies. If the have deficiencies? provider applicant does not address all deficiencies If all deficiencies are cleared, then the responsible state within the specified timeline, then the responsible entity adds the provider to its database of certified state entity terminates the application. providers, and it sends the provider a notice of certification. $ The certified provider or the responsible state entity notifies the county of the certified provider’s CERTIFIED PROVIDER interest in providing program services. The certified If the county refuses to contract with provider can receive COUNTY NO the certified provider, the State STATE Does the county enter payments from contracts directly with that provider. into a contract with the the program. certified provider? YES Sources: Code of Federal Regulations, Title 42, Section 455.450; California Welfare and Institutions Code, sections 14214.21 and 14214.24(d) and (e); California Health and Safety Code, Section 11772(b)(3); Drug Medi-Cal Certification Standards for Substance Abuse Clinics, effective July 1, 2004; interviews with Health Care Services’ management; and documents obtained from Health Care Services. 12 California State Auditor Report 2013-119 August 2014 The State’s Responsibility for Investigating Program Fraud Allegations State law identifies Health Care Services and the Office of the Attorney General’s Bureau of Medi‑Cal Fraud and Elder Abuse (fraud bureau) as the two state entities responsible for handling the investigation of fraud allegations in the Medi‑Cal program. Federal regulations state that a credible allegation of fraud may be one that the State has verified from any source. Potential sources of credible allegations include, but are not limited to, fraud hotline complaints; the State’s analysis of claims data; and patterns the State identifies through provider audits, civil false claims cases, and law enforcement investigations. Health Care Services’ Audits and Investigations Division (investigations division) uses various methods to identify potential fraud, including data analyses to monitor the practices and billing activities of providers, reviews of complaints from the counties and the general public, and daily communication with partners in the health care industry. If the investigations division’s preliminary investigation results in a credible fraud allegation against a program provider, it will refer the case to the fraud bureau for a full investigation. The investigations division is solely responsible for conducting the full investigation for fraud allegations against beneficiaries of the Medi‑Cal program. The deputy director of the investigations division stated that, as of December 31, 2013, the investigations division had 100 investigators responsible for investigating Medi‑Cal fraud allegations. The fraud bureau receives referrals of potentially fraudulent activity involving Medi‑Cal providers from the investigations division, counties, and the general public. State law authorizes the fraud bureau to investigate and either prosecute or refer for prosecution violations of all applicable laws pertaining to fraud in the administration of the Medi‑Cal program. A senior management auditor of the fraud bureau stated that, as of December 31, 2013, it had 74 investigators, 64 of whom were responsible for handling Medi‑Cal fraud allegations. The senior management auditor also stated that, between July 1, 2008, and December 31, 2013, the fraud bureau received 111 allegations against program providers. Figure 2 shows the program’s fraud referral process. At the local level, state law requires public prosecutors and district attorneys in each county to use their discretion to initiate and conduct all prosecutions for public offenses. State law also gives local law enforcement and prosecution agencies concurrent jurisdiction with the fraud bureau to investigate and prosecute violations of all applicable laws pertaining to fraud in the administration of the Medi‑Cal program. Thus, counties have the option of referring allegations of fraud in the Medi‑Cal program to either their local district attorneys or the fraud bureau. California State Auditor Report 2013-119 13 August 2014 Figure 2 Drug Medi-Cal Treatment Program’s Fraud Referral Process Between July 1, 2008 and December 31, 2013 COMPLAINANT The complainant reports an allegation of Drug Medi-Cal Treatment Program (program) fraud to the State or the county. STATE The complainant can report the allegation directly to the state The complainant can report the allegation COUNTY entity responsible for administering the program or to the directly to the county entity responsible state entities responsible for investigating allegations of for administering the program or through Medi-Cal fraud, which maintain complaint hotlines. the county's fraud hotline. STATE ENTITY RESPONSIBLE FOR COUNTY ENTITY RESPONSIBLE FOR Administering Investigating Allegations Administering Investigating Allegations the Program of Medi-Cal Fraud the Program of Medi-Cal Fraud (county entity) (investigating entity) California Department California Office of the of Alcohol and Attorney General’s Bureau Fresno County Fresno County Drug Programs (ADP) of Medi-Cal Fraud and Department of Auditor-Controller/ July 1, 2008 through Elder Abuse (fraud bureau) Behavioral Health Treasurer-Tax Collector’s Financial June 30, 2012 Reporting and Audits Division California Department of Health Care Services’ Audits Los Angeles County Los Angeles County Health Care Services and Investigations Division Department of Public Health Department of Auditor-Controller’s (Health Care Services) (investigations division) Office of County Investigations Sacramento County July 1, 2012 through Department of Health and Sacramento County present Human Services Department of Finance’s Auditor-Controller Division STATE COUNTY The investigations division accepts or rejects the The county entity may refer allegations of fraud complaint based upon its merits and the associated to the State or to the investigating entity, which evidence it received. The investigations division will decide on a case-by-case basis whether to then must conduct a preliminary investigation refer the allegation to the State or local law of the complaint to determine whether there is a enforcement and prosecution agencies. credible allegation of fraud. If the fraud bureau receives a complaint of Medicaid fraud or abuse, it must conduct a preliminary investigation to determine whether there is a credible allegation of fraud. ?Has the State determined that the The State and county will decide Has the county determined that the? on a case-by-case basis if they will notify allegation of fraud is credible? allegation of fraud is credible? each other of an ongoing investigation. Neither have an obligation to do so. NO YES YES NO If the investigations division or fraud bureau is If the county's investigating entity unable to substantiate the allegation, it will is unable to substantiate either refer the case back to the appropriate the allegation, in most parties or close the case. circumstances it will If the case is an allegation of fraud The investigating entity either refer the case against a Medi-Cal provider, then the will refer the case to the back to the county fraud bureau is responsible for the investigation. district attorney, other entity or close local law enforcement, or the case. If the case is an allegation of fraud a state agency on a against a Medi-Cal beneficiary, then the case-by-case basis. investigations division is responsible for the investigation. A full investigation must continue until appropriate legal action is initiated, the case is closed or dropped because of insufficient evidence to support the allegations of fraud or abuse, or Health Care Services and the provider or beneficiary resolve the matter. Sources: Code of Federal Regulations, Title 42, sections 455.14, 455.15, 455.16, 455.2, and 1007.11; California Government Code, sections 12528(a) and (c); California Welfare and Institutions Code, Section 14021.30; interviews with management and key staff from the investigations division, the fraud bureau, the investigating entities, and county entities listed in the figure; and documents obtained from Health Care Services, Fresno County, Los Angeles County, and Sacramento County. 14 California State Auditor Report 2013-119 August 2014 Recent Media Allegations of Fraud in the Program On July 18, 2013, Health Care Services issued a press release stating that the investigations division’s preliminary investigation of 22 substance abuse clinics found that 16 of these clinics were in violation of the program’s federal and state laws. Health Care Services also stated that it had temporarily suspended the 16 clinics. In late July 2013 The Center for Investigative Reporting (CIR) and the Cable News Network (CNN) reported widespread fraud in the program. Using information obtained from Health Care Services, they reported that counties approved payments to 56 substance abuse clinics in southern California during fiscal years 2011–12 and 2012–13 that showed signs of deception or questionable billing practices. For example, CIR and CNN reported allegations such as providers billing for deceased individuals and for foster children with no substance abuse history. In addition, they reported allegations that an owner of one program substance abuse treatment clinic was certified although he was on parole after having served one year of a seven‑year sentence for engaging in organized crime. The investigations division continued its preliminary investigation by conducting targeted reviews of specific providers throughout the State. Health Care Services reported to the Centers for Medicare and Medicaid Services that as of June 20, 2014, it had temporarily suspended or terminated the certifications of 74 providers, which constitutes a total of 236 facilities. The majority of these suspended providers were in Los Angeles County. Scope and Methodology The audit committee directed the state auditor to conduct an audit of the program and a selection of counties responsible for administering the program. The audit committee approved six objectives. We list the objectives the audit committee approved and our methods for addressing them in Table 3. California State Auditor Report 2013-119 15 August 2014 Table 3 Audit Objectives and the Methods Used to Address Them AUDIT OBJECTIVE METHOD 1 Review and evaluate the laws, rules, • Reviewed relevant federal and state laws and regulations. and regulations significant to the • Reviewed certification and treatment standards and other relevant policies and procedures adopted by audit objectives. the California Department of Health Care Services (Health Care Services) and the California Department of Alcohol and Drug Programs (ADP). • Reviewed relevant policies and procedures adopted by the counties of Fresno, Los Angeles, and Sacramento. 2 Identify the roles and responsibilities • Reviewed relevant federal and state laws and regulations. of the appropriate state and county • Reviewed the contracts between Health Care Services and ADP as well as contracts between the level entities overseeing outpatient departments and the counties. drug‑free treatment clinics and • Interviewed staff at Health Care Services and the counties to gain an understanding of their roles determine whether there is effective and responsibilities. coordination between these entities. • Evaluated those roles and responsibilities to identify the processes Health Care Services and ADP used to coordinate with the counties. • Assessed the effectiveness of the coordination between the State and the counties. 3 Determine whether the policies, • Reviewed the federal and state laws and regulations relevant to the Drug Medi‑Cal Treatment Program processes, and practices used to (program) certification process. approve eligible outpatient drug‑free • Reviewed contractual agreements that pertained to the program certification process. treatment providers are appropriate • Identified key controls applicable to the certification process by determining which certification and effective. checklists and procedure documents were applicable during which time periods during the scope of the audit. • Selected 30 providers that became certified for outpatient drug‑free treatment services between July 2008 and December 2013 and reviewed the applications they submitted to Health Care Services or ADP for review. • Interviewed key staff at the three counties we visited to determine if they imposed requirements in addition to the program certification requirements to contract with outpatient drug‑free treatment providers. If so, we identified the extent to which each requirement surpasses Health Care Services’ and ADP’s certification requirements. 4 For a period of the most recent • Interviewed Health Care Services’ staff to identify high‑risk indicators of potentially fraudulent activity. five fiscal years, to the extent possible, Federal regulations define fraud as an intentional deception or misrepresentation made by a person with identify fraudulent activity related the knowledge that the deception could result in some unauthorized benefit to him/her or some other to outpatient drug‑free treatment person. For purposes of this audit, we did not identify fraudulent activity related to outpatient drug‑free centers funded through the program treatment providers because whether an act is, in fact, fraud is a determination to be made through in Los Angeles County and two other the judicial or other adjudicative system. Instead, we analyzed statewide program claims billing data to counties chosen by the California identify payments for services that met the criteria of the high‑risk indicators as described in Appendix A State Auditor (state auditor), and for beginning on page 63. a selection of transactions, determine • Using the preliminary results of our statewide analysis, we identified the additional two counties for the following: our review. • Selected 20 transactions for Los Angeles County and 16 for each of the two remaining counties we visited from the services identified in Appendix A. Before selecting these transactions, we excluded all providers that Health Care Services had already suspended or terminated as well as providers that are currently under investigation by the California Office of the Attorney General’s Bureau of Medi‑Cal Fraud and Elder Abuse. Some high‑risk indicators we developed—such as multiple beneficiaries residing at the same address—are designed to identify services that are collectively indicative of potentially fraudulent activity. We generally selected from these transactions the services with the largest approved amounts and reviewed the patient records associated with those services, up to a maximum of five unique beneficiaries. • Reviewed county‑to‑provider contracts for each of the providers we selected at the three counties we visited. continued on next page . . . 16 California State Auditor Report 2013-119 August 2014 AUDIT OBJECTIVE METHOD a. The fiscal impact of any illegal or • Reviewed the selected providers’ patient records associated with the 52 transactions we tested. However, inappropriate activity. we did not review the patient records for the purpose of rendering conclusions of medical necessity based on the patients’ medical information. • Identified the selected providers’ noncompliance with federal and state laws and regulations regarding patient record documentation. • Determined the fiscal impact of any deficiencies we noted. If the provider was missing the beneficiary’s entire patient record or had missing or incomplete treatment plans and medical waivers, we calculated the impact of the deficiency based on all services the provider claimed it rendered to the beneficiary. Similarly, if the provider claimed services before or after the beneficiary’s admission or discharge date, we calculated the impact of the deficiency based on all services the provider claimed it rendered to the beneficiary before or after these dates. Otherwise, we calculated the impact of the deficiency based on the individual service the provider claimed it rendered to the beneficiary. b. The extent and timeliness of any • For each provider with a deficiency, determined whether Health Care Services, ADP, and/or the corrective action taken. respective county had conducted post‑service post‑payment utilization reviews (utilization reviews) or county‑to‑provider contract monitoring reviews during our audit period. • If a review was conducted by any of these entities, determined whether the reviews identified deficiencies similar to those we noted. If so, determined whether the provider submitted a corrective action plan and whether the entities approved it. • Followed up with staff at the appropriate entity to ascertain whether the provider implemented fully the corrective actions related to the deficiencies we noted. c. The reasons why corrective actions Followed up with staff at the appropriate entity to ascertain why the providers had not taken may not have been taken in corrective actions. instances where there were none. 5 Determine whether the number • Interviewed staff at Health Care Services and the counties we selected for review. of compliance regulators and • If applicable, obtained staffing or workload analyses from Health Care Services and the counties we investigators is reasonably sufficient to selected for review to determine whether the staffing levels were sufficient. Health Care Services’ effectively address the occurrence of Audits and Investigations Division (investigations division) is responsible for conducting preliminary fraudulent activity. investigations of the occurrence of fraudulent activity by providers that the State identifies. The investigations division recently obtained three additional staff in fiscal year 2014–15 and, as a result, asserted that it has a sufficient number of staff to address potentially fraudulent activity in the program. The chief of the Los Angeles County’s Department of Auditor‑Controller’s (Los Angeles County Auditor‑Controller) Office of County Investigations asserted that to his knowledge the office has not received or investigated any complaints related to the program. The chief of Fresno County’s Auditor‑Controller/Treasurer‑Tax Collector Financial Reporting and Audits Division asserted that the division has not received a program complaint through its fraud hotline during our audit period. The manager of Sacramento County’s Department of Finance Auditor‑Controller Division asserted that the division has not received any fraud allegations that involve the program during our audit period. • Staff at the State and counties who are responsible for compliance regulating activities—utilization reviews, contract monitoring, and financial audits––are not required to address the occurrence of fraudulent activity as we depict in Figure 2 on page 13. However, the entities performing compliance‑regulating activities at the State and counties assert that either they have adequate staff to perform their duties or they recently received additional staff. 6 Review and assess any other • Based on interviews with key staff, determined that two reports related to the program were issued issues that are significant to the during our audit period. Health Care Services issued one report in November 2013. The Los Angeles administration of the program County Auditor‑Controller issued the other in October 2013 to Los Angeles County’s Department of and to the extent possible, make Public Health, the department responsible for administering the program in the county. recommendations of statutory or • Reviewed each report as follows: regulatory changes that may help further prevent fraud in the program. ‑ To determine whether (i) Health Care Services has implemented any of the recommendations related to our audit scope that are set forth in its Drug Medi‑Cal Treatment Program Limited Scope Review, (ii) substantive testing can be conducted on such implementation efforts, and (iii) our audit scope should be expanded to include the testing of such implementation efforts. We verified the implementation status of these recommendations by adjusting our audit period for certain audit procedures. ‑ To determine whether (i) Los Angeles County’s Department of Public Health has implemented any of the recommendations set forth in the Los Angeles County Auditor‑Controller’s program audit, (ii) substantive testing can be conducted on such implementation efforts, and (iii) our audit scope should be expanded to include the testing of such implementation efforts. We did not follow up on the recommendations because the department was in the early stages of implementing them. Sources: State auditor’s analysis of Joint Legislative Audit Committee audit request number 2013‑119 and the analysis of information and documentation identified in the table column titled Method. California State Auditor Report 2013-119 17 August 2014 Methods to Assess Data Reliability In performing this audit, we obtained electronic data files extracted from the information systems listed in Table 4. The U.S. Government Accountability Office, whose standards we are statutorily required to follow, requires us to assess the sufficiency and appropriateness of computer‑processed information that we use to support findings, conclusions, or recommendations. Table 4 shows the results of our assessments for the various information systems we analyze in this report. Table 4 Methods Used to Assess Data Reliability INFORMATION SYSTEM PURPOSE METHOD AND RESULT CONCLUSION California Department To identify outpatient drug‑free • We performed data‑set verification procedures and electronic Undetermined of Health Care Services treatment services (outpatient testing of key data elements and did not identify any reliability for the (Health Care Services) and drug‑free services) that were significant issues. purpose of this audit. California Department rendered from July 1, 2008 • We did not perform accuracy and completeness testing of of Alcohol and Drug through December 31, 2013, the program billing application data because the source Programs (ADP) and approved for payment. Also, documents required for this testing are stored at various to determine the provider site Short‑Doyle locations throughout the State, making such testing and beneficiary associated with Medi‑Cal ADP cost‑prohibitive. each service and the approved Remediation Technology payment amount. system (program billing application) Drug Medi‑Cal Treatment Program (program) claims billing data for services rendered from July 1, 2008 through December 31, 2013, and submitted for adjudication on or after January 1, 2010 To determine whether • We performed data‑set verification procedures and electronic Not sufficiently outpatient drug‑free services testing of key data elements and did not identify any reliable for the providers were eligible to significant issues. purpose of this audit. receive program payments Nevertheless, we • We conducted accuracy testing for a sample of 30 outpatient for services they rendered to present these data, drug‑free services provider certifications that occurred during beneficiaries from July 1, 2008 as they represent the period from July 1, 2008 through December 31, 2013. through December 31, 2013. the best available Health Care Services could not locate five of the 30 files we data source of selected for testing. Therefore, we were unable to verify this information. the accuracy of key data elements we used in completing our analysis. Further, we noted one instance where the program billing application showed a provider was certified for outpatient drug‑free services, even though Health Care Services’ source documents indicated it had yet to issue final approval for the certification. Due to the errors we identified in our accuracy testing, we did not proceed with performing completeness testing. Health Care Services To identify program • We performed data‑set verification procedures and electronic Undetermined beneficiaries’ Social testing of key data elements and did not identify any reliability for the Fiscal Intermediary Access Security numbers. significant issues. purpose of this audit. to Medi‑Cal Eligibility system (beneficiary • We did not perform accuracy and completeness testing eligibility system) of the beneficiary eligibility system’s data because the source documents required for this testing are stored Eligibility data for at various locations throughout the State, making such beneficiaries enrolled in testing cost‑prohibitive. the Medi‑Cal Program from July 1, 2008 through December 31, 2013 continued on next page . . . 18 California State Auditor Report 2013-119 August 2014 INFORMATION SYSTEM PURPOSE METHOD AND RESULT CONCLUSION To identify program • We performed data‑set verification procedures and did Not sufficiently beneficiaries’ residential not identify any errors. However, we performed electronic reliable for the addresses. testing of key data elements and found that 60 percent of purpose of this audit. residence addresses were blank. Although this field was Nevertheless, we blank for a significant number of records, which limited our present these data, analysis, Health Care Services does not require this field to as they represent be populated for its business purposes if the beneficiary’s the best available address is unknown. data source of this information. • We did not perform accuracy and completeness testing of the beneficiary eligibility database’s data because the source documents required for this testing are stored at various locations throughout the State, making such testing cost‑prohibitive. Health Care Services To determine the county in • We performed data‑set verification procedures and electronic Not sufficiently and ADP which each provider rendered testing of key data elements and did not identify any reliable for the services. significant issues. purpose of this audit. Master Provider File Nevertheless, we • We conducted accuracy testing for a sample of 30 outpatient Data related to present these data, as drug‑free services provider certifications that occurred during Medi‑Cal providers they represent the period from July 1, 2008 through December 31, 2013. Health the best available Care Services could not locate five of the 30 files we selected data source of for testing. Therefore, we were unable to verify the accuracy this information. of key data elements we used in completing our analysis. Due to the missing files identified in our accuracy testing, we did not proceed with performing completeness testing. Health Care Services To identify outpatient drug‑free • We performed data‑set verification procedures and electronic Undetermined services provider suspensions as testing of key data elements and did not identify any reliability for the Provider suspension of April 2014. significant issues. purpose of this audit. spreadsheet • We did not perform accuracy and completeness testing Suspension records for because we received portions of the data after the end outpatient drug‑free of fieldwork. services providers between July 2012 and April 2014 U.S. Social Security To determine the death dates • We performed data‑set verification procedures and electronic Undetermined Administration recorded for Social Security testing of key data elements and found no errors. reliability for the (Social Security) numbers associated with purpose of this audit. • Social Security does not guarantee the accuracy of the program beneficiaries. Death Master File Death Master File; however, we did not perform accuracy and completeness testing of its data because the source Death records reported documents that support this data are maintained by the to Social Security as of U.S. Government, and our access statute does not compel March 1, 2014. the U.S. Government to provide us records. Sources: California State Auditor’s analysis of various documents and interviews and analysis of data obtained from the entities listed in this table. California State Auditor Report 2013-119 19 August 2014 Chapter 1 THE STATE AND COUNTIES APPROVED MILLIONS OF DOLLARS IN QUESTIONABLE OUTPATIENT DRUG‑FREE TREATMENT SERVICES Between July 1, 2008, and December 31, 2013, the State approved nearly $1 million to Drug Medi‑Cal Treatment Program (program) providers for potentially unauthorized outpatient drug‑free treatment services (outpatient drug‑free services) because the California Department of Health Care Services (Health Care Services) and the California Department of Alcohol and Drug Programs (ADP) lacked adequate processes to identify ineligible providers and deceased beneficiaries when they approved these claims for payment. Although Health Care Services and ADP should have had access to the information necessary for preventing or recovering these payments, they did not always update their databases and use the available information in a timely manner. Further, Health Care Services failed to recover payments for services that providers purportedly rendered to deceased beneficiaries even after receiving notification of the beneficiaries’ deaths. In addition, we analyzed four years of statewide program claims billing data and identified $93.7 million in payments Health Care Services and ADP authorized for more than 2.6 million outpatient drug‑free services that are potentially indicative of fraudulent activity. We identified these payments by searching the program claims billing data for services that met the criteria for five high‑risk indicators of potential fraud, such as services rendered on holidays or to multiple beneficiaries residing at the same address. Although we could not review all of these identified payments to verify their validity, we examined a total of 338 services in three counties: Fresno County, Los Angeles County, and Sacramento County. We found that 10 of the 16 outpatient drug‑free services providers we visited could not locate the patient records or provide adequate documentation to support 74 of these 338 services. Further, we found that seven of the 10 providers lacked support for an additional 1,784 services. In total, the State paid roughly $60,000 for 1,858 services that the providers could not adequately support. Health Care Services and ADP Did Not Have Adequate Controls to Identify Payments to Ineligible Providers and Services Rendered to Deceased Beneficiaries Because of deficiencies in their processes for identifying ineligible providers and deceased beneficiaries, Health Care Services and ADP approved nearly $1 million in potentially improper payments to providers for outpatient drug‑free services. For example, ADP approved payments to a provider that had voluntarily surrendered its program certification because ADP failed to complete timely updates 20 California State Auditor Report 2013-119 August 2014 to the data it relied upon for verifying provider eligibility during the claims adjudication process. Health Care Services believes the majority of these improper payments have been recovered through a subsequent cost‑settlement process. In addition, because Health Care Services failed to promptly update the beneficiary eligibility system with death information, Health Care Services and ADP inappropriately approved payments for services that providers rendered to beneficiaries using Social Security numbers belonging to deceased individuals. Further, after receiving notifications of beneficiaries’ deaths, Health Care Services and ADP failed to initiate recovery efforts for inappropriate payments they had made. Health Care Services and ADP Approved Payments to Ineligible Providers Health Care Services and ADP approved program payments for providers that did not appear to be certified at the time they rendered the services. As Figure 1 on page 11 shows, a provider must become Between July 1, 2008, and certified to receive program reimbursement. However, using Health December 31, 2013, Health Care Care Services’ and ADP’s program claims billing data, we determined Services and ADP authorized that between July 1, 2008, and December 31, 2013, Health Care payments totaling nearly $943,000 Services and ADP authorized payments totaling nearly $943,000 to 22 provider sites, even though to 22 provider sites, even though the data showed that the program the data showed that the program certifications were not active on the dates on which the providers certifications were not active at the rendered the services.5 As shown in Table 5, the majority of these time services were rendered. services were rendered prior to July 2012, which means that ADP was primarily responsible for the inappropriate payments made to the ineligible providers we identified. Health Care Services was able to demonstrate that some of the payments shown in Table 5 were appropriate. For example, we identified approved payments totaling nearly $64,000 for 1,877 services a provider rendered from April 2012 through March 2013, even though Health Care Services’ provider eligibility database showed that this provider site was decertified effective April 2012. When we brought these payments to Health Care Services’ attention, it provided a copy of the temporary suspension letter it issued to the provider indicating a certification suspension date of April 2013. After conducting further research, Health Care Services explained that its staff erroneously entered a decertification date of April 2012 into the provider eligibility database it relies upon during the claims adjudication process for verifying provider eligibility. Because the decertification 5 Effective January 2010 ADP implemented the program’s current billing application. Our analysis did not include claims that ADP processed through its previous tracking and payments system. Therefore, for the period from July 1, 2008 through December 31, 2009, our analysis of services related to ineligible providers and beneficiaries that were purportedly deceased only included those services processed by Health Care Services and ADP on or after January 1, 2010. California State Auditor Report 2013-119 21 August 2014 date was incorrect, it appeared that Health Care Services and ADP inappropriately approved the services for payment when that was not actually the case. According to Health Care Services, it typically has one employee enter certification information into the provider eligibility database and another employee review each data entry for accuracy. However, it was unable to explain why this error was not identified during its review process. Because the provider was actually certified until April 2013, it was eligible to receive payment for the services questioned and thus Health Care Services does not need to initiate efforts to recover these payments. As a result of our audit, Health Care Services corrected its provider eligibility database to accurately reflect the provider’s decertification date of April 2013. Table 5 Number and Amount of Payments the State Approved for Potentially Ineligible Providers by County for Services Rendered July 1, 2008 Through December 31, 2013 NUMBER OF INELIGIBLE NUMBER OF NUMBER OF AMOUNT OF COUNTY PROVIDER SITES BENEFICIARIES SERVICES APPROVED PAYMENTS Services Rendered Prior to July 2012* Alameda 1 1 1 $67 Imperial 1 48 620 18,914 Kern 2 12 63 1,858 Lake 1 222 5,371 224,751 Los Angeles† 10 559 19,554 601,234 Mendocino 1 6 23 841 Riverside 2 92 1,501 47,216 Sacramento 1 16 109 4,465 San Bernardino 1 1 1 28 Santa Clara 1 30 203 6,236 Solano 1 19 147 4,489 Subtotals 22 1,006 27,593 $910,099 Services Rendered July 2012 or Later Los Angeles† 1 50 888 $32,788 Totals for All Services‡ 23 1,056 28,481 $942,887§ Sources: California State Auditor’s analysis of the California Department of Health Care Services’ (Health Care Services) and the California Department of Alcohol and Drug Programs’ (ADP) Short‑Doyle Medi‑Cal ADP Remediation Technology system and Master Provider File. * ADP administered the Drug Medi‑Cal Treatment Program (program) prior to July 2012. As of July 1, 2012, Health Care Services became responsible for administering the program. † These amounts include 1,877 services totaling nearly $64,000 in approved payments to one provider during a period when it appeared to be decertified. At our request, Health Care Services researched this issue and discovered it had erroneously entered the provider’s decertification date as April 2012 rather than April 2013. Therefore, these payments were appropriately authorized for payment. ‡ One provider and a related 28 beneficiaries were included in the data for Los Angeles County’s services rendered before July 2012 and in the data for services rendered July 2012 or later; thus, they are duplicated in the totals. § Health Care Services believes the majority of these improper payments have been recovered through a subsequent cost‑settlement process. However, because it did not provide the supporting documentation for the cost settlement until after the conclusion of our fieldwork, we were not able to complete the audit procedures needed to verify Health Care Services’ assertion. 22 California State Auditor Report 2013-119 August 2014 In contrast, Health Care Services acknowledged that other payments we identified in Table 5 were inappropriate. According to Health Care Services, many of these inappropriate payments occurred because ADP experienced a delay of one year or more in updating the provider eligibility database with the providers’ decertification dates. This created a situation where providers could continue submitting claims for services that were rendered after their decertification dates and receive approval for payment. For example, ADP approved more than $265,000 ADP approved more than $265,000 in claims for 9,043 services in claims for 9,043 services a a provider rendered between December 2009 and June 2010, provider rendered between even though the provider site was decertified in October 2009. December 2009 and June 2010, even The provider’s corporate office notified ADP in March 2010 that though the provider was decertified it was voluntarily surrendering its certification for this particular in October 2009. site effective October 2009. However, ADP did not process the decertification until June 2011, a delay that Health Care Services was unable to explain. Consequently, the provider continued to submit claims that ADP approved for payment through June 2010—eight months after the provider surrendered its certification. After researching the payments included in Table 5 for 13 of 22 provider sites, Health Care Services indicated that it believes the majority of the inappropriate payments it reviewed have already been recovered through the routine cost‑settlement process that occurs each fiscal year with direct providers and counties. However, because Health Care Services did not provide the supporting documentation from ADP’s cost‑settlement process for these providers until after the conclusion of our fieldwork, we were unable to complete the extensive procedures that would be required to verify Health Care Services’ assertion. However, as we describe below, even though the cost‑settlement process is performed each year to ensure that the State does not overpay direct providers and counties, Health Care Services still found some inappropriate payments that it needs to recover; consequently, we do not have assurance that this process is sufficient for identifying and recovering inappropriate payments. Specifically, in performing further research for our audit, Health Care Services reviewed applicable cost‑settlement reports that ADP had completed for 13 providers and concluded that ADP inappropriately approved other payments that are not included in Table 5. For example, Health Care Services found that ADP had inappropriately reimbursed Los Angeles County for an additional 1,322 services rendered in November 2009 by the provider we discussed earlier that was decertified in October 2009. These services were processed through ADP’s previous tracking and payments system, which we did not analyze for purposes of this audit, and according to Health Care Services, they represent an additional $39,000 of inappropriate payments. Because Los Angeles County contracted with this provider to provide these outpatient drug‑free services, Health Care Services indicated that it will California State Auditor Report 2013-119 23 August 2014 In contrast, Health Care Services acknowledged that other payments invoice Los Angeles County to recover the inappropriate payments we identified in Table 5 were inappropriate. According to Health it detected as the result of our audit. Health Care Services also Care Services, many of these inappropriate payments occurred explained that Los Angeles County will need to decide whether because ADP experienced a delay of one year or more in updating it will attempt to recover these inappropriate payments from the the provider eligibility database with the providers’ decertification provider. Ultimately, in total, as of July 2014, Health Care Services dates. This created a situation where providers could continue acknowledged that it intends to recover more than $150,000 in submitting claims for services that were rendered after their inappropriate payments for the 13 providers it researched. decertification dates and receive approval for payment. For example, ADP approved more than $265,000 ADP approved more than $265,000 in claims for 9,043 services These examples highlight deficiencies in Health Care Services’ in claims for 9,043 services a a provider rendered between December 2009 and June 2010, and ADP’s processes for ensuring prompt recovery of payments provider rendered between even though the provider site was decertified in October 2009. to ineligible providers. Specifically, neither department had December 2009 and June 2010, even The provider’s corporate office notified ADP in March 2010 that adequate processes in place to identify whether it had approved though the provider was decertified it was voluntarily surrendering its certification for this particular payments for a provider between the effective date of the in October 2009. site effective October 2009. However, ADP did not process the provider’s decertification and the date when it became aware of decertification until June 2011, a delay that Health Care Services was the decertification. By not having a routine process for identifying unable to explain. Consequently, the provider continued to submit these types of payments, Health Care Services places itself and the claims that ADP approved for payment through June 2010—eight counties at risk of not being able to recover payments that they months after the provider surrendered its certification. previously made to decertified providers. After researching the payments included in Table 5 for 13 of 22 provider sites, Health Care Services indicated that it believes the Health Care Services and ADP Reimbursed Providers for Services They majority of the inappropriate payments it reviewed have already been Purportedly Rendered to Deceased Beneficiaries recovered through the routine cost‑settlement process that occurs each fiscal year with direct providers and counties. However, because Using the U.S. Social Security Administration’s (Social Security) Health Care Services did not provide the supporting documentation Death Master File, we determined that Health Care Services from ADP’s cost‑settlement process for these providers until after and ADP approved reimbursement to 16 provider sites for the conclusion of our fieldwork, we were unable to complete the 19 beneficiaries that were deceased at the time the services extensive procedures that would be required to verify Health Care purportedly occurred. As shown in Table 6, our analysis of Health Services’ assertion. However, as we describe below, even though Care Services’ and ADP’s program claims billing data suggests the cost‑settlement process is performed each year to ensure that the that they authorized payments totaling more than $10,300 for State does not overpay direct providers and counties, Health Care 323 services related to these purportedly deceased beneficiaries. Services still found some inappropriate payments that it needs to recover; consequently, we do not have assurance that this process is sufficient for identifying and recovering inappropriate payments. Table 6 Number and Amount of Payments the State Approved for Purportedly Specifically, in performing further research for our audit, Health Deceased Beneficiaries by County for Services Rendered Care Services reviewed applicable cost‑settlement reports that July 1, 2008 Through December 31, 2013 ADP had completed for 13 providers and concluded that ADP inappropriately approved other payments that are not included in NUMBER OF PURPORTEDLY AMOUNT OF Table 5. For example, Health Care Services found that ADP had NUMBER OF DECEASED NUMBER OF APPROVED inappropriately reimbursed Los Angeles County for an additional COUNTY PROVIDER SITES BENEFICIARIES SERVICES PAYMENTS Los Angeles 15 18 318 $10,180 1,322 services rendered in November 2009 by the provider we discussed earlier that was decertified in October 2009. These Mariposa 1 1 5 141 services were processed through ADP’s previous tracking and Totals 16 19 323 $10,321 payments system, which we did not analyze for purposes of this audit, and according to Health Care Services, they represent an Sources: California State Auditor’s analysis of the U.S. Social Security Administration’s Death Master File, the California Department of Health Care Services’ (Health Care Services) additional $39,000 of inappropriate payments. Because Los Angeles Fiscal Intermediary Access to Medi‑Cal Eligibility system, and Health Care Services’ and the County contracted with this provider to provide these outpatient California Department of Alcohol and Drug Programs’ Short‑Doyle Medi‑Cal ADP Remediation Technology system and Master Provider File. drug‑free services, Health Care Services indicated that it will 24 California State Auditor Report 2013-119 August 2014 State regulations prohibit Health Care Services from reimbursing a provider for outpatient drug‑free services that it did not render or for services that a beneficiary did not receive. According to Health Care Services, it relies on information it receives from several sources, including counties, California vital records, and Social Limitations in Health Care Services’ Security, to determine whether beneficiaries are deceased. However, procedures for promptly updating although Health Care Services claims to use this information to its beneficiary eligibility system with identify deceased beneficiaries, ADP still authorized some of the available death records could have payments included in Table 6 because of limitations in Health Care even greater implications related to Services’ procedures for promptly updating its beneficiary eligibility Health Care Services’ other Medi‑Cal system with available death records. This could have even greater programs that also rely on this implications related to Health Care Services’ other Medi‑Cal system’s data. programs that also rely on this system’s data. For example, 111 of the 323 services presented in Table 6 were purportedly rendered to one beneficiary whom Social Security’s Death Master File shows died in 1980. However, Health Care Services’ data was not updated to reflect that this beneficiary had been deceased for 31 years at the time the provider purportedly rendered and was paid for the services. According to Health Care Services, the beneficiary’s Social Security number—which had been in the beneficiary eligibility system for at least 43 months and was included in Social Security’s data as belonging to a deceased individual—was incorrect. Ultimately, in October 2011, Health Care Services took steps to resolve the discrepancy. However, because it does not always update its beneficiary eligibility system promptly with death records, it will not identify mistakes such as this and may make inappropriate payments for deceased individuals. In addition, Health Care Services failed to recover payments that it approved between some beneficiaries’ death dates and its receipt of their death information. Specifically, 120 of the 323 services in Table 6 correspond to payments totaling more than $3,600 that Health Care Services and ADP authorized for providers who purportedly rendered services up to 61 days after three beneficiaries’ dates of death. According to Health Care Services, it was not aware that these beneficiaries were deceased until up to more than six months after their dates of death, and thus they continued approving payments for the services the providers purportedly rendered to these beneficiaries. However, even after receiving notification that the beneficiaries were deceased, Health Care Services and ADP failed to initiate recovery efforts for the inappropriate payments they had already made. Further, because of deficiencies in the program’s claims adjudication processes, it is unlikely that Health Care Services and ADP would have avoided inappropriately approving payments to these providers even if they had received more timely notification of the beneficiaries’ deaths. According to Health Care Services, California State Auditor Report 2013-119 25 August 2014 prior to November 2013, counties and direct providers could submit claims for services after the beneficiaries’ dates of death and receive approval for reimbursement because Health Care Services and ADP did not verify whether they had received a death record for a beneficiary before approving a claim. However, Health Care Services asserted that effective November 2013, it modified its system to deny payment for any service occurring after the beneficiary’s date of death recorded in its system. Health Care Services acknowledged that it could do more to recover Health Care Services acknowledged payments it makes related to deceased beneficiaries. Specifically, that it could do more to recover Health Care Services stated that it does not have a process in place payments it makes related to to verify whether it previously authorized payments for services deceased beneficiaries. purportedly rendered between the receipt of the death record and the beneficiary’s actual date of death, which was a period of up to more than six months for the three beneficiaries described earlier. Health Care Services asserted that it is currently in the process of evaluating new procedures to address this issue, thus allowing for a more timely recovery of inappropriate payments. It also indicated that it intends to pursue recovering the payments it inappropriately made related to these three deceased beneficiaries. However, unless it routinely detects inappropriate payments for deceased beneficiaries shortly after authorizing them, Health Care Services places itself and the counties at risk of not being able to recover payments from providers that have closed their businesses. Until Health Care Services develops robust procedures for promptly updating all records in its beneficiary eligibility system with available death information and ensuring that no inappropriate payments have already occurred, it risks reimbursing providers for services they did not render. This issue has implications that extend beyond the program because both departments used the beneficiary eligibility system to verify beneficiary eligibility for all of Health Care Services’ Medi‑Cal programs. Health Care Services and ADP Authorized Millions of Dollars in Payments for Services That Are Potentially Indicative of Fraudulent Activity Using program claims billing data for services provided from January 1, 2010 through December 31, 2013, we identified $93.7 million in payments Health Care Services and ADP authorized for more than 2.6 million outpatient drug‑free services 26 California State Auditor Report 2013-119 August 2014 that are potentially indicative of fraudulent activity.6 We identified these payments by searching the program claims billing data for services that met the criteria for any of the five high‑risk indicators. To develop the five high‑risk indicators for identifying potentially fraudulent claims, we relied Five High-Risk Indicators of Potentially on our professional judgment and our knowledge Fraudulent Services of known cases of fraudulent activity, interviews 1. Services rendered to multiple beneficiaries residing with Health Care Services, and background at the same address. information for the audit—including the media reports we detailed in the Introduction. Using 2. Services approved for payment at unauthorized rates. these five indicators, which we describe in the text box, we analyzed Health Care Services’ and 3. Services rendered on holidays. ADP’s program claims billing data to identify 4. Excessive individual counseling services rendered to services that we believe are symptomatic of fraud. a specific beneficiary. Tables A.1 through A.5 beginning on page 64 in Appendix A present the results of our statewide 5. Services rendered by providers billing more than five days in a week. data analysis for each of the five indicators by county and include the number of provider sites, Sources: California State Auditor’s professional judgment and the number of services we identified, and the total our knowledge of known cases of fraudulent activity, interviews with the California Department of Health Care Services, and payments approved for these services. background information for the audit. The Joint Legislative Audit Committee requested that we perform testing in Los Angeles County and two other counties of the California State Auditor’s choosing to identify the extent of fraudulent activity related to outpatient drug‑free treatment centers funded through the program. Using the preliminary results of our statewide analysis, we selected the counties of Fresno and Sacramento for additional testing because we assessed them to be at high risk for potentially fraudulent activity. Prior to selecting transactions for further testing at the counties of Fresno, Los Angeles, and Sacramento, we excluded services associated with suspended and terminated provider sites.7 For example, we identified 201 provider sites that billed more than five days in a week in Los Angeles County representing nearly $66 million in services. Health Care Services had already suspended or terminated 153 of these provider sites. As shown in Table 7 on page 28, the remaining 48 provider sites account for more than 6 Health Care Services’ current billing system, which ADP implemented on January 1, 2010, contains all services processed after the system’s implementation. However, some of these services were rendered prior to January 2010. Therefore, to ensure that we selected transactions for testing from a complete population of services rendered each year, we limited our analysis to services rendered between January 2010 and December 2013. 7 There are circumstances, referred to as good cause exceptions, where Health Care Services may determine not to suspend payments to a provider despite a pending investigation of a credible allegation of fraud. For example, law enforcement officials may specifically request that a suspension not be imposed because it may compromise an existing investigation. California State Auditor Report 2013-119 27 August 2014 $7 million in services for this high‑risk indicator in Los Angeles County. In total, using all five high‑risk indicators, we identified nearly $84 million in services for the three counties. Although Health Care Services had already suspended or terminated provider sites associated with nearly $71 million, the remaining provider sites account for more than $13 million. Table 7 details the number of provider sites, the number of services, and the amount of approved payments that we identified as potentially indicative of fraudulent activity in our analysis of the counties of Los Angeles, Sacramento, and Fresno, excluding provider sites that Health Care Services suspended or terminated as of April 2014. Removing services rendered at suspended and terminated provider sites significantly reduced the population of outpatient drug‑free services from which we made our selections for further testing. The fact that our five high‑risk However, the fact that our five high‑risk indicators yielded so many indicators yielded so many services services that were rendered by suspended and terminated providers that were rendered by suspended validates our selection of these indicators for identifying potentially and terminated providers validates fraudulent activity because it demonstrates that these are known our selection of these indicators billing practices used by providers that Health Care Services has for identifying potentially ultimately suspended or terminated. According to the deputy fraudulent activity. director of its Audits and Investigations Division (investigations division), Health Care Services contracted for data analysis services in September 2013 and he believes it can now perform similar analyses. Finally, because Government Auditing Standards issued by the U.S. Government Accountability Office require us to avoid interfering with any ongoing investigations, we contacted the California Office of the Attorney General’s Bureau of Medi‑Cal Fraud and Elder Abuse (fraud bureau) to ensure that we did not jeopardize any of its ongoing investigations. Therefore, prior to conducting our testing at the counties of Los Angeles, Sacramento, and Fresno, we verified that the provider sites we selected for testing were not under investigation by the fraud bureau. 28 California State Auditor Report 2013-119 August 2014 7 elbaT dna dednepsuS gnidulcxE ,seitnuoC eerhT ni rotacidnI ksiR-hgiH yb devorppA etatS eht stnemyaP fo tnuomA dna secivreS dna setiS redivorP fo rebmuN setiS redivorP detanimreT 3102 ,13 rebmeceD hguorhT 0102 ,1 yraunaJ YTNUOC ONSERF YTNUOC OTNEMARCAS YTNUOC SELEGNA SOL FO TNUOMA FO TNUOMA FO TNUOMA DEVORPPA FO REBMUN FO REBMUN DEVORPPA FO REBMUN FO REBMUN DEVORPPA FO REBMUN FO REBMUN STNEMYAP SECIVRES SETIS REDIVORP STNEMYAP SECIVRES SETIS REDIVORP STNEMYAP SECIVRES SETIS REDIVORP ROTACIDNI KSIR-HGIH seiraicfieneb elpitlum ot deredner secivreS 826,465$ 618,71 24 961,491$ 949,4 31 274,555,1$ 855,74 05 sserdda emas eht ta gnidiser ta tnemyap rof devorppa secivreS 0 0 0 0 0 0 178,82 89 1 setar dezirohtuanu 337,4 221 7 488,01 692 3 729,12 526 13 syadiloh no deredner secivreS deredner secivres gnilesnuoc laudividni evissecxE 341,796 749,9 84 132,046,1 123,42 14 196,225,2 799,53 77 yraicfieneb cfiiceps a ot naht erom gnillib sredivorp yb deredner secivreS 225,285 877,61 41 917,234 577,11 9 456,020,7 236,802 84 keew a ni syad evfi 620,948,1$ 366,44 111 300,872,2$ 143,14 66 516,941,11$ 019,292 702 *slatoT ,snitellub )PDA( ’smargorP gurD dna lohoclA fo tnemtrapeD ainrofilaC eht dna )secivreS eraC htlaeH( ’secivreS eraC htlaeH fo tnemtrapeD ainrofilaC eht fo sisylana s’rotiduA etatS ainrofilaC :secruoS .metsys ytilibigilE laC‑ideM ot sseccA yraidemretnI lacsiF ’secivreS eraC htlaeH dna ,eliF redivorP retsaM ,metsys ygolonhceT noitaidemeR PDA laC‑ideM elyoD‑trohS .4102 lirpA fo sa secivreS eraC htlaeH yb detanimret ro dednepsus setis redivorp dedulcxe eW :setoN .seitnuoc eht htiw yltcerid detcartnoc taht sredivorp sa llew sa ,PDA dna secivreS eraC htlaeH htiw yltcerid detcartnoc taht sredivorp sedulcni sisylana ruO ’secivreS eraC htlaeH fo weiver launam a eriuqer dluow tnemyap rof elbigile erew secivres rehtehw gnitaitnatsbuS .tnemyap rof elbigileni erew secivres eseht rehtehw etacidni ton od enola atad ehT .etatS eht tuohguorht snoitacol suoirav ta derots era hcihw ,sdrocer ’sredivorp tnemtaert eerf‑gurd tneitaptuo dna ,sdrocer s’PDA ,sdrocer roF .rotacidni eno naht erom rof airetirc eht tem ecivres a taht elbissop si ti esuaceb txet eht ni dedulcni noillim 31$ eht naht retaerg era stnuoma tnemyap devorppa eseht fo mus ehT * erom ni dedulcni eb yam stnuoma tnemyap devorppa dna ,secivres ,setis redivorp ,yltneuqesnoC .yadiloh a no llib osla ot ylekil si keew a ni syad evfi naht erom sllib taht redivorp a ,elpmaxe .rotacidni ksir‑hgih eno naht California State Auditor Report 2013-119 29 August 2014 Many Providers Could Not Substantiate Their Claims for Outpatient Drug-Free Services Documentation That Drug Medi-Cal Treatment Program Providers Must Maintain to Receive Reimbursement To determine whether providers could substantiate the questionable claims we had identified, we Providers must establish, maintain, and update individual selected 20 transactions for Los Angeles County patient records for each beneficiary that contain and 16 for each of the remaining two counties.8 the following: In some instances, a transaction can consist of • Identifying information of the beneficiary, such as multiple services that collectively indicate potentially the beneficiary’s name, date of birth, gender, ethnic fraudulent activity. In total, the 52 transactions we background, and contact information. selected represent 338 services. • Intake and admission data that include the beneficiary’s personal, medical, and substance abuse Our review found that outpatient drug‑free services history upon admission to treatment. providers in Los Angeles County and Fresno County could not locate all of the patient records we selected • Assessment of the physical condition of the for testing. In addition, the patient records for all beneficiary within 30 calendar days of the date he three of the counties we visited did not always or she was admitted to treatment. If the assessment include the documentation that state regulations does not include a physical examination, the physician must complete a waiver, which specifies require, as shown in the text box. the basis for not requiring it. • A treatment plan based upon the information the Four of the Providers We Visited Could Not Locate provider obtained in the intake and assessment Patient Records process. The treatment plan must include a statement of the beneficiary’s problems, goals to address the problems, action steps that the Two of the providers we visited in Los Angeles provider will take to accomplish the goals, target County could not locate all of the patient records we dates for accomplishing the steps and goals, a selected for testing. Specifically, the providers could description of the services, and the assignment of a not locate two of the 38 patient records associated primary counselor. with the 20 transactions we selected for testing. The • Progress notes, which are narrative summaries chief executive officer of one of the two providers that describe the beneficiary’s progress, problems, stated that she and her staff looked for the patient goals, action steps, objectives, or referrals. The record but were unable to find it at the time of our progress notes must also include information review. The patient purportedly received $1,203 worth on the beneficiary’s attendance, including the of services from this provider from May 4, 2011 date and duration in minutes of individual or through December 22, 2011. The program director group‑counseling sessions. of the other provider stated that it did not have the • Other information relating to the treatment patient record we requested because the individual services rendered to the beneficiary, including was never a client. However, Health Care Services continuing services justifications, laboratory test and ADP approved $10,094 for services the provider orders and results, referrals, counseling notes, and purportedly rendered to that individual from discharge summaries. December 28, 2011 through December 28, 2013. Providers must also maintain group‑counseling sign‑in sheets that indicate the names of attendees, the date, and In June 2010 and December 2011, ADP performed the duration of the session. post‑service post‑payment utilization reviews (utilization reviews) for these providers as federal Source: California Code of Regulations, Title 22, sections 51341.1 (g) and (h). This regulation was amended on June 30, 2014. The requirements above, however, applied during our audit period of July 1, 2008 through December 31, 2013. 8 Please refer to Audit Objective 4 in Table 3 on page 15 for the methodology we used to select the transactions. 30 California State Auditor Report 2013-119 August 2014 and state regulations require. The purpose of utilization reviews is to verify that the providers maintain documentation in their individual patient records that meets the requirements in state regulations, that each beneficiary meets the admissions criteria, that a treatment plan exists for each beneficiary, and that the provider rendered services claimed for reimbursement in Although ADP noted deficiencies accordance with state regulations. Although ADP noted deficiencies for these two Los Angeles County for these providers in its utilization reviews, the deficiencies did providers in its utilization reviews, not include missing patient records. In addition, Los Angeles the deficiencies did not include County’s Department of Public Health conducted site visits at missing patient records. these providers during our audit period of July 1, 2008 through December 31, 2013. The county also did not note any deficiencies related to missing patient records. Consequently, ADP and the county did not take any corrective action against these providers for this type of deficiency. Similarly, providers in Fresno County could not locate two of the 27 patient records associated with the 16 transactions we selected for testing. Specifically, one provider was missing records for a patient who purportedly received services on July 28, 2011, that totaled about $70. The provider’s program director stated the individual’s intake assessment and discharge occurred on the same day and this individual never attended group‑counseling sessions. Nevertheless, we would still expect the provider to have a record of the individual’s intake assessment and discharge summary. In addition, the other provider was missing records for a patient who purportedly received services on July 4, 2010, and July 5, 2010, that totaled $135. The president of the provider’s board of directors agreed the patient’s records were missing but did not provide us with an explanation as to why. Health Care Services and ADP performed utilization reviews for these providers in April 2010 and September 2012 and did not identify any deficiencies related to missing patient records. Fresno County’s Department of Behavioral Health also conducted site visits at these providers during our audit period of July 1, 2008 through December 31, 2013. The county’s random selection of patient records did not identify any deficiencies related to missing patient records. Therefore, the departments and the county did not take any corrective action against these providers for this type of deficiency. Health Care Services contracts with the counties to provide program services and requires them to retain patient records for a minimum of three years from the date of the last face‑to‑face contact with the patient or until the final resolution of any federal or state audit issue. The counties’ contracts with their providers generally require the providers to retain patient records for a minimum of five years following the expiration, termination, or final California State Auditor Report 2013-119 31 August 2014 payment of the contract, or until the resolution of any applicable federal, state, and county audit findings, whichever is later. State regulations prohibit providers from receiving reimbursement for program services they did not render and the beneficiary did not receive. When providers cannot produce patient records, they cannot demonstrate that they rendered services. Thus, the State and counties can recover the reimbursements they paid to these providers because the providers cannot produce patient records to support their claims. The Providers We Visited Were Often Missing Critical Documentation From Their Patient Records Many of the providers that we visited in the three counties failed to maintain adequate documentation within their patient records to justify their reimbursement claims. Specifically, four providers lacked adequate documentation for 10 of the 20 transactions we tested in Los Angeles County. In total, we identified $3,018 in deficiencies for these providers. One provider was missing progress notes for services it purportedly rendered to beneficiaries in March 2012 and May 2012. Similarly, another provider was missing progress notes for a service it purportedly rendered to a beneficiary in January 2012. The third provider was missing a treatment plan and progress notes for services it purportedly rendered to beneficiaries in September 2011. In this instance, we also noted that the services related to the progress notes for one beneficiary were outside of the provider’s days of operation according to its contract with the county. In addition, this provider was missing progress notes for services it purportedly rendered to another beneficiary in May 2011, and neither a counselor nor a physician had signed the treatment plan for services it purportedly rendered to a beneficiary in December 2010 within the required time frame. The last provider was missing documentation for five transactions. Specifically, this provider was missing the sign‑in sheet from a group‑counseling session held on August 30, 2010. When we reviewed the group sign‑in sheets, we found that the beneficiary’s name had been crossed out and replaced with another name. Further, the provider was missing the progress notes for services it purportedly rendered to one beneficiary in June 2011 and September 2011 and for another beneficiary in March 2012. In We are concerned about the addition, this provider charged $90.51 for two services it purportedly deficiencies we identified rendered to beneficiaries on holidays. We reviewed the patient for the provider—that was records and found that the progress notes indicated that the provider missing documentation for held no sessions on those billing dates and that the site was closed five transactions—particularly because of the holidays. We are concerned about the deficiencies we because Health Care Services and identified for this provider, particularly because Health Care Services ADP approved $761,000 for it and ADP approved $761,000 for it between 2010 and 2013. between 2010 and 2013. 32 California State Auditor Report 2013-119 August 2014 Los Angeles County’s Department of Public Health identified similar deficiencies during its site visits at these providers. For example, as mentioned previously, we found that a counselor and physician had not signed one of the provider’s treatment plans for services within the required time frame. During its site visit at this provider in December 2009, the county found that a supervisor had not signed a treatment plan to verify his or her review. During its March 2011 site visit, the county determined that the provider had corrected this finding. The county’s head contract program auditor stated it is currently implementing an electronic monitoring system that will incorporate the county’s recently developed and adopted Risk Assessment Tool and Evaluation (RATE) system. He explained that the RATE system will automatically track serious deficiencies and chronic findings, assign points to the deficiencies and findings, and produce a score that will result in appropriate and automatic county responses. For example, if the RATE system produces a score between 80 and 89, the county will suspend a provider’s contract. Of the 16 transactions we tested Of the 16 transactions we tested at Fresno County, four providers at Fresno County, four providers lacked adequate documentation for seven of them. In total, we lacked adequate documentation for identified roughly $43,000 in deficiencies for these providers. seven of them. One provider was missing a treatment plan and progress notes for services it purportedly rendered to beneficiaries in December 2012. Another provider was missing a sign‑in sheet for a service it purportedly rendered to a beneficiary in November 2010. The third provider had missing or incomplete medical waivers and a missing treatment plan for services it purportedly rendered to beneficiaries in November 2010 and October 2013, and its progress notes for services did not indicate the duration of the counseling sessions. In addition, this provider claimed reimbursement for services it purportedly rendered to a beneficiary in June 2013 before her admission date of December 5, 2013. The last provider was missing documentation for three transactions. Specifically, this provider was missing the sign‑in sheets for six months of group‑counseling sessions and a treatment plan for services it purportedly rendered to a beneficiary in February 2011. This provider also claimed reimbursement for services it purportedly rendered to one beneficiary before his admission date of January 20, 2012, and to another beneficiary after her discharge date of December 23, 2012. Fresno County’s Department of Behavioral Health identified similar deficiencies during its site visits at these providers. One of the county’s senior staff analysts stated that the county department’s prior staffing levels did not allow it to conduct follow‑up visits to the providers with deficiencies. The senior staff analyst also stated that recently staff have been discussing new site visit procedures that will include revising the report format to highlight recurring deficiencies and conducting follow‑up visits to providers California State Auditor Report 2013-119 33 August 2014 to ensure that they have implemented their corrective action plans. On October 31, 2013, the county issued a bulletin to its providers that, effective November 1, 2013, it would begin to recoup funds from them for noncompliance with applicable regulatory and contractual requirements that it notes during its site visits. Finally, two providers lacked adequate documentation for nine of the 16 transactions for services we tested in Sacramento County. In total, we identified more than $3,600 in deficiencies for these providers. One provider could not support a transaction for multiple services because it was missing a beneficiary’s progress notes and the group counseling sign‑in sheets for sessions it purportedly held on January 5, 2012, and January 6, 2012. The other provider was missing documentation for the remaining eight transactions. Specifically, this provider was missing progress notes for services it purportedly rendered to beneficiaries in October 2011 and January 2013. In addition, this provider was missing the sign‑in sheets from group‑counseling sessions it purportedly held in Two providers lacked adequate May 2011, October 2012, and May 2013. Further, this provider had documentation for nine of the incomplete medical waivers for services it purportedly rendered 16 transactions for services we tested to beneficiaries in March 2010 and October 2010. In another in Sacramento County; one provider instance, this provider claimed reimbursement for services was missing the medical waiver, a purportedly rendered to a beneficiary before her admission date treatment plan, and the progress of February 18, 2011. Finally, this provider was missing the medical notes for services it purportedly waiver, a treatment plan, and the progress notes for services rendered to a beneficiary on it purportedly rendered to a beneficiary on February 5, 2011. February 5, 2011. Health Care Services and ADP approved $1.9 million for this particular provider between 2010 and 2013. Sacramento County’s Department of Health and Human Services identified similar deficiencies during its site visits at these providers. The acting health program manager of Sacramento County’s Alcohol and Drug Services Unit acknowledged that its lack of contract monitoring contributes to the providers’ failure to implement fully their corrective action plans to resolve deficiencies that are brought to their attention. The acting health program manager also stated that the unit did not identify the types of deficiencies we noted because it focused on monitoring state regulations and did not use patient records to match the services rendered by the providers to their reimbursement claims. Further, the acting health program manager stated that the unit plans to immediately strengthen its monitoring practices by putting into place a system for tracking provider deficiencies and by conducting site visits within 30 days of receiving the providers’ corrective action plans to ensure their implementation. Finally, the unit plans to incorporate a review of all providers’ corrective action plans into its mid‑year and annual contract monitoring protocol. 34 California State Auditor Report 2013-119 August 2014 Health Care Services and ADP also identified similar deficiencies during their utilization reviews of some of these providers in Los Angeles, Fresno, and Sacramento counties. When we asked Health Care Services whether it conducts follow‑up visits to ensure that providers appropriately implement their corrective action plans, the supervisor of the department’s post‑service post‑payment unit within its Substance Use Disorder Prevention, Treatment, and Recovery Services Division (PTRS division) stated that the unit does not have the resources necessary to follow up with each provider. The chief of the performance management branch within the PTRS division stated the county monitoring unit began to monitor Health Care Services’ contract with the counties in fiscal year 2012– 13. Until Health Care Services and the counties improve their oversight of providers to ensure that they adhere to established billing practices, retain the appropriate documentation to support their reimbursement claims, and implement fully their corrective action plans for resolving deficiencies, providers will continue to receive reimbursement for services they cannot demonstrate they rendered or that the beneficiaries received. Further, state regulations require Heath Care Services to recover from providers any payments it determines to be either for services not documented in the provider’s records or for services where the provider’s documentation justifies only a lower level of payment. Recommendations To ensure that the providers receive reimbursement for only valid services, Health Care Services should immediately do the following: • Coordinate with the appropriate counties to recover inappropriate payments to ineligible providers and for services purportedly rendered to deceased beneficiaries. • Develop and implement new procedures for routinely identifying and initiating recovery efforts for payments that it authorizes between the effective date of a provider’s decertification and the date it became aware of the decertification, in addition to the payments it authorizes between a beneficiary’s death date and its receipt of the death record. • Direct its investigations division to determine whether it authorized any improper payments to program providers for deceased beneficiaries outside of our audit period. It should also determine whether it authorized such payments through its other Medi‑Cal programs. Health Care Services should initiate efforts to recover such payments as appropriate. California State Auditor Report 2013-119 35 August 2014 • Direct its investigations division to determine whether it should recover any overpayments for the high‑risk payments we identified in Table 7 on page 28 and Appendix A beginning on page 63. It should also take the appropriate disciplinary action against the affected providers, such as suspension or termination. • Direct its investigations division to further enhance its analysis of program claims data to identify the types of high‑risk payments we identified on a monthly basis. • Direct its fiscal management and accountability branch to work with Fresno, Los Angeles, and Sacramento counties to recover the specific overpayments we identified during our visits. • Instruct the counties to remind their providers to adhere to the record retention policies stated in their contracts. • Ensure that each county has a process in place to follow up on their providers’ implementation of corrective action plans aimed at resolving program deficiencies. • Ensure that Fresno County strengthens its provider contract monitoring process, including revising its report format and conducting follow‑up visits to providers. • Ensure that Los Angeles County strengthens its provider contract monitoring process, including fully implementing its RATE system to track and respond to provider deficiencies, and that it imposes appropriate responses when warranted, such as withholding payment or suspending or terminating a contract. • Ensure that Sacramento County strengthens its provider contract monitoring process, including tracking provider deficiencies and conducting follow‑up visits to providers. 36 California State Auditor Report 2013-119 August 2014 Blank page inserted for reproduction purposes only. California State Auditor Report 2013-119 37 August 2014 Chapter 2 THE STATE’S WEAK CERTIFICATION PROCESS MAY HAVE CAUSED IT TO CERTIFY INELIGIBLE OUTPATIENT DRUG‑FREE TREATMENT PROVIDERS Both the California Department of Health Care Services (Health Care Services) and the California Department of Alcohol and Drug Programs (ADP) failed to implement an effective provider certification process for the Drug Medi‑Cal Treatment Program (program).9 Because they did not consistently enforce laws and regulations intended to reduce fraud, the departments increased the risk that they certified ineligible program providers for outpatient drug‑free treatment services (outpatient drug‑free services). For example, neither department consistently required provider applicants to make the necessary fraud disclosures before certifying them, nor did they conduct database searches on many provider applicants. They also failed to assign risk levels to provider applicants, as federal regulations require. In addition, Health Care Services and ADP did not consistently apply their own application review procedures. Consequently, we found serious deficiencies in the certification of 25 of the 30 provider applicants we selected for review—deficiencies that demonstrated the State’s certification process was woefully inadequate. Finally, because both departments failed to establish a process to proactively recertify providers until required to by a 2011 change in federal regulations, it is possible that some program providers may never have been subject to further scrutiny by the State. Health Care Services and ADP Certified Provider Applicants That Did Not Disclose Required Background Information Health Care Services’ and ADP’s failure to require provider applicants to make necessary disclosures may have led to their certification of ineligible providers. Only one of the 30 provider applicants we selected for testing made complete disclosures; nonetheless, Health Care Services or ADP certified all 30. Further, Health Care Services was unable to locate five of the 30 applicant files we selected, suggesting that the departments’ controls over these files were inadequate. Finally, we found that Health Care Services and ADP did not require applicants to sign and submit provider agreements with their applications during our audit period of July 1, 2008 through December 31, 2013. 9 Effective July 1, 2012, state law transferred the program from ADP to Health Care Services. 38 California State Auditor Report 2013-119 August 2014 Federal regulations require Medicaid providers to Disclosure Requirements for the Drug Medi-Cal disclose certain critical information, including their Treatment Program Certification respective entity’s ownership, control, and business transactions.10 Providers must also disclose the The provider applicant must identify any officer, director, identity of specified people affiliated with them who manager, or other individual who exercises operational have been convicted of Medicaid‑related crimes. or managerial control over the day‑to‑day operation of the provider applicant. It must also identify any individual who, We present the required disclosure information in directly or indirectly, has at least a 5 percent ownership the text box. Federal regulations also require interest in the provider applicant. Subsequently, the provider providers to disclose their ownership and control at applicant must perform disclosures, such as the following: various times, such as when they submit their provider applications, execute their provider • Each identified individual must provide his or her agreements, or change ownership, at which point name, address, date of birth, Social Security number, and relation to another identified individual, if the the provider has 35 days to submit the required relation is that of a spouse, parent, child, or sibling. information. State law and regulations mirror these federal disclosure requirements except that they do • The provider applicant must disclose any significant not specifically call for providers to make the business transactions with any supplier whose required disclosures within 35 days after any change total ownership interest was held by the provider in ownership. applicant or any subcontractor during the previous five years. However, when we selected 30 provider • Each identified individual must disclose if he or she applicant files to review the applicants’ has been convicted of a criminal offense related to disclosure information, Health Care Services that person’s involvement in any program under was unable to locate five of the files, even though Medicare, Medicaid, or the Title XX services program since the inception of those programs. ADP’s retention policy required staff to keep program certification files for five years after Sources: The California Department of Health Care Services’ the certification was relinquished, revoked, Medi‑Cal Disclosure Statement and the Code of Federal Regulations, Title 42, sections 455.101, 455.104(b)(1)‑(4), or abandoned. The chief of the department’s 455.105(b)(1) and (2), and 455.106(a)(1) and (2). Licensing and Certification Branch (certification branch) stated that he did not know the exact reason why the five files were missing. However, he noted that before July 2012, the majority of branch staff had access rights to the file room. At that time, in response to the failure of staff to use sign‑out sheets when removing files, the certification branch limited access to only the staff responsible for certification. However, the chief stated that provider files continued to disappear. On June 10, 2013, the certification branch further limited access to the file room to branch supervisors and two office technicians. These five missing files particularly concern us because of the nature of the information the files contain. For example, the program application requires that applicants identify their owners and three key managing employees, namely the clinic director, executive director, and medical director.11 The file also contains the 10 Ownership means a person or corporation that owns, directly or indirectly, at least 5 percent or more of the equity, stock, or profits of the disclosing provider. 11 Managing employees include the general manager, business manager, administrator, director, or other individual who exercises operational or managerial control over, or who directly or indirectly conducts the day‑to‑day operation of the provider applicant. California State Auditor Report 2013-119 39 August 2014 critical disclosure information we described previously. Thus, when Health Care Services loses files, it loses the ability to (1) compare or verify a provider’s current information with information from its prior application and (2) take action against a provider or hold a provider accountable, because the State cannot support its position without the missing information. For example, Health Care Services may not be able to identify a change of ownership—an event that should trigger recertification—if it cannot locate the provider’s original application and the State’s Medi‑Cal Disclosure Statement (disclosure statement) that state statutes and regulations require. Our review of the remaining 25 files found that 24 provider Our review of the remaining 25 files applicants had submitted inadequate disclosure statements. When found that 24 provider applicants we compared the managing employees that provider applicants had submitted inadequate identified in their program applications to the individuals named in disclosure statements—22 provider their disclosure statements, we found that 22 provider applicants applicants did not include all of did not include all of their managing employees on their disclosure their managing employees on their statements. Further, one of the remaining two provider applicant disclosure statements. files had only the first page of its disclosure statement, while the other was missing the disclosure statement completely. The certification branch chief stated that the reason ADP’s certification staff did not ensure that provider applicants made all required disclosures was because they did not receive any training on evaluating the completeness of disclosure statements until the winter of 2013, when Health Care Services’ Provider Enrollment Division (enrollment division) hosted a Webinar on the topic.12 The chief further stated that Health Care Services provided very little, if any, training to certification staff regarding the program certification process in general and that he did not request any training until he became aware of his staff’s lack of understanding of the disclosure statements. He explained that supervisors and staff learned how to conduct program certifications by watching other analysts and supervisors. However, according to the certification branch chief, this style of on‑the‑job training was exacerbated by high turnover rates that limited knowledge transfer and by multiple organizational transfers of the certification staff from one branch to another. Nevertheless, we do not believe the certification staff would need training to identify the types of errors that we found during our review of disclosure statements. We found these errors by merely comparing the application and disclosure statement and by reviewing the disclosure statement for completeness. However, 12 State law requires that whenever a function or the administration of a law is transferred from one state agency to another state agency, all persons serving in the state civil service and engaged in the performance of the function or the administration of law must be transferred to that state agency. 40 California State Auditor Report 2013-119 August 2014 the certification branch chief’s explanation is consistent with the enrollment division chief’s statement that the enrollment division did not have any involvement with the program because Health Care Services was not responsible for administering the program until July 1, 2012. Finally, we found that during our audit period neither Health Care Services nor ADP required applicants to sign and submit provider agreements, as federal and state law require. In executing a provider agreement, a provider agrees to furnish the disclosures we described previously and to take certain steps to mitigate fraud. For example, a provider agrees that it will not commit fraud or engage in unsound fiscal or business practices that result in an unnecessary cost to the Medi‑Cal program, that none of the persons affiliated with the provider committed any of the activities required to be disclosed on the disclosure statement, and that it will not solicit or offer any form of gratuitous consideration when rendering health care services to any Medi‑Cal beneficiary. The chief of Health Care Services’ policy and administrative branch (policy branch) stated that he was unaware of any state law or regulation that excludes program providers from executing provider agreements. The policy branch chief also stated that the enrollment division was in the process of developing a provider agreement for program providers. Because the departments did not require provider applicants to execute provider agreements, it increased the risk of fraud or abuse within the program. Health Care Services’ failure to provide oversight for the program is inconsistent with its administrative responsibilities. For many years, Health Care Services entered into interagency agreements assigning the responsibility to review and certify providers seeking to participate in the program to ADP. According to the State Contracting Manual, one of the responsibilities of contract management is to ensure compliance with all applicable federal or other regulations. Federal regulations state that the consequence for a provider failing to disclose information on its ownership and control and business transactions is that federal financial participation will not be available to the State for payments it Because Health Care Services and made to that provider. Because Health Care Services and ADP ADP did not ensure that all provider did not ensure that all provider applicants made the required applicants made the required disclosures on their disclosure statements, they put federal funding disclosures on their disclosure for the program at risk. Further, they increased the possibility statements, they put federal funding that ineligible providers participated in the program, which in for the program at risk. turn increased the risk for fraud or abuse. The two departments’ decisions not to require applicants to sign provider agreements only exacerbated the potential for problems. California State Auditor Report 2013-119 41 August 2014 Health Care Services and ADP Did Not Consistently Perform Database Searches to Screen Federal and State Databases for Provider Applicants Screening Drug Medi-Cal Treatment Program Provider Applicants Health Care Services and ADP did not consistently conduct database searches intended to ensure the • National Plan and Provider Enumeration System is the Centers for Medicare and Medicaid Services’ system that integrity of the program. Before the State certifies assigns unique identifiers to health care providers and provider applicants, federal regulations require it health plans. States must require all claims for payments for to verify the license status, confirm the identity, items and services furnished under the federal Medicaid and determine whether the exclusion status applies program to contain the National Provider Identifier of the to provider applicants through routine checks of physician or other professionals ordering or rendering such federal databases and other methods, which we items or services. describe in the text box. In addition, the State’s • List of Excluded Individuals and Entities (LEIE) is program application processing procedures maintained by the U.S. Department of Health and Human require Health Care Services and ADP to search Services’ Office of the Inspector General (Inspector the California Secretary of State’s Business General). The Inspector General must exclude from Search database to verify the provider applicant’s participation in federal health care programs individuals business status. and entities convicted of certain criminal offenses, such as Medicare or Medicaid fraud and other health care‑related Our review found that Health Care Services and fraud. In addition, the Inspector General has the discretion ADP did not conduct all of the required database to exclude individuals and entities on a number of searches for 22 of the 25 provider applicant grounds, such as the submission of false or fraudulent files that we reviewed. Frequently, Health Care claims to a federal health care program. Federal regulations require states to check the LEIE at least monthly. Services and ADP did not perform two or more of the required database searches for the provider • BreEZe is the California Department of Consumer Affairs’ applicants. Specifically, the provider files did not (Consumer Affairs) licensing and enforcement system that contain evidence that the departments performed enables individuals to verify the license status of physicians List of Excluded Individuals and Entities (LEIE) licensed by the Medical Board of California, as well as database searches for 14 provider applicants, BreEZe other professionals licensed by the boards and bureaus Consumer Affairs regulates. Federal regulations require license verifications for five provider applicants, states to verify that the provider applicant has a current business status searches for six provider applicants, license and that no current limitations are on the license. and National Plan and Provider Enumeration System searches for four provider applicants. The • U.S. Social Security Administration’s (Social Security) certification branch supervisor who handled those Death Master File contains records of deaths created from program certifications stated that she did not the Social Security’s payment records. Since March 25, 2011, federal regulations require states to review this file for know why analysts had not performed some of screening provider applicants. the searches. She offered different explanations for others, such as the analyst overlooking the need to • Excluded Parties List System (EPLS) is an electronic, perform the searches or performing the searches but web‑based system that identifies those parties excluded misplacing the documentation. from receiving federal contracts, certain subcontracts, and certain types of federal financial and nonfinancial assistance and benefits. As of November 21, 2012, the EPLS Finally, ADP and Health Care Services certified 15 of is now part of the System for Awards Management. Since our selected providers after March 25, 2011, which is March 25, 2011, federal regulations require states to review the effective date for the State to begin performing this system at least monthly. searches of the U.S. Social Security Administration’s (Social Security) Death Master File and the Excluded Sources: Code of Federal Regulations, Title 42, sections 455.412, 455.436, and 455.40; and information taken from the Web page Parties List System (EPLS). However, our review of each system. of the files for these provider applicants found no evidence that either department performed 42 California State Auditor Report 2013-119 August 2014 these searches. The certification branch chief stated that Health Care Services does not perform these searches because they are not part of the State’s review process. Health Care Services has since updated its procedures to include the EPLS database search but not the Social Security Death Master File database search, even though it is required by federal regulations. The policy branch chief stated that the enrollment division is in the process of establishing periodic checks of provider applicants against the Death Master File. Nevertheless, since March 25, 2011, federal regulations have required monthly searches of both the LEIE and the EPLS. Health Care Services and ADP did not conduct either of these monthly database searches before July 2013. The enrollment division took over program recertifications in July 2013 and initial certifications in January 2014. However, the policy branch chief stated that the enrollment division did not conduct monthly checks against the EPLS database because it just completed system changes to the provider master file to capture the names of the individuals and entities associated with the provider applicants. The policy branch chief stated that, going forward, the enrollment division will conduct this search as it certifies provider applicants. However, this does not conform to federal regulations that require EPLS searches to occur at least monthly. Furthermore, the enrollment division is conducting monthly LEIE database searches for only the provider applicants whose applications it has reviewed beginning in July 2013. We performed the searches on the 25 provider applicants we reviewed and found that the medical director for one provider applicant surrendered his physician and surgeon license effective In December 2010 the medical January 16, 2013. In December 2010 the Medical Board of California board filed a formal accusation (medical board) filed a formal accusation against this physician for a against a physician for a number of number of reasons, such as clearly excessive prescribing, furnishing, reasons, yet, on May 25, 2011, ADP dispensing, or administering of drugs related to his care and certified the physician to serve as the treatment of patients. According to the medical board’s Web site, if provider’s medical director. it has formally accused a physician of wrongdoing, this information would appear on the BreEZe licensing database as a public record. Nonetheless, on May 25, 2011, ADP certified the provider applicant. In this instance, we found evidence in the file that ADP had conducted a license database search, but ADP did not disqualify the physician from serving as the provider’s medical director despite the fact that the medical board’s accusation appeared on the license database search as a disciplinary action. The certification branch supervisor who handled certifications stated that ADP did not have any written policies or procedures on how to evaluate a license database search, and its informal policy was to take action only if the search indicated that a physician had been convicted, and then only if ADP staff thought the conviction warranted denial of the application. California State Auditor Report 2013-119 43 August 2014 Our search also found that one provider applicant’s clinic director’s name appeared on the LEIE. The analyst processing the provider applicant’s file conducted the same search and got the same result we did. While it is possible that the clinic director is not in fact the person in the LEIE, the analyst did not request her Social Security number to verify this. Because the department was unable to provide us with the Social Security number, we were unable to verify whether this clinic director was the person on the exclusion list. When Health Care Services does not perform the required database searches or follow up on what it finds in such searches, it may certify ineligible providers, increasing the risk of fraud. Health Care Services Has Unnecessarily Delayed Its Federal Requirements for Screening Designation of High-Risk Provider Applicants Drug Medi-Cal Treatment Program Providers at Designated Categorical Risk Levels Health Care Services has failed to fully implement Federal regulations require the California Department of federal regulations that require it to screen all initial Health Care Services (Health Care Services) to establish provider applicants and assign them a risk level of categorical risk levels for providers and to screen all initial limited, moderate, or high. Effective March 25, 2011, applications, applications for a change in location, and the regulations required Health Care Services to recertifications based on a categorical risk level of limited, designate a provider applicant as high risk under moderate, or high. If a provider fits within more than one risk level, the highest level of screening is applicable. Once Health the following circumstances: when it imposes Care Services has assigned a risk level to a Drug Medi‑Cal a payment suspension on a provider applicant Treatment Program (program) provider, it must take the based on a credible allegation of fraud, waste, or following actions depending on the designated risk level: abuse; when the provider applicant has received a federal Medicaid program overpayment; or when • For program providers designated as limited the provider applicant has been excluded by the categorical risk, Health Care Services must (1) verify that the provider meets any applicable federal regulations U.S. Department of Health and Human Services’ or state requirements prior to certification, (2) conduct Office of Inspector General or another State’s license verifications, and (3) conduct on a pre‑ and Medicaid program within the previous 10 years. post‑enrollment basis the federal database checks The stringency of Health Care Services’ screening of described in the text box on page 41. provider applicants should increase as their assigned risk level increases. Further, federal regulations • For program providers designated as moderate categorical risk, Health Care Services must (1) perform the require Health Care Services to conduct a criminal limited categorical risk screening requirements described background check when screening a high‑risk above and (2) conduct on‑site visits prior to and after provider applicant and to require the submission enrollment to verify that the provider submitted accurate of a set of fingerprints from the owner and any information to Health Care Services and to ensure that person with a direct or indirect interest in the the provider is in compliance with federal and state provider applicant of 5 percent or more. The text box enrollment requirements. describes this federal requirement. • For program providers designated as high categorical risk, Health Care Services must (1) perform the moderate Health Care Services incorporated the federal risk screening requirements described above, high‑risk designation criteria into its program (2) conduct a criminal background check, and (3) require analyst review guide. According to the policy the submission of a set of fingerprints from specified branch chief, high‑risk designation criteria were people associated with the provider. incorporated in August 2013. However, Health Care Sources: Code of Federal Regulations, Title 42, Services has yet to begin the process of assigning sections 455.432, 455.434, and 455.450. appropriate risk levels to provider applicants. 44 California State Auditor Report 2013-119 August 2014 Further, as discussed in the previous section, Health Care Services does not consistently perform database searches to screen provider applicants, and the recent changes it has made do not all conform Health Care Services has not fully to federal regulations. The policy branch chief stated that Health implemented the designation Care Services has not fully implemented the designation of of high‑risk providers because high‑risk providers because it is waiting for final guidance from the it is waiting for final guidance federal government on how to implement the criminal background on how to implement the check and fingerprinting requirements. In addition, Health Care criminal background check and Services is seeking clarification from the federal government on fingerprinting requirements. whether it can authorize these requirements for the executive directors and officers of nonprofit organizations, because these organizations have boards of directors instead of owners. Further, we noted that the analyst guide does not include the criteria for assigning limited and moderate risk designations. The policy branch chief stated that Health Care Services did not establish criteria for the limited and moderate designations because the program’s Drug Medi‑Cal Certification Standards for Substance Abuse Clinics (certification standards) require an on‑site inspection of the facility, which meets the moderate categorical risk level requirements. Our legal counsel informs us, however, that although the federal government has allowed Health Care Services to delay the background check and fingerprinting of provider applicants until 60 days following the publication of the federal government’s additional guidance, this exemption does not extend to its obligation to designate provider applicants as high, moderate, and limited risk. The risk categorization is a necessary prerequisite to determine the level of screening Health Care Service must conduct on a provider applicant. For example, the guidance regarding fingerprint‑based criminal background checks applies to only the screening of provider applicants Health Care Services designates as high risk; in our opinion, failing to categorize all providers while awaiting guidance that applies to only certain providers is not reasonable. Health Care Services and ADP Cannot Demonstrate That They Certified Only Provider Applicants That Met Applicable Standards Before certifying provider applicants, Health Care Services and ADP did not consistently determine whether they complied with the certification standards, which ADP issued in 2004, and the Standards for Drug Treatment Programs (treatment standards), which ADP issued in 1981. Together, these standards require provider applicants to demonstrate a certain level of organizational and programmatic competency. For example, the treatment standards require providers to have established admission and readmission, case management, quality assurance, and discharge criteria and procedures. The certification standards include California State Auditor Report 2013-119 45 August 2014 requirements related to fire safety, use permits, maintenance, and staff qualifications. To ensure that provider applicants meet the certification and treatment standards, Health Care Services and ADP developed checklists for analysts to use during their review of applications, disclosure statements, and supporting documents. However, when we reviewed the four different processes the When we reviewed the four different departments used to certify provider applicants from July 1, 2008, processes the departments used to December 31, 2013, we found that they did not incorporate to certify provider applicants from all of the Medi‑Cal program legal requirements related to July 1, 2008, to December 31, 2013, we provider screening. The program certification standards state found that they did not incorporate that each substance abuse clinic must have a licensed physician all of the Medi‑Cal program designated as the medical director and that the medical director legal requirements related to assumes medical responsibility of all of its patients. State law provider screening. mandates that a physician provider rendering services may not be enrolled at more than three business locations unless there is a ratio of at least one physician providing supervision for every three locations. With respect to the program, this means that a physician cannot simultaneously serve as a medical director at more than three program sites unless another physician is also acting as a medical director, thus ensuring that the provider maintains a 1‑to‑3 physician ratio at all of its program locations. However, the checklists did not require the certification staff to identify the number of program provider locations at which a provider’s medical director worked. Consequently, our review found one physician who was acting as the medical director of four program sites. Although three of these sites had alternate medical directors listed in the provider’s application, the certification processes also did not track the number of sites at which the alternate medical directors worked. By failing to track the number of program provider locations at which a medical director works, Health Care Services cannot guarantee that beneficiaries are receiving the proper physician ratio, which could affect the level of program services. In addition, Health Care Services’ and ADP’s certification checklists failed to incorporate other federal and state requirements. For example, neither department required provider applicants to sign their applications under penalty of perjury, as state law requires, until October 2013. The certification branch chief stated that the certification staff were unaware of this requirement. The absence of penalty of perjury attestations might weaken any legal action that the State could take against a provider. Further, the certification processes did not incorporate the federal requirements that became effective in March 2011, such as performing additional database searches and designating risk levels of provider applicants, which we discussed earlier in this chapter. 46 California State Auditor Report 2013-119 August 2014 Program certification staff often did not retain the checklists as evidence of their reviews of the provider applicants’ business Our review of the files for operations and facilities. Specifically, our review of the files for 25 provider applicants found 25 provider applicants found that 20 were missing one or both of that 20 were missing one or both the checklists. Of these 20 files, four were missing checklists to of the checklists—evidence of their assess whether the provider applicants had met the operational reviews of the provider applicants’ requirements set forth in the certification and treatment standards, business operations and facilities. and 10 were missing facility walkthrough checklists to assess whether the clinic was safe for public use. The remaining six files were missing both checklists. Further, certification staff certified provider applicants without first ensuring that the checklists were complete and that the applicants had corrected any identified deficiencies. For example, ADP certified one provider applicant without first obtaining evidence that it had resolved a fire safety deficiency. The certification branch supervisor stated that because a major portion of the pertinent documentation was missing from the file, she was unable to explain why ADP had certified this provider applicant. She also could not explain why the certification staff did not use or retain the prescribed checklists, although she noted that the checklists may have been lost, purged, or misfiled. However, without consistent and proper use of the State’s prescribed checklists, the certification staff can neither verify that provider applicants have met the minimum program certification and treatment standards, which include ensuring that the clinics are safe for public use and meet building standards for fire safety. Finally, we found that program certification supervisors did not consistently conduct reviews of the provider applications including the prescribed checklists. The program application processing procedures require supervisors to review the provider applicant file and sign off on the Master Provider File New/Addition/ Change Request form that the State uses to add providers to its provider database. The procedures also require supervisors to sign the Certification and Transmittal form that notifies provider applicants of their program certification approval. However, one of the 25 provider applicant files we reviewed was missing both of these forms, and five were missing the supervisor’s signature on the Master Provider File New/Addition/Change Request form, which would evidence that they had been reviewed. The certification branch chief stated that supervisors failed to conduct consistent reviews of the provider applications because they had not received training on how to conduct an exhaustive review of the provider applicant files and instead conducted only spot checks. In addition, a certification branch supervisor admitted that staff sometimes signed off on the forms to save time or to help reduce the workload. In other words, Health Care Services California State Auditor Report 2013-119 47 August 2014 and ADP allowed staff to sign off on their own work without supervisory review, which is inconsistent with the program application processing procedures that the departments established to ensure an adequate segregation of duties. Without evidence of supervisory reviews, Health Care Services cannot demonstrate that it has ensured that the provider applicants it certifies have met the minimum program certification and treatment standards. ADP Severely Weakened Its Provider Applicant Screening Process to Address Its Backlog of Applications To eliminate a backlog of provider applications, ADP management To eliminate a backlog of provider allowed the program certification staff to perform a less stringent applications, ADP management review of the applications for a five‑month period, thereby allowed the program certification increasing the risk of fraud and abuse in the program. To address staff to perform a less stringent this backlog, ADP’s chief deputy director approved an application review of the applications for backlog resolution process proposal in December 2010 that a five‑month period, thereby required the program certification staff to implement the use increasing the risk of fraud and of the Compliance Agreement and the Front End Application abuse in the program. Checklist (front‑end checklist). Further, a physical inventory of its applications by ADP management found that it had a backlog of roughly 280 applications as of January 2011. In signing the Compliance Agreement, provider applicants agreed to fully comply with the program certification standards, treatment standards, and relevant state regulations, and to have certain supporting documentation available for review at the time of ADP’s site inspection. Certification staff used the front‑end checklist to expedite the Compliance Agreement review process. The certification branch chief and supervisor stated that these requirements were in effect from January 2011 through May 2011. We found that the front‑end checklist was less robust than the initial Drug Medi‑Cal Parent Application Checklist that program certification staff previously used. For example, the front‑end checklist did not include a review of provider applicants’ annual budgets or of their policies and procedures for quality assurance, intake, admission and treatment, services, and personnel. We do not know how many providers were subject to this process because the certification branch supervisor stated that ADP did not maintain a specific list of all the provider applicants that it certified using the Compliance Agreement and front‑end checklist review process. Our review of 25 files found that ADP certified six of the provider applicants using the Compliance Agreement and front‑end checklist review process. Health Care Services recently suspended one of these six providers after receiving a credible allegation of fraud against it. Between 2010 and 2013, Health Care Services and 48 California State Auditor Report 2013-119 August 2014 ADP approved $316,235 for this provider. Because the certification staff could not provide evidence that they reviewed the accuracy and completeness of this provider’s documentation during their site visit as part of the certification process, we cannot determine whether they could have prevented this potentially fraudulent activity by not certifying the provider. The certification staff also could not provide evidence that they reviewed all of the required documentation for four of the five remaining providers during their site visits. Ultimately, ADP’s desire to reduce its application backlog resulted in a diluted review process that weakened the provider applicant screening process and increased the likelihood of fraud and abuse in the program. Heath Care Services’ and ADP’s Passive Administration of the Program Allowed Providers to Remain Certified Indefinitely Health Care Services and ADP did not take steps to strengthen their outdated program recertification requirements until mandated to do so by the federal government. Specifically, before a change in federal regulations in March 2011, the program certification standards did not require the recertification of a provider unless it changed one of the following: • Its ownership • Its scope of services, if the new scope resulted in more restrictive or higher standards of program services or increased the treatment hours of clients • Its physical space through, for instance, substantial remodeling • Its address As a result, Health Care Services and ADP essentially certified providers indefinitely unless the providers experienced one of the four changes described above. Further, the certification branch supervisor provided us with a copy of the initial program certification approval letter that required providers to submit applications if they experienced any of the four changes. In other words, Health Care Services and ADP relied on the providers to self‑report the triggering events. During our audit period of July 1, 2008 through December 31, 2013, the certification branch chief reported that Health Care Services and ADP recertified 133 providers that had changes related to relocations, expansions to their physical plant space, and changes in their program services. The certification standards require the departments to conduct site visits when recertifying providers for any of the four changes. However, the certification branch chief was unable to provide California State Auditor Report 2013-119 49 August 2014 evidence that the departments conducted or at least assigned a site visit for 57 of these recertifications. In addition, neither department established a mechanism to identify changes in ownership. According to the certification branch chief, once the certification staff issued the program certification to the provider, they had no further contact with a provider unless it informed the staff of any changes. Further, according to the chief of the performance management branch that conducts the post‑service post‑payment utilization reviews, this branch was not monitoring changes in ownership because it lacked adequate staffing to monitor the certification standards or treatment standards. However, federal regulations are forcing Health Care Services to strengthen its recertification process. As of March 25, 2011, federal regulations require the recertification of all program providers every five years. The Centers for Medicare and Medicaid Services’ Information Bulletin from December 23, 2011, specifies that states must complete their provider recertifications on or before March 24, 2016. The chief of the department’s enrollment division stated that it began the recertification process for all program providers in July 2013. The 2014–15 Governor’s Budget includes 21 one‑year limited‑term positions to assist the enrollment division with its additional workload associated with the certification and recertification of the program providers. Despite the federal regulations having been in effect since 2011, Despite the federal regulations the enrollment division has not yet established any recertification having been in effect since 2011, policies and procedures, nor has it developed a schedule to the enrollment division has not demonstrate that it will be recertifying program providers every yet established any recertification five years. The policy branch chief stated that the enrollment policies and procedures or schedule division will develop this information once it has recertified all to demonstrate that it will be current providers. In the meantime, the enrollment division will use recertifying program providers every the same process it uses for initially certifying provider applicants five years. to recertify the current providers. However, according to the policy branch chief, as of June 24, 2014, the enrollment division had received 613 applications for recertification but had approved only 24, or 4 percent, of these applications. Because the enrollment division must still process the remaining 589 recertification applications, it is unclear whether it will be able to meet the federal recertification deadline or when it will develop the required recertification policies, procedures, and schedule. Moreover, since January 1, 2014, the enrollment division not only has been handling program recertifications, but it also has been conducting new provider certifications. Thus, we are concerned that it may be underestimating the challenge of recertifying all program providers while simultaneously screening new provider applicants. According to the policy branch chief, as of June 24, 2014, the enrollment division had received 298 applications 50 California State Auditor Report 2013-119 August 2014 for certification of new sites and services or for changes to an existing certification. It has approved none of these applications, in part because it found that 194 of the 298 applications were deficient. In accordance with its Medi‑Cal Desk Procedures Provider Enrollment Manual, the enrollment division returned the deficient applications to the provider applicants so that they could remediate the deficiencies. Because the provider applicants will return these deficient applications to the enrollment division, it eventually must still process a total of 298 applications. The enrollment division chief stated that the enrollment division will process these applications concurrently with its provider recertifications. She also stated that the enrollment division is implementing a system that will automate its provider enrollment process. Further, she stated that the system will provide efficiencies that should significantly reduce the time it takes to process applications. Finally, she stated that the system will not be implemented fully until spring of 2015. Thus, because the enrollment division approves a low percentage of its applications, it may continue to encounter a growing backlog of program applications between now and spring of 2015. As a result, Medi‑Cal beneficiaries may not be able to obtain the program services they need from certified program providers. Recommendations To prevent the certification of ineligible providers, Health Care Services should immediately do the following: • Instruct its staff to compare the names of the managing employees whom applicant providers identify in their program applications to those whom they identify in their disclosure statements. • Train its staff regularly on the program requirements, including the certification standards and the federal Medicaid provider enrollment requirements. • Develop a provider agreement for program providers. • Update its procedures to include searches of the Social Security Death Master File. • Develop procedures on how to evaluate provider applicant license database searches. • Instruct its enrollment division to conduct all required database searches of individuals that provider applicants identify as their owners or managing employees. California State Auditor Report 2013-119 51 August 2014 • Ensure that its enrollment division conducts LEIE and EPLS database searches of program providers at least monthly. • Designate provider applicants as moderate or high risk in accordance with federal regulations. • Establish a mechanism to identify the number of program sites the provider applicants’ medical directors work at, and ensure that the physician ratio does not exceed 1‑to‑3 in accordance with state law and the certification standards. • Identify and perform an immediate recertification of providers that signed the Compliance Agreement to ensure that these providers are currently meeting all program requirements. • Use a risk‑based approach for recertifying program providers. • Develop policies and procedures for its program recertification process. • Develop a schedule for recertifying all program providers every five years. • Continue its implementation of an automated provider enrollment system. • Complete its program recertifications on or before March 24, 2016, as federal regulations require. • Establish a plan for eliminating its backlog of applications for new sites and services and changes to existing certifications. To ensure that it appropriately and consistently reviews provider applications and conducts site visits, Health Care Services should do the following: • Update its program checklists to reflect the current federal and state laws and regulations. • Retain the documentation, such as checklists, that it uses to support its certification decisions in accordance with its retention policy. • Ensure that supervisors perform detailed reviews of all provider applicants’ files, including the application, disclosure statement, and checklists, and that they evidence their reviews by signing off on the appropriate forms. 52 California State Auditor Report 2013-119 August 2014 Blank page inserted for reproduction purposes only. California State Auditor Report 2013-119 53 August 2014 Chapter 3 THE STATE’S INEFFECTIVE COORDINATION WITHIN ITS OWN DIVISIONS AND WITH THE COUNTIES MAY COMPROMISE THE INTEGRITY OF THE DRUG MEDI‑CAL TREATMENT PROGRAM The California Department of Health Care Services’ (Health Care Services) Audits and Investigations Division (investigations division) has identified a number of areas in which Health Care Services can improve the coordination between its various divisions, branches, and units to ensure that it addresses fraud in the Drug Medi‑Cal Treatment Program (program) in a timely manner. Although Health Care Services is in the process of implementing these recommendations, many remain incomplete. Until it fully implements these recommendations, Health Care Services cannot effectively mitigate the State’s financial and legal risks. The investigations division also identified weaknesses in Health Care Services’ coordination with the counties that leave potential gaps in their collective monitoring efforts. In response to the investigations division’s recommendations, Health Care Services is currently revising its contract with the counties to establish a more coordinated monitoring process. However, it has not yet completed these revisions. Further, one county believes Health Care Services’ unwillingness to disclose information related to provider suspensions may affect the county’s ability to provide program services to beneficiaries. Health Care Services Has Yet to Make Critical Changes to Ensure Its Effective Internal Coordination of the Program Since 2013 Health Care Services has taken steps to improve the coordination between its divisions, branches, and units that are responsible for administering the program. A key factor driving its efforts is an internal review its investigations division conducted in 2013 that highlighted numerous gaps in Health Care Services’ administration of the program.13 Although Health Care Services has made progress in implementing some of the investigations division’s recommendations, it still needs to implement others fully to ensure that it addresses fraud in a timely manner and effectively mitigates the State’s financial and legal risks. 13 The investigations division defined gaps as internal control weaknesses; inefficient or ineffective business practices; and the lack of statutory or regulatory authority to meet performance expectations, ensure program integrity, and effectively mitigate Health Care Services’ financial or legal risks. 54 California State Auditor Report 2013-119 August 2014 The investigations division conducted a limited scope review of the program to determine whether Health Care Services was effectively and efficiently overseeing the program functions that The investigations division the Legislature transferred to it from the California Department found numerous weaknesses of Alcohol and Drug Programs in July 2012. The investigations in Health Care Services’ division found numerous weaknesses in Health Care Services’ administration of the program administration of the program and made 32 recommendations for and made 32 recommendations improvement. Thirteen, or 41 percent, of these recommendations for improvement. related specifically to improving the coordination between the department staff responsible for administering the program. Health Care Services has fully implemented only four of the 13 recommendations. For example, two of its divisions oversee the substance use disorder (SUD) services: the SUD Prevention, Treatment, and Recovery Services Division (PTRS division) and the SUD Compliance Division (compliance division). Health Care Services implemented fully the investigations division’s recommendation that SUD management and the investigations division collaborate to provide detailed and ongoing program training to the investigators and other staff who may be responsible for conducting future investigations, audits, or reviews of program activity or providers. The deputy director of mental health and substance use disorder services, who oversees the two SUD divisions, reported to the director of Health Care Services on January 10, 2014, that SUD management had worked closely with staff in the investigations division to provide training and guidance since the summer of 2013. The deputy director cited examples of training that occurred between October and December 2013. For example, the deputy director stated that in November 2013, SUD management provided statewide training to the investigations division staff on general program requirements. However, as of July 9, 2014, Health Care Services had not implemented fully the remaining nine recommendations aimed at improving coordination between the department staff responsible for administering the program. Specifically, one recommendation addresses coordination between the PTRS division and the compliance division. The investigations division found that there was a lack of clarity among SUD management and staff regarding the responsibility for monitoring compliance with the program certification standards we discussed in Chapter 2 versus the post‑service post‑payment utilization reviews (utilization reviews) that federal and state regulations require. As such, the investigations division recommended that SUD management identify the SUD unit best suited to assume responsibility for the ongoing monitoring of the program’s certification standards. The purpose of the utilization reviews is to verify that the documentation maintained by providers in their individual patient records meets the requirements in state regulations, that each beneficiary meets the California State Auditor Report 2013-119 55 August 2014 admissions criteria, that a treatment plan exists for each beneficiary, and that the provider rendered services claimed for reimbursement in accordance with state regulations. The post‑service post‑payment (PSPP) unit within the performance management branch of the PTRS division is responsible for conducting the utilization reviews. The performance management branch chief stated the PSPP unit has not historically monitored the providers’ compliance with the program’s certification and treatment standards except to the extent that the PSPP unit intermittently monitored selected items related to facility site inspections. However, beginning in fiscal year 2013–14, Health Care Services’ county monitoring unit, within the performance management branch, asked counties to certify that they are complying with the State‑county contract, which requires counties to ensure that providers comply with the program’s certification and treatment standards. However, this certification No unit is assigned the task of does not explicitly apply to the program, and the State‑county monitoring providers’ compliance contract does not require the State or the county to monitor with the program’s certification provider compliance with these standards. The performance and treatment standards, yet, management branch chief acknowledges that no unit is assigned without this monitoring, it is not the task of monitoring providers’ compliance with these standards. possible to ascertain whether Without this monitoring, it is not possible to ascertain whether a a provider remains eligible for provider remains eligible for program certification. program certification. In addition, four of the nine recommendations that focus on coordination that remain unimplemented are related to strengthening the utilization reviews. The utilization reviews require coordination between the PSPP unit and the investigations division. Health Care Services stated that to implement the four recommendations related to the utilization reviews, SUD management would work with the investigations division to develop a provider risk assessment model for the PSPP unit to use when performing its utilization reviews. However, Health Care Services does not expect to complete the provider risk assessment model until the fall of 2014. The deputy director of mental health and substance abuse disorder services stated the investigations division is currently selecting providers for utilization reviews based on data mining activities and input from its investigators. Nevertheless, without this provider risk assessment model, the PSPP unit lacks the framework necessary for determining when it should engage the investigations division’s medical review branch staff to review clinical information for certain providers. Two of the remaining nine recommendations relate specifically to improving coordination between the PSPP unit, the complaints unit within the Complaints and Counselor Certification Branch of the compliance division, and the investigations division to ensure that the investigations division receives program complaints so that it can determine whether they are credible allegations of fraud. 56 California State Auditor Report 2013-119 August 2014 The complaints unit is responsible for investigating complaints against program facilities and certain counselors instead of providers and beneficiaries. The complaints unit’s procedures require it to maintain an intake log and to track the disposition of each complaint, including whether it has forwarded any complaints related to potential fraud or improper billings to the PSPP unit. Similarly, the PSPP unit’s procedures require it to maintain an intake log and to track the disposition of each complaint it receives. The investigations division’s recommendations focus on ensuring that program complaints are addressed by the appropriate unit in a timely fashion and that the PSPP unit forwards the complaints to the appropriate law enforcement authorities. Health Care Services stated that to implement these recommendations, its complaints unit within the compliance division will forward complaints to the PSPP unit, which will review and refer complaints to the investigations division for preliminary investigation. It also stated the PSPP unit will establish a mechanism to regularly report to the investigations division and SUD management the referrals it receives, the referral outcomes, and the basis of the outcomes. However, the chief of the performance management branch stated that the PSPP unit will not finalize Until it finalizes the development this reporting mechanism until September 2014 because it is of this reporting mechanism, still in the process of drafting its complaint and fraud referral Health Care Services cannot procedures, and the procedures must undergo an internal review ensure that it is tracking the in August 2014. Until it finalizes the development of this reporting disposition of complaints and mechanism, the PSPP unit cannot ensure that it is tracking the coordinating with the investigations disposition of complaints and coordinating with the investigations division effectively. division effectively. We present the investigations division’s recommendations in Appendix B beginning on page 69 along with Health Care Services’ implementation plan as of January 10, 2014, its progress as of July 9, 2014, and our assessment of its implementation status. The remaining two of the nine recommendations regarding coordination that have not been implemented fully can be found in Appendix B. If the department does not fully implement these nine recommendations, it will continue to hinder the coordination of efforts for administering the program. Weaknesses in Health Care Services’ Coordination With the Counties Creates Gaps in Their Collective Monitoring Efforts and May Affect the Counties’ Ability to Provide Services The investigations division’s recommendations included four that relate specifically to improving the coordination between Health Care Services and the counties responsible for administering the program. However, Health Care Services has not implemented California State Auditor Report 2013-119 57 August 2014 these recommendations. As a result, it is failing to address the gaps that exist within the State and counties’ collective monitoring efforts. Moreover, Sacramento County believes that Health Care Services’ conditions for disclosing the names of suspended providers may prevent it from ensuring the safe and reliable treatment of its beneficiaries. The investigations division made four recommendations to Health Care Services to improve the integrity of the program that require it and the counties to work together: • Consider expanding the counties’ role in the program’s compliance monitoring activities. • Amend the State‑county contract to reflect the enhanced role that counties might play regarding future utilization reviews. • Require the counties to notify Health Care Services when they become aware that a provider with which they contract is closing its program or has become defunct. • Work with the counties to develop a process for retrieving and securing relevant records from providers after Health Care Services sanctions them. Health Care Services’ implementation plan for the first three of the four recommendations was to amend its State‑county contract that covers fiscal years 2014–15 and 2015–16. However, as of July 9, 2014, Health Care Services had not yet finalized its amendments to the State‑county contract. Health Care Services’ implementation plan for the fourth recommendation was to have its SUD management work with the counties to take possession of patient records from providers that contract directly with the State when those providers close their facilities or the State terminates their contracts. The deputy director of mental health and substance use disorder services stated that Health Care Services also plans to address this recommendation by amending the State‑county contract. Nevertheless, without its contract amendments in place, Health Care Services cannot ensure that counties will fully implement the monitoring responsibilities that it will no longer perform. In addition, Health Care Services stated that counties have expressed an interest in sharing information about provider applicants in their jurisdiction before Health Care Services certifies them. As discussed in the Introduction, counties must negotiate contracts only with providers that Health Care Services has certified to provide program services. The chief of its policy and administrative branch (policy branch) stated that Health Care Services has taken a number of steps to communicate with counties regarding program 58 California State Auditor Report 2013-119 August 2014 provider applicants. For example, the Provider Enrollment Division (enrollment division) staff participate in county stakeholder gatherings, such as the County Alcohol and Drug Program Administrators Association of California meetings, to answer questions from the county administrators. In June 2014 they also began to host monthly county administrator conference calls. The policy branch chief stated that in an effort to assist providers seeking certification or recertification, counties have asked the enrollment division to (1) inform them when providers in their jurisdictions apply for program certification, (2) identify the provider that is submitting an application, and (3) copy them on any deficiency notices the enrollment division sends to Health Care Services regarding the providers’ applications. However, the policy branch chief stated that Health Care Services’ position is that it cannot share provider deficiency information because to do so would violate a provider applicant’s privacy rights. State law prohibits Health Care Services from sharing a provider applicant’s deficiency notice but allows disclosure to governmental entities that execute a confidentiality agreement. One county we visited also expressed One county we visited also expressed concern that Health Care concern that Health Care Services Services does not notify the county in a timely manner when it does not notify the county in a suspends program providers. State law requires the director of timely manner when it suspends Health Care Services to suspend program providers under certain program providers. circumstances and authorizes suspensions in others. For example, if a provider is under investigation by Health Care Services or any state, local, or federal government law enforcement agency for a credible allegation of fraud or abuse, Health Care Services must temporarily suspend it. This suspension includes temporary deactivation of the provider’s number, including all business addresses the provider used to obtain reimbursement from the Medi‑Cal program. State law also requires the director to notify the provider in writing of the temporary suspension and deactivation, which takes effect 15 days from the notification. Sacramento County’s deputy director of the Behavioral Health Division (Behavioral Health) within its Department of Health and Human Services stated that Health Care Services issued a temporary suspension to one of Sacramento County’s providers, sending it a cease‑and‑desist letter on February 12, 2014. However, Health Care Services did not send a copy of the letter to the county, nor did it notify the county of the suspension in a timely manner. Instead, the provider informed the county on February 18, 2014. Because the county’s drug court program often referred juveniles to this provider, behavioral health staff informed the court of the temporary suspension on February 19, 2014, so that it would not penalize the suspended provider’s clients for not completing the alcohol and drug treatment conditions of their probation. On February 24, 2014, a former Behavioral Health manager contacted California State Auditor Report 2013-119 59 August 2014 Health Care Services to seek guidance on how to process this provider’s claims, but Health Care Services did not provide any information other than to instruct the county that the temporary suspension was to remain confidential. According to the chief of the investigations division, Health Care Services does not send copies of the suspension letters to counties in order to maintain the confidentiality of open and ongoing criminal investigations. Instead, it offers counties the opportunity to sign a confidentiality agreement, which would allow the investigations division to disclose the names of suspended program providers. Health Care Services sent Sacramento County a confidentiality agreement on March 3, 2014. Sacramento County did not sign the confidentiality agreement because it believes that the agreement would prevent it from sharing information with entities within the county that may unknowingly refer beneficiaries to providers under investigation. The county requested modifications to the agreement that would allow it to share the provider’s name with its service partners, such as the county courts and probation department; however, according to the chief of the investigations division, Health Care Services would not agree to the modifications because it believes that would defeat the purpose of the agreement. In turn, Sacramento County believes Health Care Services’ unwillingness to negotiate a solution prevents its beneficiaries from obtaining the program services they need from a legitimate provider. The deputy director of Behavioral Health explained that Sacramento County takes very seriously its obligation to provide safe and responsible treatment to its beneficiaries and to inform its service partners of critical information related to the beneficiaries under their respective charges. In addition, she stated that the lack of communication would leave numerous county entities at risk. Health Care Services is within its legal rights to uphold the confidentiality of its ongoing investigations; however, it is taking steps to address the county’s concern. According to the assistant chief of the PTRS division, Health Care Services is incorporating into its contract with the counties language that would allow a county to enter into separate confidentiality agreements with its key partners to share the confidential provider information. The assistant chief stated that the language is finalized and will be incorporated into its State‑county contract. However, as noted previously, Health Care Services had not yet finalized all of its amendments to the State‑county contract. Because this solution is not yet in place, counties that are unwilling to sign Health Care Services’ current confidentiality agreement are still unable to obtain information about the suspended providers in their jurisdictions. 60 California State Auditor Report 2013-119 August 2014 Recommendations To improve the coordination between its divisions, branches, and units and ensure that it addresses allegations of fraud in a timely manner, Health Care Services should do the following: • Continue its efforts to develop its provider risk assessment model for the PSPP unit. • Continue its efforts to establish a mechanism for its PSPP unit to report the status of fraud referrals to SUD management and its investigations division. • Fully implement the investigations division’s recommendations shown in Appendix B. If it chooses not to implement a recommendation, it should document sufficiently the reasons for its decision. To strengthen the coordination between the State and the counties, Health Care Services should amend the State‑county contract to address any gaps in their collective monitoring efforts. To ensure that beneficiaries have safe and reliable access to program services, Health Care Services should amend the State‑county contract to allow a process for counties to notify their key partners of the providers that it has suspended. California State Auditor Report 2013-119 61 August 2014 We conducted this audit under the authority vested in the California State Auditor by Section 8543 et seq. of the California Government Code and according to generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives specified in the scope section of the report. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Respectfully submitted, ELAINE M. HOWLE, CPA State Auditor Date: August 19, 2014 Staff: Joanne Quarles, CPA, Audit Principal Andrew J. Lee Reed Adam, MAcc Heather Kendrick, JD, LLM Jessica E. Kubo Legal Counsel: Scott A. Baxter, JD IT Audit Support: Ben Ward, CISA, ACDA Sarah Rachael Black, MBA Kim L. Buchanan, MBA, CIA Ryan P. Coe, MBA, CISA Richard W. Fry, MPA, ACDA For questions regarding the contents of this report, please contact Margarita Fernández, Chief of Public Affairs, at 916.445.0255. 62 California State Auditor Report 2013-119 August 2014 Blank page inserted for reproduction purposes only. California State Auditor Report 2013-119 63 August 2014 Appendix A SERVICES POTENTIALLY INDICATIVE OF FRAUDULENT ACTIVITY We analyzed the California Department of Health Care Services’ (Health Care Services) and the California Department of Alcohol and Drug Programs’ Drug Medi‑Cal Treatment Program claims billing data for services that providers rendered to beneficiaries from January 1, 2010 through December 31, 2013. To identify these services, we searched the data for services that met the criteria for any of the five high‑risk indicators that we believe may be symptomatic of fraud in certain circumstances. We developed these indicators based on what we learned from background information obtained for the audit, as well as on our professional judgment, knowledge of known cases of fraud, and interviews with Health Care Services. The following are the five high‑risk indicators for which we searched: • Services rendered to multiple beneficiaries residing at the same address. • Services approved for payment at unauthorized rates. • Services rendered on holidays. • Excessive individual counseling services rendered to a specific beneficiary. • Services rendered by providers billing more than five days in a week. Tables A.1 through A.5 on pages 64 through 68 present the statewide results for each of the five indicators by county. The tables show the number of provider sites, the number of services we identified for each indicator, and the total payments approved for the services. Because the high‑risk indicators are not mutually exclusive, it is possible that a service met the criteria for more than one indicator. Consequently, a service may have been included in more than one of these tables. In total, we identified $93.7 million in approved payments for more than 2.6 million services that are potentially indicative of fraudulent activity. 64 California State Auditor Report 2013-119 August 2014 Table A.1 High-Risk Indicator: Services Rendered to Multiple Beneficiaries Residing at the Same Address, by County January 1, 2010 Through December 31, 2013 NUMBER OF COUNTY PROVIDER SITES NUMBER OF SERVICES AMOUNT OF APPROVED PAYMENTS Alameda 10 3,062 $103,625 Butte 4 696 27,918 Contra Costa 7 913 35,107 El Dorado 5 1,175 46,846 Fresno 49 22,304 716,005 Glenn 1 31 1,234 Humboldt 2 1,063 38,451 Imperial 2 1,284 43,716 Inyo 1 13 383 Kern 13 2,485 87,186 Kings 2 432 15,761 Lake 5 771 31,409 Lassen 3 1,078 42,564 Los Angeles 162 423,536 13,773,966 Madera 3 46 1,738 Marin 4 263 8,184 Mariposa 1 244 9,079 Mendocino 2 1,700 54,021 Merced 2 88 3,238 Monterey 1 483 19,754 Napa 4 3,826 107,083 Nevada 5 1,676 67,838 Placer 6 1,708 57,247 Riverside 28 20,892 775,727 Sacramento 21 6,558 282,418 San Benito 1 138 6,817 San Bernardino 24 5,669 189,738 San Diego 21 4,420 144,606 San Francisco 3 113 3,882 San Joaquin 2 1,347 49,840 Santa Barbara 12 7,020 224,233 Santa Clara 13 757 28,676 Santa Cruz 3 44 1,873 Shasta 5 3,028 102,642 Solano 4 484 15,595 California State Auditor Report 2013-119 65 August 2014 NUMBER OF COUNTY PROVIDER SITES NUMBER OF SERVICES AMOUNT OF APPROVED PAYMENTS Sonoma 4 6,116 197,938 Tulare 1 1,296 59,921 Ventura 6 2,912 115,176 Yolo 1 109 3,441 Yuba/Sutter* 1 1,672 49,730 Totals 444 531,452 $17,544,606 Sources: California State Auditor’s analysis of the California Department of Health Care Services’ (Health Care Services) and the California Department of Alcohol and Drug Programs’ (ADP) Short‑Doyle Medi‑Cal ADP Remediation Technology system and Master Provider File and Health Care Services’ Fiscal Intermediary Access to Medi‑Cal Eligibility system. Notes: The data alone do not indicate whether these services were ineligible for payment. Substantiating whether services were eligible for payment would require a manual review of Health Care Services’ records, ADP’s records, and outpatient drug‑free treatment providers’ records, which are stored at various locations throughout the State. Our analysis includes providers that contracted directly with Health Care Services and ADP, as well as providers that contracted directly with the counties. * The State has a single contract with Sutter County and Yuba County. Table A.2 High-Risk Indicator: Services Approved for Payment at Unauthorized Rates, by County January 1, 2010 Through December 31, 2013 NUMBER OF NUMBER OF AMOUNT OF COUNTY PROVIDER SITES SERVICES APPROVED PAYMENTS Lassen 1 1 $135 Los Angeles 2 111 29,683 San Francisco 1 341 25,884 San Mateo 1 8 1,232 Santa Clara 1 1 114 Santa Cruz 8 102 7,293 Totals 14 564 $64,341 Sources: California State Auditor’s analysis of the California Department of Health Care Services’ (Health Care Services) and the California Department of Alcohol and Drug Programs’ (ADP) bulletins, Short‑Doyle Medi‑Cal ADP Remediation Technology system, and Master Provider File. Notes: The data alone do not indicate whether these services were ineligible for payment. Substantiating whether services were eligible for payment would require a manual review of Health Care Services’ records, ADP’s records, and outpatient drug‑free treatment providers’ records, which are stored at various locations throughout the State. Our analysis includes providers that contracted directly with Health Care Services and ADP, as well as providers that contracted directly with the counties. 66 California State Auditor Report 2013-119 August 2014 Table A.3 High-Risk Indicator: Services Rendered on Holidays, by County January 1, 2010 Through December 31, 2013 NUMBER OF NUMBER OF AMOUNT OF COUNTY PROVIDER SITES SERVICES APPROVED PAYMENTS Alameda 7 89 $2,678 Butte 1 1 30 Contra Costa 1 7 445 El Dorado 1 5 191 Fresno 13 259 8,563 Kern 1 6 177 Kings 2 13 528 Lake 2 8 285 Los Angeles 137 9,871 319,648 Nevada 1 1 70 Placer 2 4 117 Riverside 4 22 918 Sacramento 5 303 11,130 San Bernardino 3 14 430 San Diego 6 19 664 San Joaquin 2 29 1,154 San Luis Obispo 4 13 761 San Mateo 1 1 70 Santa Barbara 7 264 9,189 Santa Clara 3 3 88 Santa Cruz 1 1 70 Shasta 2 23 806 Solano 3 32 1,053 Sonoma 2 162 5,216 Tulare 1 11 523 Ventura 1 6 422 Totals 213 11,167 $365,226 Sources: California State Auditor’s analysis of the California Department of Health Care Services’ (Health Care Services) and the California Department of Alcohol and Drug Programs’ (ADP) Short‑Doyle Medi‑Cal ADP Remediation Technology system and Master Provider File. Notes: The data alone do not indicate whether these services were ineligible for payment. Substantiating whether services were eligible for payment would require a manual review of Health Care Services’ records, ADP’s records, and outpatient drug‑free treatment providers’ records, which are stored at various locations throughout the State. Our analysis includes providers that contracted directly with Health Care Services and ADP, as well as providers that contracted directly with the counties. California State Auditor Report 2013-119 67 August 2014 Table A.4 High Risk Indicator: Excessive Individual Counseling Services Rendered to a Specific Beneficiary, by County January 1, 2010 Through December 31, 2013 NUMBER OF NUMBER OF AMOUNT OF COUNTY PROVIDER SITES SERVICES APPROVED PAYMENTS Alameda 13 2,883 $197,356 Butte 6 1,817 127,714 Contra Costa 9 2,191 150,431 El Dorado 3 919 62,337 Fresno 59 12,791 898,339 Glenn 2 68 4,732 Humboldt 2 47 3,187 Imperial 2 584 40,144 Kern 13 642 33,423 Kings 2 405 27,790 Lake 9 2,644 180,053 Lassen 3 548 37,179 Los Angeles 270 222,984 15,481,406 Mariposa 1 58 3,721 Mendocino 2 51 3,474 Merced 2 19 1,342 Monterey 1 301 21,124 Napa 3 81 4,838 Nevada 5 1,685 127,541 Placer 6 226 15,992 Riverside 32 20,443 1,426,299 Sacramento 55 37,765 2,552,502 San Benito 1 73 5,080 San Bernardino 24 3,204 221,586 San Diego 18 591 41,285 San Francisco 4 350 23,958 San Joaquin 3 1,011 70,383 San Luis Obispo 4 39 2,798 San Mateo 1 397 28,185 Santa Barbara 12 8,291 577,654 Santa Clara 25 1,764 118,397 Santa Cruz 11 255 17,331 Shasta 5 388 26,873 Solano 5 157 10,706 Sonoma 5 862 59,115 Tulare 1 10,245 712,065 Ventura 6 853 59,797 Yolo 2 233 15,643 Totals 627 337,865 $23,391,780 Sources: California State Auditor’s analysis of the California Department of Health Care Services’ (Health Care Services) and the California Department of Alcohol and Drug Programs’ (ADP) Short‑Doyle Medi‑Cal ADP Remediation Technology system and Master Provider File. Notes: The data alone do not indicate whether these services were ineligible for payment. Substantiating whether services were eligible for payment would require a manual review of Health Care Services’ records, ADP’s records, and outpatient drug‑free treatment providers’ records, which are stored at various locations throughout the State. Our analysis includes providers that contracted directly with Health Care Services and ADP, as well as providers that contracted directly with the counties. 68 California State Auditor Report 2013-119 August 2014 Table A.5 High-Risk Indicator: Services Rendered by Providers Billing More than Five Days in a Week, by County January 1, 2010 Through December 31, 2013 NUMBER OF NUMBER OF AMOUNT OF COUNTY PROVIDER SITES SERVICES APPROVED PAYMENTS Alameda 5 15,524 $507,066 Butte 1 13 521 Contra Costa 4 474 16,633 El Dorado 1 156 4,911 Fresno 18 17,969 620,612 Imperial 1 1,133 35,669 Kern 5 371 13,512 Kings 1 36 1,188 Lake 1 99 3,143 Los Angeles 201 2,023,808 65,877,351 Mendocino 1 38 1,324 Monterey 1 31 1,083 Napa 1 111 3,191 Nevada 4 940 38,605 Placer 3 1,770 54,152 Riverside 11 3,378 145,604 Sacramento 12 14,214 576,701 San Bernardino 4 4,097 148,802 San Diego 11 3,524 112,304 San Francisco 2 129 4,202 San Joaquin 1 364 12,651 San Luis Obispo 3 2,560 86,520 San Mateo 1 20 751 Santa Barbara 8 33,661 1,092,556 Santa Clara 6 393 13,949 Shasta 3 9,185 312,853 Solano 3 71 2,103 Sonoma 2 95 3,169 Tulare 1 25,825 1,144,516 Ventura 5 4,695 165,299 Yolo 1 85 2,964 Totals 322 2,164,769 $71,003,905 Sources: California State Auditor’s analysis of the California Department of Health Care Services’ (Health Care Services) and the California Department of Alcohol and Drug Programs’ (ADP) Short‑Doyle Medi‑Cal ADP Remediation Technology system and Master Provider File. Notes: The data alone do not indicate whether these services were ineligible for payment. Substantiating whether services were eligible for payment would require a manual review of Health Care Services’ records, ADP’s records, and outpatient drug‑free treatment providers’ records, which are stored at various locations throughout the State. Our analysis includes providers that contracted directly with Health Care Services and ADP, as well as providers that contracted directly with the counties. California State Auditor Report 2013-119 69 August 2014 Appendix B STATUS OF RECOMMENDATIONS FROM THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES’ LIMITED SCOPE REVIEW OF THE DRUG MEDI‑CAL TREATMENT PROGRAM Effective July 1, 2012, state law transferred the administrative functions for the Drug Medi‑Cal Treatment Program (program) from the California Department of Alcohol and Drug Programs (ADP) to the California Department of Health Care Services (Health Care Services). One of the Legislature’s purposes for this transfer was to improve consumers’ access to alcohol and drug treatment services, with a particular focus on recovery and rehabilitation services. Health Care Services’ Audits and Investigations Division (investigations division) conducted a limited scope review of the program and issued its report in November 2013. The purpose of the investigations division’s review was to determine whether Health Care Services was effectively and efficiently managing the program functions that ADP previously performed. The investigations division found numerous weaknesses in Health Care Services’ administration of the program, and Table B beginning on page 70 presents its recommendations for improvement. The table also includes the implementation status for these recommendations as of July 9, 2014. We excluded three of the investigations division’s recommendations from the table because they were for services other than outpatient drug‑free treatment, which is the focus of our audit. Of the 29 recommendations we present in the table, Health Care Services fully implemented eight, partially implemented 14, and has yet to implement seven. 70 California State Auditor Report 2013-119 August 2014 Table B The Status of Certain Recommendations From the California Department of Health Care Services’ Limited Scope Review of the Drug Medi-Cal Treatment Program IMPLEMENTATION STATUS THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES’ THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES’ PROGRESS AS OF JULY 9, 2014 RECOMMENDATION NUMBER* RECOMMENDATION IMPLEMENTATION PLAN AS OF JANUARY 10, 2014 AS OF JULY 9, 2014 (UNLESS OTHERWISE NOTED) (UNLESS OTHERWISE NOTED) To ensure the successful implementation of remedies Health Care Services stated that it is utilizing the Audits Health Care Services completed the targeted on‑site reviews of for identified gaps and program deficiencies, substance and Investigations Division’s (investigations division) program providers on May 9, 2014. We present the results of these use disorder (SUD) services management should take investigators, financial auditors, and medical personnel in reviews on page 14 of this report. 1 Action Step 1† advantage of the recent transition to the California its statewide targeted reviews of Drug Medi‑Cal Treatment Fully implemented Department of Health Care Services (Health Care Program (program) providers. Services) and fully leverage Health Care Services’ support and resources. Health Care Services stated that its investigations division Health Care Services obtained services from Trinity Technology has dedicated significant staff resources to create an elite Group, Inc. on September 6, 2013, to create a data mining tool that 1 strike team to conduct program data mining activities will help it identify patterns and anomalies that suggest potential for Fully Implemented Action Step 2 focused on identifying patterns and anomalies that suggest fraud. Health Care Services stated the data mining tool went live on potential fraud for further investigation. April 6, 2014. Health Care Services stated that it dedicated resources The investigations division completed its limited scope review and 1 to completing the limited scope review of the program to presented its results to the director on November 30, 2013. Fully Implemented Action Step 3 quickly identify significant gaps in the program as a focus of its planning efforts. Health Care Services stated it tasked a cross‑departmental Health Care Services stated it completed an analysis of the program’s team with conducting an analysis of program medically medically necessary assessments conducted by the providers’ necessary assessments performed by the providers’ medical directors. Health Care Services also stated it issued 1 medical directors. information notice 14‑002 on February 7, 2014, as a result of this Fully Implemented Action Step 4 analysis. This information notice reminds county administrators and program providers of the requirements for providing minor consent and school‑based SUD treatment services. Health Care Services stated its Provider Enrollment Health Care Services is in the process of recertifying and performing Division (enrollment division) began recertifying all initial and ongoing certifications for program providers. We discuss 1 program providers in July 2013. The enrollment division the status of its efforts beginning on page 48 of this report. Partially Implemented Action Step 5 will also manage all initial and ongoing certifications moving forward. Health Care Services stated that it plans to reconfigure Health Care Services stated that SUD management met with post‑service post‑payment utilization reviews (utilization the deputy director of its investigations division and the chief reviews) to include (1) adding the investigations division’s of the medical branch to determine the preliminary framework for 1 Medical Review Branch (medical branch) to provide clinical the provider risk assessment model. However, Health Care Services Partially Implemented Action Step 6 expertise, (2) developing a provider risk assessment model will not complete the provider risk assessment model or use the by fall of 2014, and (3) using the investigations division’s investigations division’s help to shape the PSPP unit’s internal help to shape the post‑service post‑payment (PSPP) unit’s control structure until the fall of 2014. internal control structure. To improve the effectiveness of its Provider Registry Health Care Services stated that once the PRIMe system Health Care Services stated that currently all program providers Information Management enterprise (PRIMe) system, SUD is fully operational, it will contain all SUD treatment are in the PRIMe system. The licensing and certification portion management should enhance the PRIMe system to accept programs, including program certifications. The system will of PRIMe was released on June 12, 2014. PRIMe is not capable of all application, compliance, and program information also include Driving Under the Influence (DUI) programs, accepting applications for the DUI programs. In addition, data 2 (deficiencies, corrective action plans, etc.) across all complaints, corrective actions, Patient Protection and from the noneligible provider list(s) from the enrollment division Partially Implemented programs to ensure that the entire universe of data is Affordable Care Act (Affordable Care Act) requirements, and is not in PRIMe; this information is stored in a different database— being tracked and analyzed. Data such as the noneligible noneligible provider lists. Health Care Services also stated Short‑Doyle Medi‑Cal ADP Remediation Technology 6i. provider list(s) from the enrollment division should also be that as of January 10, 2014, all program providers were in incorporated in this effort to the extent feasible. the PRIMe system. To ensure the program providers continue to meet Drug Health Care Services stated its enrollment division began Health Care Services is in the process of recertifying all program Medi-Cal Certification Standards for Substance Abuse Clinics recertifying all program providers in July 2013. Health providers. We discuss the status of its efforts to complete this task (certification standards), Health Care Services should Care Services will conduct the recertification process at and to comply with the federal requirements beginning on page 48 3 Partially implemented implement a full program provider recertification process least once every five years in accordance with the new of this report. at least once every five years in accordance with the new requirements of the Affordable Care Act. requirements of the Affordable Care Act. California State Auditor Report 2013-119 71 August 2014 Table B The Status of Certain Recommendations From the California Department of Health Care Services’ Limited Scope Review of the Drug Medi-Cal Treatment Program IMPLEMENTATION STATUS THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES’ THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES’ PROGRESS AS OF JULY 9, 2014 RECOMMENDATION NUMBER* RECOMMENDATION IMPLEMENTATION PLAN AS OF JANUARY 10, 2014 AS OF JULY 9, 2014 (UNLESS OTHERWISE NOTED) (UNLESS OTHERWISE NOTED) To ensure the successful implementation of remedies Health Care Services stated that it is utilizing the Audits Health Care Services completed the targeted on‑site reviews of for identified gaps and program deficiencies, substance and Investigations Division’s (investigations division) program providers on May 9, 2014. We present the results of these use disorder (SUD) services management should take investigators, financial auditors, and medical personnel in reviews on page 14 of this report. 1 Action Step 1† advantage of the recent transition to the California its statewide targeted reviews of Drug Medi‑Cal Treatment Fully implemented Department of Health Care Services (Health Care Program (program) providers. Services) and fully leverage Health Care Services’ support and resources. Health Care Services stated that its investigations division Health Care Services obtained services from Trinity Technology has dedicated significant staff resources to create an elite Group, Inc. on September 6, 2013, to create a data mining tool that 1 strike team to conduct program data mining activities will help it identify patterns and anomalies that suggest potential for Fully Implemented Action Step 2 focused on identifying patterns and anomalies that suggest fraud. Health Care Services stated the data mining tool went live on potential fraud for further investigation. April 6, 2014. Health Care Services stated that it dedicated resources The investigations division completed its limited scope review and 1 to completing the limited scope review of the program to presented its results to the director on November 30, 2013. Fully Implemented Action Step 3 quickly identify significant gaps in the program as a focus of its planning efforts. Health Care Services stated it tasked a cross‑departmental Health Care Services stated it completed an analysis of the program’s team with conducting an analysis of program medically medically necessary assessments conducted by the providers’ necessary assessments performed by the providers’ medical directors. Health Care Services also stated it issued 1 medical directors. information notice 14‑002 on February 7, 2014, as a result of this Fully Implemented Action Step 4 analysis. This information notice reminds county administrators and program providers of the requirements for providing minor consent and school‑based SUD treatment services. Health Care Services stated its Provider Enrollment Health Care Services is in the process of recertifying and performing Division (enrollment division) began recertifying all initial and ongoing certifications for program providers. We discuss 1 program providers in July 2013. The enrollment division the status of its efforts beginning on page 48 of this report. Partially Implemented Action Step 5 will also manage all initial and ongoing certifications moving forward. Health Care Services stated that it plans to reconfigure Health Care Services stated that SUD management met with post‑service post‑payment utilization reviews (utilization the deputy director of its investigations division and the chief reviews) to include (1) adding the investigations division’s of the medical branch to determine the preliminary framework for 1 Medical Review Branch (medical branch) to provide clinical the provider risk assessment model. However, Health Care Services Partially Implemented Action Step 6 expertise, (2) developing a provider risk assessment model will not complete the provider risk assessment model or use the by fall of 2014, and (3) using the investigations division’s investigations division’s help to shape the PSPP unit’s internal help to shape the post‑service post‑payment (PSPP) unit’s control structure until the fall of 2014. internal control structure. To improve the effectiveness of its Provider Registry Health Care Services stated that once the PRIMe system Health Care Services stated that currently all program providers Information Management enterprise (PRIMe) system, SUD is fully operational, it will contain all SUD treatment are in the PRIMe system. The licensing and certification portion management should enhance the PRIMe system to accept programs, including program certifications. The system will of PRIMe was released on June 12, 2014. PRIMe is not capable of all application, compliance, and program information also include Driving Under the Influence (DUI) programs, accepting applications for the DUI programs. In addition, data 2 (deficiencies, corrective action plans, etc.) across all complaints, corrective actions, Patient Protection and from the noneligible provider list(s) from the enrollment division Partially Implemented programs to ensure that the entire universe of data is Affordable Care Act (Affordable Care Act) requirements, and is not in PRIMe; this information is stored in a different database— being tracked and analyzed. Data such as the noneligible noneligible provider lists. Health Care Services also stated Short‑Doyle Medi‑Cal ADP Remediation Technology 6i. provider list(s) from the enrollment division should also be that as of January 10, 2014, all program providers were in incorporated in this effort to the extent feasible. the PRIMe system. To ensure the program providers continue to meet Drug Health Care Services stated its enrollment division began Health Care Services is in the process of recertifying all program Medi-Cal Certification Standards for Substance Abuse Clinics recertifying all program providers in July 2013. Health providers. We discuss the status of its efforts to complete this task (certification standards), Health Care Services should Care Services will conduct the recertification process at and to comply with the federal requirements beginning on page 48 3 Partially implemented implement a full program provider recertification process least once every five years in accordance with the new of this report. at least once every five years in accordance with the new requirements of the Affordable Care Act. requirements of the Affordable Care Act. continued on next page . . . 72 California State Auditor Report 2013-119 August 2014 IMPLEMENTATION STATUS THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES’ THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES’ PROGRESS AS OF JULY 9, 2014 RECOMMENDATION NUMBER* RECOMMENDATION IMPLEMENTATION PLAN AS OF JANUARY 10, 2014 AS OF JULY 9, 2014 (UNLESS OTHERWISE NOTED) (UNLESS OTHERWISE NOTED) To ensure that only qualified and legally compliant Health Care Services stated it will clarify the responsibilities On June 25, 2014, Health Care Services used its emergency providers are authorized to participate in the program, of program providers, medical directors, and other provider regulatory authority to amend Title 22 of the California Code of Health Care Services should strengthen its program personnel as part of a regulatory revision package aimed Regulations to clarify the responsibilities of program providers and certification standards, with a specific focus on the at improving the integrity of the program. Health Care other provider personnel. Health Care Services is in the process 4 responsibilities and performance measures of the facility Services stated it would begin engaging stakeholders in of aligning program certification standards with the enrollment Partially Implemented medical director and other provider personnel. discussions that focus on proposed changes to the program requirements for the Medi‑Cal fee‑for‑service providers and is in January 2014. in the process of drafting regulatory changes to accomplish this alignment. Health Care Services anticipates implementing the new requirements by mid‑year 2015. To reduce the risk of fraud, waste, and abuse, Health Care Health Care Services stated that it would need to further Health Care Services stated it has concerns regarding this Services should limit the number of program providers at evaluate the impact of having one entity with provider recommendation as written and will need to further evaluate the 5 Not Implemented one physical location or address to a single provider. certifications at one physical location because it has not impact of this recommendation. found this to be a program integrity issue. To streamline the recertification process and take advantage Health Care Services stated its enrollment division began Health Care Services stated that its enrollment division assumed of Health Care Services’ strict provider enrollment standards, recertifying all program providers in July 2013. The responsibility of all program certifications as of January 1, 2014. Health Care Services should consider formally aligning the enrollment division will also manage all initial and ongoing Health Care Services also stated that the enrollment division program certification process with policies and procedures certifications moving forward. Health Care Services stated will complete its alignment of the program certification process 6 Partially Implemented utilized by the enrollment division for enrollment of that through the recertification process, the enrollment with the Medi‑Cal fee‑for‑service provider enrollment process by Medi‑Cal fee‑for‑service providers. division is learning program policies and procedures mid‑year 2015. and beginning to align the certification process with the Medi‑Cal fee‑for‑service provider enrollment process. To comply with the federal Centers for Medicare and Health Care Services stated that the enrollment division will Health Care Services stated that as part of its recertification process Medicaid Services’ (CMS) policy regarding the screening of conduct monthly checks against the Medicare database for program providers, enrollment division checks the provider’s excluded providers, Health Care Services should conduct to identify exclusions and reinstatements of existing status against these databases. Health Care Services also stated that, monthly checks against the Medicare Exclusion Database program providers. once it completes the recertification process, the enrollment division 7 (Medicare database) or the federal Office of the Inspector will conduct monthly checks against these databases. We discuss the Partially Implemented General’s (Inspector General) List of Excluded Individuals/ status of the enrollment division’s recertification efforts beginning Entities database to identify exclusions and reinstatements on page 48 and the status of its database searches on page 41 of of existing program providers. All identified excluded this report. providers should be suspended from the program. To enhance program integrity and decrease the risk of fraud, Health Care Services stated it will decertify providers that Health Care Services stated that, as of March 2014, it sent letters to waste, and abuse, Health Care Services should decertify all have not billed the program for more than 12 months. The 602 program‑certified sites that had not billed the program for more 8 providers that have not billed the program for more than department stated it notified all program providers of this than 12 months to notify them of their removal from the Master Fully implemented 12 months. Recertification should then be required if the forthcoming decertification process. Provider File. Health Care Services reported that it deactivated 321 provider wishes to resume participation in the program. of these sites. To enhance program integrity, Health Care Services should Health Care Services stated it will amend its two‑year Health Care Services stated that the fiscal year 2014–15 State‑county establish ongoing and periodic program compliance State‑county contract that covers fiscal years 2014–15 contract is not final because it has been working with counties in monitoring activities for the program. The monitoring and 2015–16 to increase county monitoring of program obtaining feedback on the draft contract provisions. Health Care activities should be coordinated with utilization reviews and providers. In addition, Health Care Services stated it Services expects to finalize the contract in August 2014. Further, it 9† other Health Care Services‑conducted county monitoring is developing a provider risk assessment model for its will not complete the provider risk assessment model until the fall Not Implemented activities to ensure that program certification standards are utilization reviews, which it expects to be complete by fall of 2014. complied with. In addition, consider enhanced/expanded of 2014. roles for counties in the monitoring efforts. State/county collaboration needs to be strengthened to avoid duplication and maximize enforcement capacity. To increase the effectiveness and efficiency of program Health Care Services stated it will coordinate its SUD Health Care Services stated that it held several meetings between integrity efforts, program monitoring should be fully monitoring efforts (alcohol and other drug program, April 1, 2014, and July 7, 2014, to discuss the implementation of a coordinated with the biennial alcohol and other drug Narcotic Treatment Program, and the program) through tool to coordinate its SUD monitoring efforts. Health Care Services program, annual Narcotic Treatment Program, and local development of efficient communication methods/ finalized its monitoring tool on July 7, 2014. 11† county‑conducted monitoring activities. There should formats and twice yearly meetings with all field units. Fully Implemented also be full data sharing between all parties to ensure SUD management will coordinate alcohol and other drug that identified compliance issues are fully communicated program, Narcotic Treatment Program, and program site to avoid duplicating efforts and executing the various visits to ensure better monitoring of the program. monitoring and auditing activities in a vacuum. California State Auditor Report 2013-119 73 August 2014 IMPLEMENTATION STATUS THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES’ THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES’ PROGRESS AS OF JULY 9, 2014 RECOMMENDATION NUMBER* RECOMMENDATION IMPLEMENTATION PLAN AS OF JANUARY 10, 2014 AS OF JULY 9, 2014 (UNLESS OTHERWISE NOTED) (UNLESS OTHERWISE NOTED) To ensure that only qualified and legally compliant Health Care Services stated it will clarify the responsibilities On June 25, 2014, Health Care Services used its emergency providers are authorized to participate in the program, of program providers, medical directors, and other provider regulatory authority to amend Title 22 of the California Code of Health Care Services should strengthen its program personnel as part of a regulatory revision package aimed Regulations to clarify the responsibilities of program providers and certification standards, with a specific focus on the at improving the integrity of the program. Health Care other provider personnel. Health Care Services is in the process 4 responsibilities and performance measures of the facility Services stated it would begin engaging stakeholders in of aligning program certification standards with the enrollment Partially Implemented medical director and other provider personnel. discussions that focus on proposed changes to the program requirements for the Medi‑Cal fee‑for‑service providers and is in January 2014. in the process of drafting regulatory changes to accomplish this alignment. Health Care Services anticipates implementing the new requirements by mid‑year 2015. To reduce the risk of fraud, waste, and abuse, Health Care Health Care Services stated that it would need to further Health Care Services stated it has concerns regarding this Services should limit the number of program providers at evaluate the impact of having one entity with provider recommendation as written and will need to further evaluate the 5 Not Implemented one physical location or address to a single provider. certifications at one physical location because it has not impact of this recommendation. found this to be a program integrity issue. To streamline the recertification process and take advantage Health Care Services stated its enrollment division began Health Care Services stated that its enrollment division assumed of Health Care Services’ strict provider enrollment standards, recertifying all program providers in July 2013. The responsibility of all program certifications as of January 1, 2014. Health Care Services should consider formally aligning the enrollment division will also manage all initial and ongoing Health Care Services also stated that the enrollment division program certification process with policies and procedures certifications moving forward. Health Care Services stated will complete its alignment of the program certification process 6 Partially Implemented utilized by the enrollment division for enrollment of that through the recertification process, the enrollment with the Medi‑Cal fee‑for‑service provider enrollment process by Medi‑Cal fee‑for‑service providers. division is learning program policies and procedures mid‑year 2015. and beginning to align the certification process with the Medi‑Cal fee‑for‑service provider enrollment process. To comply with the federal Centers for Medicare and Health Care Services stated that the enrollment division will Health Care Services stated that as part of its recertification process Medicaid Services’ (CMS) policy regarding the screening of conduct monthly checks against the Medicare database for program providers, enrollment division checks the provider’s excluded providers, Health Care Services should conduct to identify exclusions and reinstatements of existing status against these databases. Health Care Services also stated that, monthly checks against the Medicare Exclusion Database program providers. once it completes the recertification process, the enrollment division 7 (Medicare database) or the federal Office of the Inspector will conduct monthly checks against these databases. We discuss the Partially Implemented General’s (Inspector General) List of Excluded Individuals/ status of the enrollment division’s recertification efforts beginning Entities database to identify exclusions and reinstatements on page 48 and the status of its database searches on page 41 of of existing program providers. All identified excluded this report. providers should be suspended from the program. To enhance program integrity and decrease the risk of fraud, Health Care Services stated it will decertify providers that Health Care Services stated that, as of March 2014, it sent letters to waste, and abuse, Health Care Services should decertify all have not billed the program for more than 12 months. The 602 program‑certified sites that had not billed the program for more 8 providers that have not billed the program for more than department stated it notified all program providers of this than 12 months to notify them of their removal from the Master Fully implemented 12 months. Recertification should then be required if the forthcoming decertification process. Provider File. Health Care Services reported that it deactivated 321 provider wishes to resume participation in the program. of these sites. To enhance program integrity, Health Care Services should Health Care Services stated it will amend its two‑year Health Care Services stated that the fiscal year 2014–15 State‑county establish ongoing and periodic program compliance State‑county contract that covers fiscal years 2014–15 contract is not final because it has been working with counties in monitoring activities for the program. The monitoring and 2015–16 to increase county monitoring of program obtaining feedback on the draft contract provisions. Health Care activities should be coordinated with utilization reviews and providers. In addition, Health Care Services stated it Services expects to finalize the contract in August 2014. Further, it 9† other Health Care Services‑conducted county monitoring is developing a provider risk assessment model for its will not complete the provider risk assessment model until the fall Not Implemented activities to ensure that program certification standards are utilization reviews, which it expects to be complete by fall of 2014. complied with. In addition, consider enhanced/expanded of 2014. roles for counties in the monitoring efforts. State/county collaboration needs to be strengthened to avoid duplication and maximize enforcement capacity. To increase the effectiveness and efficiency of program Health Care Services stated it will coordinate its SUD Health Care Services stated that it held several meetings between integrity efforts, program monitoring should be fully monitoring efforts (alcohol and other drug program, April 1, 2014, and July 7, 2014, to discuss the implementation of a coordinated with the biennial alcohol and other drug Narcotic Treatment Program, and the program) through tool to coordinate its SUD monitoring efforts. Health Care Services program, annual Narcotic Treatment Program, and local development of efficient communication methods/ finalized its monitoring tool on July 7, 2014. 11† county‑conducted monitoring activities. There should formats and twice yearly meetings with all field units. Fully Implemented also be full data sharing between all parties to ensure SUD management will coordinate alcohol and other drug that identified compliance issues are fully communicated program, Narcotic Treatment Program, and program site to avoid duplicating efforts and executing the various visits to ensure better monitoring of the program. monitoring and auditing activities in a vacuum. continued on next page . . . 74 California State Auditor Report 2013-119 August 2014 IMPLEMENTATION STATUS THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES’ THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES’ PROGRESS AS OF JULY 9, 2014 RECOMMENDATION NUMBER* RECOMMENDATION IMPLEMENTATION PLAN AS OF JANUARY 10, 2014 AS OF JULY 9, 2014 (UNLESS OTHERWISE NOTED) (UNLESS OTHERWISE NOTED) To ensure activities are coordinated and staff are Health Care Services stated that SUD management provided SUD management provided its staff with cross‑training on knowledgeable about the various program integrity extensive cross‑training to staff from multiple units July 14, 2014. efforts and objectives across the entire SUD program, SUD participating in the program targeted reviews. In addition, 12† management should provide internal cross‑training on SUD management will continue to provide cross‑training to Fully Implemented the topics of alcohol and other drug monitoring, Narcotic staff over the next 12 months, with the goal of increasing Treatment Program monitoring, program monitoring, and the effectiveness of their ability to identify issues for referral utilization reviews. to other units. To increase program integrity and decrease the risk of fraud, Health Care Services stated it will clarify the responsibilities On June 25, 2014, Health Care Services used its emergency waste, and abuse in the program, Health Care Services of program medical directors as part of a regulatory revision regulatory authority to amend Title 22 of the California Code of should consider revisions to Title 22 of the California Code of package aimed at improving the integrity of the program. Regulations to clarify the provider’s role and responsibilities as they Regulations specific to the physician/medical director’s role Health Care Services stated it would begin engaging relate to beneficiary contact and involvement in patient care. 13 Fully Implemented and responsibilities as they relate to beneficiary contact and stakeholders in discussions that focus on proposed changes involvement in patient care. Consultation from appropriate to the program in January 2014. clinical personnel should be obtained to determine what those standards should be. To ensure counties are not overpaid due to inflated Health Care Services stated it will analyze the current county Health Care Services stated it has not begun this process because base rate, Health Care Services should work with the allocation formula and will work with Finance to assess how either it has not completed all of the reviews or the cases are California Department of Finance (Finance) to ensure that it should adjust the formula. pending the final disposition from the California Department 14 Not Implemented adjustments are made to back out identified fraudulent of Justice. billings or false claims from existing levels of service in developing county allocation schedules. To ensure appropriate investigation and fraud referral by the Health Care Services stated that its complaints unit within Health Care Services stated the PSPP unit maintains a complaint PSPP unit to the appropriate law enforcement authorities, SUD’s compliance division will forward complaints to the log to track the status of program complaints. The complaints are the complaint intake function should be segregated from PSPP unit within SUD’s prevention, treatment, and recovery sent to the PSPP unit supervisor who assigns the complaints to personnel responsible for deciding whether an investigation division. The PSPP unit will review and refer complaints to staff for follow up and referral to the investigations division. Health and fraud referral to law enforcement is warranted. the investigations division for preliminary investigation. Care Services stated the PSPP unit will not finalize the reporting 15† Health Care Services expects this referral process to be mechanism until September 2014 because it is still in the process Partially Implemented complete by mid‑2014. Health Care Services stated the of drafting its complaint and fraud referral procedures, and the PSPP unit will also establish a mechanism to regularly procedures will undergo an internal review in August 2014. report to the investigations division and SUD management the referrals it receives, the referral outcomes, and the basis of the outcomes. To effectively implement program provider monitoring as Health Care Services stated that its county monitoring Health Care Services stated that the county monitoring unit began stated in recommendation number 11, SUD management unit within SUD’s compliance division will have the monitoring the State‑county contracts in February 2014. However, should clearly delineate program utilization review primary responsibility to monitor counties’ adherence to as we discuss on page 55 of this report, Health Care Services is not requirements from the program monitoring requirements. the State‑county contracts and to ensure that the State conducting monitoring of the program providers’ compliance with 16† Once completed, SUD management should identify the and counties are monitoring the providers appropriately. certification and treatment standards. Partially Implemented SUD unit best suited to assume responsibility for ongoing Health Care Services stated the county monitoring unit will program monitoring. If there are inadequate personnel recommend any changes needed to ensure it can meet resources to address monitoring responsibilities, SUD these responsibilities. management should pursue additional resources and request the needed positions. To increase the effectiveness of the PSPP unit, SUD The PSPP unit within SUD will partner with the Health Care Services stated that SUD management met with management should enhance/increase clinical expertise investigations division’s medical branch as part of its the deputy director of its investigations division and the chief 17† and capacity within the unit. SUD management should utilization review process. Health Care Services expects to of the medical branch to determine the preliminary framework for Partially Implemented also consider leveraging the investigations division’s implement this process in the fall of 2014. the provider risk assessment model. However, Health Care Services clinical resources and expertise to assist with aspects of its will not complete the provider risk assessment model until the fall utilization reviews. of 2014. In light of the 2011 realignment, Health Care Services Health Care Services stated it will amend its two‑year State‑ Health Care Services stated that the fiscal year 2014 –15 State‑county should determine what enhanced role the counties might county contract that covers fiscal years 2014–15 and contract is not final because it has been working with counties in play regarding future utilization reviews. Once determined, 2015–16 to require counties to monitor program providers obtaining feedback on the draft contract provisions. Health Care Health Care Services should amend the State‑county so that (1) beneficiaries receive the necessary services, Services expects to finalize the contract in August 2014. 18 contract to reflect the modified roles and responsibilities. (2) providers correct all deficiencies identified by the State Not Implemented within the prescribed time frames, (3) provider complaints are submitted to the State, (4) the county shares the results of its provider audits with the State, and (5) counties review and verify claims before submitting them to the State. California State Auditor Report 2013-119 75 August 2014 IMPLEMENTATION STATUS THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES’ THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES’ PROGRESS AS OF JULY 9, 2014 RECOMMENDATION NUMBER* RECOMMENDATION IMPLEMENTATION PLAN AS OF JANUARY 10, 2014 AS OF JULY 9, 2014 (UNLESS OTHERWISE NOTED) (UNLESS OTHERWISE NOTED) To ensure activities are coordinated and staff are Health Care Services stated that SUD management provided SUD management provided its staff with cross‑training on knowledgeable about the various program integrity extensive cross‑training to staff from multiple units July 14, 2014. efforts and objectives across the entire SUD program, SUD participating in the program targeted reviews. In addition, 12† management should provide internal cross‑training on SUD management will continue to provide cross‑training to Fully Implemented the topics of alcohol and other drug monitoring, Narcotic staff over the next 12 months, with the goal of increasing Treatment Program monitoring, program monitoring, and the effectiveness of their ability to identify issues for referral utilization reviews. to other units. To increase program integrity and decrease the risk of fraud, Health Care Services stated it will clarify the responsibilities On June 25, 2014, Health Care Services used its emergency waste, and abuse in the program, Health Care Services of program medical directors as part of a regulatory revision regulatory authority to amend Title 22 of the California Code of should consider revisions to Title 22 of the California Code of package aimed at improving the integrity of the program. Regulations to clarify the provider’s role and responsibilities as they Regulations specific to the physician/medical director’s role Health Care Services stated it would begin engaging relate to beneficiary contact and involvement in patient care. 13 Fully Implemented and responsibilities as they relate to beneficiary contact and stakeholders in discussions that focus on proposed changes involvement in patient care. Consultation from appropriate to the program in January 2014. clinical personnel should be obtained to determine what those standards should be. To ensure counties are not overpaid due to inflated Health Care Services stated it will analyze the current county Health Care Services stated it has not begun this process because base rate, Health Care Services should work with the allocation formula and will work with Finance to assess how either it has not completed all of the reviews or the cases are California Department of Finance (Finance) to ensure that it should adjust the formula. pending the final disposition from the California Department 14 Not Implemented adjustments are made to back out identified fraudulent of Justice. billings or false claims from existing levels of service in developing county allocation schedules. To ensure appropriate investigation and fraud referral by the Health Care Services stated that its complaints unit within Health Care Services stated the PSPP unit maintains a complaint PSPP unit to the appropriate law enforcement authorities, SUD’s compliance division will forward complaints to the log to track the status of program complaints. The complaints are the complaint intake function should be segregated from PSPP unit within SUD’s prevention, treatment, and recovery sent to the PSPP unit supervisor who assigns the complaints to personnel responsible for deciding whether an investigation division. The PSPP unit will review and refer complaints to staff for follow up and referral to the investigations division. Health and fraud referral to law enforcement is warranted. the investigations division for preliminary investigation. Care Services stated the PSPP unit will not finalize the reporting 15† Health Care Services expects this referral process to be mechanism until September 2014 because it is still in the process Partially Implemented complete by mid‑2014. Health Care Services stated the of drafting its complaint and fraud referral procedures, and the PSPP unit will also establish a mechanism to regularly procedures will undergo an internal review in August 2014. report to the investigations division and SUD management the referrals it receives, the referral outcomes, and the basis of the outcomes. To effectively implement program provider monitoring as Health Care Services stated that its county monitoring Health Care Services stated that the county monitoring unit began stated in recommendation number 11, SUD management unit within SUD’s compliance division will have the monitoring the State‑county contracts in February 2014. However, should clearly delineate program utilization review primary responsibility to monitor counties’ adherence to as we discuss on page 55 of this report, Health Care Services is not requirements from the program monitoring requirements. the State‑county contracts and to ensure that the State conducting monitoring of the program providers’ compliance with 16† Once completed, SUD management should identify the and counties are monitoring the providers appropriately. certification and treatment standards. Partially Implemented SUD unit best suited to assume responsibility for ongoing Health Care Services stated the county monitoring unit will program monitoring. If there are inadequate personnel recommend any changes needed to ensure it can meet resources to address monitoring responsibilities, SUD these responsibilities. management should pursue additional resources and request the needed positions. To increase the effectiveness of the PSPP unit, SUD The PSPP unit within SUD will partner with the Health Care Services stated that SUD management met with management should enhance/increase clinical expertise investigations division’s medical branch as part of its the deputy director of its investigations division and the chief 17† and capacity within the unit. SUD management should utilization review process. Health Care Services expects to of the medical branch to determine the preliminary framework for Partially Implemented also consider leveraging the investigations division’s implement this process in the fall of 2014. the provider risk assessment model. However, Health Care Services clinical resources and expertise to assist with aspects of its will not complete the provider risk assessment model until the fall utilization reviews. of 2014. In light of the 2011 realignment, Health Care Services Health Care Services stated it will amend its two‑year State‑ Health Care Services stated that the fiscal year 2014 –15 State‑county should determine what enhanced role the counties might county contract that covers fiscal years 2014–15 and contract is not final because it has been working with counties in play regarding future utilization reviews. Once determined, 2015–16 to require counties to monitor program providers obtaining feedback on the draft contract provisions. Health Care Health Care Services should amend the State‑county so that (1) beneficiaries receive the necessary services, Services expects to finalize the contract in August 2014. 18 contract to reflect the modified roles and responsibilities. (2) providers correct all deficiencies identified by the State Not Implemented within the prescribed time frames, (3) provider complaints are submitted to the State, (4) the county shares the results of its provider audits with the State, and (5) counties review and verify claims before submitting them to the State. continued on next page . . . 76 California State Auditor Report 2013-119 August 2014 IMPLEMENTATION STATUS THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES’ THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES’ PROGRESS AS OF JULY 9, 2014 RECOMMENDATION NUMBER* RECOMMENDATION IMPLEMENTATION PLAN AS OF JANUARY 10, 2014 AS OF JULY 9, 2014 (UNLESS OTHERWISE NOTED) (UNLESS OTHERWISE NOTED) To increase the effectiveness of utilization reviews, SUD Health Care Services stated that the core training program Health Care Services stated that SUD management developed some management should build and implement a comprehensive for the PSPP unit will be expanded over the next 12 months training materials on medical necessity and conducted the training 19 core training program for PSPP unit staff. to include appropriate cross‑training with other Health Care on May 20, 2014. Fully Implemented Services’ divisions and training on medical necessity and youth treatment specific to program services. To enhance the value of utilization reviews, SUD Health Care Services stated it will develop a program Health Care Services stated that SUD management met with management should modify its approach by discontinuing provider risk assessment model for the PSPP unit to use as the deputy director of its investigations division and the chief its practice of reviewing all providers based upon a cycle a method of selecting providers for utilization reviews and of the medical branch to determine the preliminary framework (once every three years). Instead, reviews should be engaging the investigations division’s medical branch’s for the provider risk assessment model. However, it will not 20† prioritized based upon high‑risk and high‑dollar providers clinical staff in conducting reviews of certain providers. complete the provider risk assessment model until the fall of 2014. Partially Implemented as identified via analysis of paid claims data and other Health Care Services expects to implement this model in the analysis of provider activity data. Consultation with the fall of 2014. investigations division’s medical branch is advised to implement the necessary structure and practices for effective data mining and case development. To deter fraud, waste, and abuse by program providers, SUD Health Care Services stated that instead of implementing SUD management stated it has concerns regarding its legal management should explore the feasibility of increasing this recommendation, it will use its existing authority authority to implement this recommendation as written. Health the use of statistical extrapolation in its utilization to seek reimbursement for disallowed claims from the Care Services held a meeting on July 25, 2014, to discuss this reviews to increase the potential for recovery of identified counties, which in turn will seek reimbursement from recommendation and assign its Office of Legal Services the 21 Not Implemented overpayments and the positive effect this might have the providers. responsibility of determining whether it has the authority to use on provider compliance with program standards, laws, a statistical extrapolation methodology to compute recovery and regulations. amounts. However, Health Care Services has not made its final determination. To increase program integrity, Health Care Services should Health Care Services stated it will amend the two‑year Health Care Services stated that the fiscal year 2014‑15 State‑county explore the feasibility of placing more expectations on the State‑county contract that covers fiscal years 2014 –15 and contract is not final because it has been working with counties in counties, including fines, if necessary, to notify Health Care 2015–16 to require counties to notify the State when a obtaining feedback on the draft contract provisions. Health Care 22 Not Implemented Services when the county becomes aware that a contractor contractor closes its program. Health Care Services stated Services expects to finalize the contract in August 2014. is closing its program or has become defunct. it will then monitor compliance with this requirement through the annual county monitoring review process. To ensure program integrity, SUD management and Health Care Services stated it will revise its financial Health Care Services stated it updated its financial audit program staff should monitor and follow up on all audit report routing and other processes to apprise SUD report routing protocol to keep SUD management apprised of significant audit findings, especially those that are unusual management and program staff of issues for follow up. program issues requiring follow up in June 2014. In addition, 23† in nature, material in dollar amounts, or may lead to the investigations division and SUD management will meet twice a Partially Implemented financial and/or legal exposure to Health Care Services. year to discuss the status of significant audit findings and the associated corrective action plans. The investigations division and SUD management will memorialize its agreements in writing by the fall of 2014. To ensure the integrity of past utilization reviews, SUD Health Care Services stated that SUD management Health Care Services stated that SUD management met with management should perform a cursory assessment of past performed a cursory review of prior utilization review the deputy director of its investigations division and the chief reviews for reasonableness, accuracy, and completeness. reports and found one or two staff had conducted a high of the medical branch to determine the preliminary framework 26† Any identified anomalies or red flags should be investigated percentage of the reviews that found no deficiencies. Health for the provider risk assessment model. However, it will not Partially Implemented and addressed as necessary. Care Services stated that over the next 12 months the SUD complete the provider risk assessment model until the fall of 2014. management will incorporate “reviews of those providers that did not receive deficiencies during their last utilization review” as a selection criterion in the risk assessment model. To ensure the integrity and effectiveness of its organization, Health Care Services stated that the SUD management The SUD management team will continue to monitor and SUD management should work diligently to improve its team has and will continue to implement controls to ensure implement changes to ensure that there are proper internal controls. internal control structure. the effectiveness of the organization as well as improve SUD management will continue to work with the investigations the internal control structure. Health Care Services also division for technical assistance. Health Care Services is still in the stated that the PSPP unit has been working closely with the process of drafting its complaint and fraud referral procedures, and 27 Partially Implemented investigations division to ensure program integrity and to the procedures will undergo an internal review in August 2014. provide internal checks and balances for program functions. In addition, until the completion of the provider risk assessment model in the fall of 2014, the investigations division is selecting the providers for the PSPP unit to review based on their investigator input and data mining activities. California State Auditor Report 2013-119 77 August 2014 IMPLEMENTATION STATUS THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES’ THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES’ PROGRESS AS OF JULY 9, 2014 RECOMMENDATION NUMBER* RECOMMENDATION IMPLEMENTATION PLAN AS OF JANUARY 10, 2014 AS OF JULY 9, 2014 (UNLESS OTHERWISE NOTED) (UNLESS OTHERWISE NOTED) To increase the effectiveness of utilization reviews, SUD Health Care Services stated that the core training program Health Care Services stated that SUD management developed some management should build and implement a comprehensive for the PSPP unit will be expanded over the next 12 months training materials on medical necessity and conducted the training 19 core training program for PSPP unit staff. to include appropriate cross‑training with other Health Care on May 20, 2014. Fully Implemented Services’ divisions and training on medical necessity and youth treatment specific to program services. To enhance the value of utilization reviews, SUD Health Care Services stated it will develop a program Health Care Services stated that SUD management met with management should modify its approach by discontinuing provider risk assessment model for the PSPP unit to use as the deputy director of its investigations division and the chief its practice of reviewing all providers based upon a cycle a method of selecting providers for utilization reviews and of the medical branch to determine the preliminary framework (once every three years). Instead, reviews should be engaging the investigations division’s medical branch’s for the provider risk assessment model. However, it will not 20† prioritized based upon high‑risk and high‑dollar providers clinical staff in conducting reviews of certain providers. complete the provider risk assessment model until the fall of 2014. Partially Implemented as identified via analysis of paid claims data and other Health Care Services expects to implement this model in the analysis of provider activity data. Consultation with the fall of 2014. investigations division’s medical branch is advised to implement the necessary structure and practices for effective data mining and case development. To deter fraud, waste, and abuse by program providers, SUD Health Care Services stated that instead of implementing SUD management stated it has concerns regarding its legal management should explore the feasibility of increasing this recommendation, it will use its existing authority authority to implement this recommendation as written. Health the use of statistical extrapolation in its utilization to seek reimbursement for disallowed claims from the Care Services held a meeting on July 25, 2014, to discuss this reviews to increase the potential for recovery of identified counties, which in turn will seek reimbursement from recommendation and assign its Office of Legal Services the 21 Not Implemented overpayments and the positive effect this might have the providers. responsibility of determining whether it has the authority to use on provider compliance with program standards, laws, a statistical extrapolation methodology to compute recovery and regulations. amounts. However, Health Care Services has not made its final determination. To increase program integrity, Health Care Services should Health Care Services stated it will amend the two‑year Health Care Services stated that the fiscal year 2014‑15 State‑county explore the feasibility of placing more expectations on the State‑county contract that covers fiscal years 2014 –15 and contract is not final because it has been working with counties in counties, including fines, if necessary, to notify Health Care 2015–16 to require counties to notify the State when a obtaining feedback on the draft contract provisions. Health Care 22 Not Implemented Services when the county becomes aware that a contractor contractor closes its program. Health Care Services stated Services expects to finalize the contract in August 2014. is closing its program or has become defunct. it will then monitor compliance with this requirement through the annual county monitoring review process. To ensure program integrity, SUD management and Health Care Services stated it will revise its financial Health Care Services stated it updated its financial audit program staff should monitor and follow up on all audit report routing and other processes to apprise SUD report routing protocol to keep SUD management apprised of significant audit findings, especially those that are unusual management and program staff of issues for follow up. program issues requiring follow up in June 2014. In addition, 23† in nature, material in dollar amounts, or may lead to the investigations division and SUD management will meet twice a Partially Implemented financial and/or legal exposure to Health Care Services. year to discuss the status of significant audit findings and the associated corrective action plans. The investigations division and SUD management will memorialize its agreements in writing by the fall of 2014. To ensure the integrity of past utilization reviews, SUD Health Care Services stated that SUD management Health Care Services stated that SUD management met with management should perform a cursory assessment of past performed a cursory review of prior utilization review the deputy director of its investigations division and the chief reviews for reasonableness, accuracy, and completeness. reports and found one or two staff had conducted a high of the medical branch to determine the preliminary framework 26† Any identified anomalies or red flags should be investigated percentage of the reviews that found no deficiencies. Health for the provider risk assessment model. However, it will not Partially Implemented and addressed as necessary. Care Services stated that over the next 12 months the SUD complete the provider risk assessment model until the fall of 2014. management will incorporate “reviews of those providers that did not receive deficiencies during their last utilization review” as a selection criterion in the risk assessment model. To ensure the integrity and effectiveness of its organization, Health Care Services stated that the SUD management The SUD management team will continue to monitor and SUD management should work diligently to improve its team has and will continue to implement controls to ensure implement changes to ensure that there are proper internal controls. internal control structure. the effectiveness of the organization as well as improve SUD management will continue to work with the investigations the internal control structure. Health Care Services also division for technical assistance. Health Care Services is still in the stated that the PSPP unit has been working closely with the process of drafting its complaint and fraud referral procedures, and 27 Partially Implemented investigations division to ensure program integrity and to the procedures will undergo an internal review in August 2014. provide internal checks and balances for program functions. In addition, until the completion of the provider risk assessment model in the fall of 2014, the investigations division is selecting the providers for the PSPP unit to review based on their investigator input and data mining activities. continued on next page . . . 78 California State Auditor Report 2013-119 August 2014 IMPLEMENTATION STATUS THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES’ THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES’ PROGRESS AS OF JULY 9, 2014 RECOMMENDATION NUMBER* RECOMMENDATION IMPLEMENTATION PLAN AS OF JANUARY 10, 2014 AS OF JULY 9, 2014 (UNLESS OTHERWISE NOTED) (UNLESS OTHERWISE NOTED) To ensure all complaints received within the SUD program Health Care Services stated its complaints unit within SUD’s Health Care Services stated the PSPP unit maintains a complaint log are being addressed by the appropriate unit and in a timely compliance division will forward complaints to the PSPP to track the status of program complaints. The complaints are sent fashion, the SUD complaint unit and PSPP unit should unit within SUD’s prevention, treatment, and recovery to the PSPP unit supervisor who assigns the complaints to staff for coordinate their efforts and compare their complaint log division. The PSPP unit will review and refer complaints to follow‑up and referral to the investigations division. Health Care details on a regular basis. the investigations division for preliminary investigation. Services stated that the PSPP unit will not finalize the reporting 28† Health Care Services expects this referral process to be mechanism until September 2014 because it is still in the process Partially Implemented complete by mid‑2014. Health Care Services stated the of drafting its complaint and fraud referral procedures, and the PSPP unit will also establish a mechanism to regularly procedures will undergo an internal review in August 2014. report to the investigations division and SUD management the referrals it receives, the referral outcomes, and the basis of the outcomes. To ensure the effectiveness of all future program fraud Health Care Services stated that SUD management has Health Care Services stated that the SUD management has not investigations, the investigations division’s management worked with certain staff in the investigations division to provided any additional training to the investigations division since should collaborate with SUD management to provide provide training and guidance since the summer of 2013. December 2013 because there has not been an expressed need. detailed and ongoing program training to the investigators Health Care Services gave examples of trainings that took and other staff that may be responsible for future place in the fall of 2013, such as the statewide training SUD investigations, audits, and reviews of program activity management provided to the investigations division staff 29† and providers. on general program requirements. Health Care Services Fully Implemented also stated that SUD management and the investigations division will continue to work closely to assure the investigations division’s ongoing success when performing audits and reviews of program activity and providers. These efforts will be ongoing as needed and requested by the investigations division. To ensure that all program recoveries and offsets are Health Care Services stated it will develop a process to Health Care Services has since determined that no action is adequately tracked, SUD’s Financial Management and enhance communications and develop a tracking system for required for this recommendation because the CORE (CALSTARS 30† Accountability Branch should work with Health Care program recoveries and offsets. Online Reporting Environment) is in place and can track payments, Fully implemented Services’ Accounting Office to develop a process to enhance recoveries, and offsets. communications and develop a tracking system for these recoveries and offsets. To ensure that provider records, including client/beneficiary Health Care Services stated that instead of implementing Health Care Services stated that the fiscal year 2014–15 State‑county files, are adequately preserved, SUD management should this recommendation, SUD management will work with contract is not final because it has been working with counties in 31 work with the counties and direct providers to develop counties and those providers that contract directly with obtaining feedback on the draft contract provisions. Health Care Not Implemented a process to retrieve and secure relevant records after a the State to take possession of the files once the program is Services expects to finalize the contract in August 2014. provider is sanctioned. closed and the contract is terminated. To increase program integrity, Health Care Services Health Care Services stated it is developing a regulatory On June 25, 2014, Health Care Services used its emergency should explore options to strengthen existing regulations revision package to increase the integrity of the program. regulatory authority to amend Title 22 of the California Code associated with medical necessity, age‑appropriate services, The package will include (1) greater specificity on how of Regulations associated with medical necessity, age‑appropriate and Day Care Habilitative requirements with consultation to establish medical necessity for SUD services, (2) limits services, and Day Care Habilitative requirements. from appropriate clinical staff. for waiving physical exams, (3) requirements that assure age‑appropriate services, (4) restrictions on the prescription of intensive outpatient services for dependence 32 Fully implemented diagnoses, (5) a process for establishing placement criteria for residential services, (6) requirements that ensure a confidential treatment setting, and (7) a definition of the medical director/physician’s roles and responsibilities. Health Care Services stated it began engaging stakeholders in discussions that focus on proposed changes to the program in January 2014. Sources: Health Care Services’ Drug Medi‑Cal Treatment Program Limited Scope Review and Implementation Plan, interviews with Health Care Services’ staff, and documents obtained from Health Care Services. * The recommendation numbers correspond with those in the investigations division’s report. We excluded three of the recommendations from the table because they were for services other than outpatient drug‑free treatment, which is the focus of our audit. In addition, we assessed Health Care Services’ implementation of the six action steps associated with the first recommendation. Because action steps 5 and 6 remain partially implemented, we assessed the first recommendation as partially implemented. † These recommendations relate specifically to improving the coordination between Health Care Services’ staff who are responsible for administering the program. California State Auditor Report 2013-119 79 August 2014 IMPLEMENTATION STATUS THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES’ THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES’ PROGRESS AS OF JULY 9, 2014 RECOMMENDATION NUMBER* RECOMMENDATION IMPLEMENTATION PLAN AS OF JANUARY 10, 2014 AS OF JULY 9, 2014 (UNLESS OTHERWISE NOTED) (UNLESS OTHERWISE NOTED) To ensure all complaints received within the SUD program Health Care Services stated its complaints unit within SUD’s Health Care Services stated the PSPP unit maintains a complaint log are being addressed by the appropriate unit and in a timely compliance division will forward complaints to the PSPP to track the status of program complaints. The complaints are sent fashion, the SUD complaint unit and PSPP unit should unit within SUD’s prevention, treatment, and recovery to the PSPP unit supervisor who assigns the complaints to staff for coordinate their efforts and compare their complaint log division. The PSPP unit will review and refer complaints to follow‑up and referral to the investigations division. Health Care details on a regular basis. the investigations division for preliminary investigation. Services stated that the PSPP unit will not finalize the reporting 28† Health Care Services expects this referral process to be mechanism until September 2014 because it is still in the process Partially Implemented complete by mid‑2014. Health Care Services stated the of drafting its complaint and fraud referral procedures, and the PSPP unit will also establish a mechanism to regularly procedures will undergo an internal review in August 2014. report to the investigations division and SUD management the referrals it receives, the referral outcomes, and the basis of the outcomes. To ensure the effectiveness of all future program fraud Health Care Services stated that SUD management has Health Care Services stated that the SUD management has not investigations, the investigations division’s management worked with certain staff in the investigations division to provided any additional training to the investigations division since should collaborate with SUD management to provide provide training and guidance since the summer of 2013. December 2013 because there has not been an expressed need. detailed and ongoing program training to the investigators Health Care Services gave examples of trainings that took and other staff that may be responsible for future place in the fall of 2013, such as the statewide training SUD investigations, audits, and reviews of program activity management provided to the investigations division staff 29† and providers. on general program requirements. Health Care Services Fully Implemented also stated that SUD management and the investigations division will continue to work closely to assure the investigations division’s ongoing success when performing audits and reviews of program activity and providers. These efforts will be ongoing as needed and requested by the investigations division. To ensure that all program recoveries and offsets are Health Care Services stated it will develop a process to Health Care Services has since determined that no action is adequately tracked, SUD’s Financial Management and enhance communications and develop a tracking system for required for this recommendation because the CORE (CALSTARS 30† Accountability Branch should work with Health Care program recoveries and offsets. Online Reporting Environment) is in place and can track payments, Fully implemented Services’ Accounting Office to develop a process to enhance recoveries, and offsets. communications and develop a tracking system for these recoveries and offsets. To ensure that provider records, including client/beneficiary Health Care Services stated that instead of implementing Health Care Services stated that the fiscal year 2014–15 State‑county files, are adequately preserved, SUD management should this recommendation, SUD management will work with contract is not final because it has been working with counties in 31 work with the counties and direct providers to develop counties and those providers that contract directly with obtaining feedback on the draft contract provisions. Health Care Not Implemented a process to retrieve and secure relevant records after a the State to take possession of the files once the program is Services expects to finalize the contract in August 2014. provider is sanctioned. closed and the contract is terminated. To increase program integrity, Health Care Services Health Care Services stated it is developing a regulatory On June 25, 2014, Health Care Services used its emergency should explore options to strengthen existing regulations revision package to increase the integrity of the program. regulatory authority to amend Title 22 of the California Code associated with medical necessity, age‑appropriate services, The package will include (1) greater specificity on how of Regulations associated with medical necessity, age‑appropriate and Day Care Habilitative requirements with consultation to establish medical necessity for SUD services, (2) limits services, and Day Care Habilitative requirements. from appropriate clinical staff. for waiving physical exams, (3) requirements that assure age‑appropriate services, (4) restrictions on the prescription of intensive outpatient services for dependence 32 Fully implemented diagnoses, (5) a process for establishing placement criteria for residential services, (6) requirements that ensure a confidential treatment setting, and (7) a definition of the medical director/physician’s roles and responsibilities. Health Care Services stated it began engaging stakeholders in discussions that focus on proposed changes to the program in January 2014. Sources: Health Care Services’ Drug Medi‑Cal Treatment Program Limited Scope Review and Implementation Plan, interviews with Health Care Services’ staff, and documents obtained from Health Care Services. * The recommendation numbers correspond with those in the investigations division’s report. We excluded three of the recommendations from the table because they were for services other than outpatient drug‑free treatment, which is the focus of our audit. In addition, we assessed Health Care Services’ implementation of the six action steps associated with the first recommendation. Because action steps 5 and 6 remain partially implemented, we assessed the first recommendation as partially implemented. † These recommendations relate specifically to improving the coordination between Health Care Services’ staff who are responsible for administering the program. 80 California State Auditor Report 2013-119 August 2014 Blank page inserted for reproduction purposes only. California State Auditor Report 2013-119 81 August 2014 * * California State Auditor’s comments begin on page 101. 82 California State Auditor Report 2013-119 August 2014 California State Auditor Report 2013-119 83 August 2014 The Department of Health Care Services Response to the California State Auditor’s Report entitled, “Department of Health Care Services: Its Failure to Properly Administer the Drug Medi-Cal Treatment Program Created Opportunities for Fraud”. 84 California State Auditor Report 2013-119 August 2014 Chapter 1 (pg. 40): To ensure providers receive reimbursement for only valid services, Health Care Services should do the following: 1. Coordinate with the counties to recover inappropriate payments for ineligible services and purportedly provided to deceased beneficiaries Response: DHCS agrees with this recommendation. DHCS is currently gathering detailed data in order to validate the recovery amount. Upon receipt of the detailed data, the Fiscal Management and Accountability Branch (FMAB) will confirm the results by conferring with county monitoring staff and utilizing various systems/documents (SMART, SDMC, and cost report data). After the final results are approved by DHCS Mental Health Substance Use Disorders (MHSUD), DHCS will notify any affected DMC contractors of the existence of an overpayment and the need to recover the overpayment. FMAB will track the various overpayment recovery activities and conduct follow-up as required if payment is not received within the time allowed for submission of recovery payment. Throughout this process, DHCS will communicate with the involved county regarding the overpayment and recovery activities. Estimated completion date for all activities is April 2015. Contact Name, Title and Division: Don Braeger, Division Chief, Substance Use Disorders Prevention, Treatment, and Recovery Services Division 2. Develop and implement new procedures for routinely identifying and initiating recovery efforts for payments that it authorizes between the effective date of a provider’s decertification and the date the decertification is entered into the system, and a beneficiary’s date of death and its receipt of the death record Response: DHCS agrees with this recommendation. DHCS is currently addressing this recommendation by developing two different processes to routinely identify and initiate recovery efforts for the specified payments: A) Receipt of Decertification Notice and B) Death Record Quarterly Checks Department of Health Care Services July 2014 Page 2 California State Auditor Report 2013-119 85 August 2014 A. Receipt of Decertification Notice – Ongoing The Provider Enrollment Division will immediately notify FMAB when a provider needs to be decertified. Upon FMAB’s receipt of such notification, FMAB will generate a query to determine if there is billing data activity (approved and paid claims) for services after the termination date. If there is activity, notification will be issued to the County or Direct Provider regarding the recovery of overpayment in which the DHCS Accounting Office will issue an invoice to the County or Direct Provider. FMAB will track the various activities and conduct follow-up as required if payment is not made within the time allowed for submission of recovery payment. This will be an ongoing activity as FMAB receives the DMC Decertification Notices. B. Death Record Quarterly Checks Within 45 days from the end of each billing quarter (September 30, December 31, March 30, and June 30), FMAB will generate a report that will identify any billed, approved or paid services after a “death date” as stored in SMART. The first report will be generated 45 days from September 30, 2014 and will be subsequently generated every quarter thereafter. If there is activity, DHCS will notify the Contractor that an overpayment has occurred and the DHCS Accounting Office will issue an invoice for recovery of the overpayment amount. FMAB will track the various overpayment recovery activities and conduct follow- up as required if payment is not received within the time allowed for submission of recovery payment. Contact Name, Title and Division: Don Braeger, Division Chief, Substance Use Disorders Prevention, Treatment, and Recovery Services Division 3. Direct its investigations division to determine whether it authorized any improper payments to program providers for deceased beneficiaries outside of our audit period. It should also determine if it authorized such payments through its other Medi-Cal programs. Health Care Services should initiate efforts to recover such payments as appropriate. Response: DHCS agrees with the recommendation. The DHCS Audits and Investigations Division (A&I) has experience and has had success in addressing identified overpayments to providers on behalf of deceased beneficiaries via its routine audits and data mining activities. However, in light of the current finding and recommendation, A&I will expand its efforts in this area. The expanded efforts will continue to complement existing system edits and other controls in place to limit improper payments associated with deceased beneficiaries. DHCS has acquired new technology-based data analytics tools to improve its data analytics Department of Health Care Services July 2014 Page 3 86 California State Auditor Report 2013-119 August 2014 capabilities and address overall fraud concerns. A&I performs claims analyses on a routine basis and has systems and procedures in place to recover identified overpayments when necessary. The anticipated implementation date is September 2014. Contact Name, Title, and Division: Bruce Lim, Deputy Director, Audits and Investigations 4. Direct its investigations unit to determine whether it should recover any overpayments for the high-risk payments, [CSA] identified in Table 7 and Appendix A. It should also take the appropriate disciplinary action against the affected providers, such as suspension or termination. Response: DHCS agrees with the recommendation. DHCS’ Audits and Investigations Division (A&I) will review and investigate the suspect activities identified by the CSA once the details of CSA’s analysis are obtained. It is important to note that while fraud indicators are helpful in identifying suspect payments, the actual fraud, if any, can only be confirmed via proper follow-up and investigation. A&I utilizes its own set of fraud indicators to similarly identify suspect payments and activities. A&I continues to be aggressive in its fraud fighting efforts, as evidenced by the significant number of fraud cases referred to the state Department of Justice during CSA’s audit period for criminal investigation and prosecution where warranted. Identifying new fraud indicators should always be a goal. Therefore, DHCS appreciates and will leverage the results of CSA independent analysis and identification of high-risk payments using their respective fraud indicators. If DHCS confirms that improper payments were made, DHCS will seek recovery of the overpayments as necessary. Upon receipt of the data, DHCS will analyze within a two month period and begin appropriate action(s). Contact Name, Title, and Division: Bruce Lim, Deputy Director, Audits and Investigations Department of Health Care Services July 2014 Page 4 California State Auditor Report 2013-119 87 August 2014 5. Direct its investigations division to further enhance its analysis of program claims data to identify the types of high-risk payments we identified on a monthly basis. Response: DHCS agrees with the recommendation. DHCS Audits and Investigations (A&I) will leverage the results of the CSA’s data mining results to expand its current claims analysis efforts. A&I will achieve this in part by expanding the fraud indicators, or algorithms, used in its data analytics tool. A&I’s current data mining activities involves access to a host of data sources, including data from county health programs and other state departments charged with administering the program, to perform its analytics. On a monthly basis, A&I will continue to utilize these tools and data sets to enhance its analysis of program claims data to identify the types of high-risk payments in the Audit. Contact Name, Title, and Division: Bruce Lim, Deputy Director, Audits and Investigations 6. Direct its fiscal management and accountability branch to work with Fresno, Los Angeles and Sacramento counties to recover the specific overpayments CSA identified during their visit Response: DHCS agrees with this recommendation. Upon receipt of the detailed dead beneficiary data specific to Fresno, Los Angeles, and 1 Sacramento County, the Fiscal Management and Accountability Branch (FMAB) will confirm the results by utilizing various systems/documents (SMART, SDMC, and cost report data). After the final results are approved by DHCS Mental Health Substance Use Disorders (MHSUD) Executive Staff, DHCS will notify Fresno, Los Angeles, Sacramento counties of the existence of an overpayment and the need to recovery the overpayment as they related to dead beneficiary overpayments. The DHCS Accounting Office will issue an invoice to the County. FMAB will track the various overpayment recovery activities and follow-up with the counties if payment is not received within the time allowed for submission of recovery payment. Throughout this process, DHCS will communicate Fresno, Sacramento, and Los Angeles counties regarding the overpayment and recovery activities. Estimated completion date for all activities is April 2015. Contact Name, Title and Division: Don Braeger, Division Chief, Substance Use Disorders Prevention, Treatment, and Recovery Services Division 7. Instruct the counties to remind their providers to adhere to the record retention policies stated in their contracts. Response: DHCS agrees with this recommendation. Department of Health Care Services July 2014 Page 5 88 California State Auditor Report 2013-119 August 2014 DHCS will instruct the counties to remind their providers to adhere to the record retention policies stated in their contracts (both the State-County contract, and the contract between the County and any subcontracted providers). DHCS will include this topic as an agenda item at the County Behavioral Health Director’s Association monthly meeting (currently scheduled for August 14, 2014) to ensure counties remind their providers of this existing contract provision and the counties’ duty to monitor their subcontracted providers for compliance with record retention requirements. Further, DHCS is including this recommendation as a monitoring element when monitoring the counties’ compliance with the State-County contract in the 2014-15 fiscal year. Implementation Fiscal Year 2014-2015 Contact Name, Title, and Division: Don Braeger, Division Chief, Substance Use Disorders Prevention, Treatment, and Recovery Services Division 8. Ensure that each county has a process in place to follow up on their providers’ implementation of corrective action plans aimed at resolving program deficiencies. Response: DHCS agrees with this recommendation. DHCS has taken and will take further action to ensure that each county has a process in place to follow up on their providers’ implementation of corrective action plans. DHCS is including this as a monitoring element when monitoring the counties’ during the 2014- 2015 fiscal year. The following question will be added to the annual county monitoring instrument for the 2014-2015 fiscal year: How does the County ensure that their providers’ corrective action plans are submitted and implemented as required? Please provide documentation that demonstrates the County’s monitoring process for provider corrective action plans. Additionally, DHCS intends to propose an addition to the State-County contract for fiscal year 2014-2015 that will require counties to certify their subcontracted providers’ completion of CAP implementation. Further, the State will provide the County Monitors (employed by DHCS) with a copy of any approved PSPP corrective action plans for the providers in that county so the County Monitors can follow up and verify that the county monitoring process of provider implementation of the PSPP CAP is effective. If the county cannot demonstrate that an effective monitoring process is in place, a compliance deficiency will be cited and the county will be given 60 days to submit a corrective action plan. DHCS intends to Department of Health Care Services July 2014 Page 6 California State Auditor Report 2013-119 89 August 2014 provide technical assistance to any county that requests it to ensure they have an effective process in place. Implementation as of Fiscal Year 2014-2015 Contact Name, Title, and Division: Don Braeger, Division Chief, Substance Use Disorders Prevention, Treatment, and Recovery Services Division 9. Ensure that Fresno County strengthens its provider contract monitoring process, including revising its report format and conducting follow-up visits to providers. Response: DHCS agrees with this recommendation. DHCS has immediate plans to address these issues with Fresno County. The County Monitors will review Fresno County’s report format and its ability to conduct follow-up visits with providers during the annual monitoring review. The Fresno County monitoring review will be conducted by September 30, 2014. In addition, DHCS has already addressed program integrity issues with Fresno County through communication with the Director of Fresno County Department of Behavioral Health in a letter sent in June 2014. The letter from the Deputy Director of the Mental Health, Substance Use Disorder Unit addressed various program integrity issues with the Drug Medi-Cal program that were identified during the Audits and Investigations reviews of providers in that county. DHCS will be following up with Fresno County on those program integrity issues and Fresno’s efforts to address those issues in August, 2014. Contact Name, Title, and Division: Don Braeger, Division Chief, Substance Use Disorders Prevention, Treatment, and Recovery Services Division 10.Ensure that Los Angeles County strengthens its provider contract monitoring process, including fully implementing its RATE system to track and respond to provider deficiencies, and that it imposes appropriate responses when warranted such as withholding payment or suspending or terminating a contract. Response: DHCS agrees with this recommendation. The County Monitors will include these issues in its annual monitoring review of Los Angeles County. The Los Angeles County monitoring review will be conducted by December 31, 2014. Contact Name, Title, and Division: Don Braeger, Division Chief, Substance Use Disorders Prevention, Treatment, and Recovery Services Division Department of Health Care Services July 2014 Page 7 90 California State Auditor Report 2013-119 August 2014 11.Ensure that Sacramento County strengthens its provider contract monitoring process, including tracking provider deficiencies and conducting follow-up visits to providers. Response: DHCS agrees with this recommendation. The County Monitors will include these issues in its annual monitoring review of Sacramento County. The Sacramento County monitoring review will be conducted by October 31, 2014. Contact Name, Title, and Division: Don Braeger, Division Chief, Substance Use Disorders Prevention, Treatment, and Recovery Services Division Department of Health Care Services July 2014 Page 8 California State Auditor Report 2013-119 91 August 2014 Chapter 2 (pg. 43): To prevent certification of ineligible providers, Health Care Services should immediately do the following: 1. Instruct staff to compare the names of managing employees whom applicant providers identify in their program applications to those whom they identify in their disclosure statements. Response: DHCS agrees with the recommendation. DHCS has instructed and will continue to instruct staff to compare the names of managing employees on providers’ applications and disclosure statements. This process has been applied to DMC provider recertification applications for over a year. 2 Since disclosure statements became a requirement, it has always been the Provider Enrollment Division’s (PED) standard process to compare all names of managing employees that are identified throughout the application with those listed on the Disclosure Statement in all fee-for-service (FFS) application reviews. These same review standards have been applied to DMC providers targeted for continued certification since July 2013 and for all other DMC providers requesting new certification effective January 2014, including backlog assumed by PED. PED researches any conflict in names or information and addresses the discrepancies via a deficiency letter, an onsite visit, or both. Contact Name, Title and Division: Tanya Homman, Chief, Provider Enrollment Division 2. Train its staff regularly on program requirements, including the certification standards and federal Medicaid provider enrollment requirements. Response: DHCS agrees with the recommendation. DHCS will continue to regularly train staff on program requirements, including certification standards and federal Medicaid provider enrollment requirements. Prior to beginning application review, all new PED staff are trained on state and federal 3 requirements for program participation. Further, effective July 2013, all staff that process DMC applications for continued certification or certification have been trained on the program requirements. Copies of the DMC certification standards, regulations, and federal requirements are provided to staff to use continually during application review. The PED managers for DMC enrollment meet each morning for a half hour, and the staff and managers meet three time a week to address issues and changes as a group. PED also conducts ongoing trainings as new issues are identified by the Total Quality Management Unit. Contact Name, Title and Division: Tanya Homman, Chief, Provider Enrollment Division Department of Health Care Services July 2014 Page 9 92 California State Auditor Report 2013-119 August 2014 3. Develop a provider agreement for program providers Response: DHCS agrees with the recommendation. DHCS has developed a draft provider agreement tailored specifically for DMC provider clinics. It was necessary to develop a new agreement because the provider agreements traditionally used by DHCS are tailored toward providers that DHCS reimburses directly rather than business entities like DMC providers. In January 2014, the Department began the process of implementing emergency regulations with a targeted effective date of July 1, 2015 that will incorporate the DMC specific provider agreement as an application requirement. Additionally, DHCS is currently researching ways to implement the requirement in advance of regulation package implementation. Contact Name, Title and Division: Tanya Homman, Chief, Provider Enrollment Division 4. Update its procedures to include searches of US Social Security Administration Death Master File. Response: DHCS agrees with the recommendation. DHCS has already updated its procedures to include a search of the U.S. Social 4 Security Administration Death Master File during review of DMC provider applications for certification and continued certification. Contact Name, Title and Division: Tanya Homman, Chief, Provider Enrollment Division 5. Develop procedures on how to evaluate provider applicant license database searches. Response: DHCS agrees with the recommendation. DHCS has developed and will update, as appropriate, procedures on how to evaluate provider applicant license database searches. All PED staff that process applications are trained on state and federal program requirements and how to evaluate provider applicant license searches. Effective July 2013, trained staff were assigned to process DMC applications for recertification and effective January 2014, trained staff were assigned to process all new and backlogged certification applications. Any questions on licensing status are addressed through further research, a remediation request and onsite inspections to verify all standards of program participation are met by the DMC provider. Contact Name, Title and Division: Tanya Homman, Chief, Provider Enrollment Division Department of Health Care Services July 2014 Page 10 California State Auditor Report 2013-119 93 August 2014 6. Instruct its enrollment division to conduct all required database searches of individuals provider applicants identify as their owners or managing employees. Response: DHCS agrees with the recommendation. DHCS has instructed its enrollment division to conduct all required database searches of such individuals. It is PED’s standard process to conduct all federally required database searches of all individuals found in the application package at the time of screening, which includes all owners and managing employees. PED has been searching MED/PECOS since April 2013 and the MCSIS since January 2013. Effective 5 July 2013 for DMC recertification applications and effective January 2014, for new DMC certification applications PED staff conduct all required database searches for DMC providers. DHCS has also begun adding all individuals identified as owners, managers, and controlling interest holders to the Provider Master File (PMF) to enable monthly database checks. Currently, DHCS and the Fiscal Intermediary conduct monthly download of the LEIE, SAM/EPLS, and MCSIS in order to check them against the providers in the PMF. In the near future (tentatively Fall 2014), PED will utilize an automated enrollment system and these database checks will become an automated process. Contact Name, Title and Division: Tanya Homman, Chief, Provider Enrollment Division 7. Ensure its enrollment division conducts List of Excluded Individuals and Entities and Excluded Parties List System Database searches of program providers at least monthly. Response: DHCS agrees with the recommendation. The enrollment division currently conducts monthly searches of program providers in the LEIE and EPLS databases. Currently, DHCS and the Fiscal Intermediary conduct monthly downloads of the LEIE and EPLS databases for comparison against all providers in the PMF. As DMC providers are approved through continued certification or certification, they are added to the PMF so the required monthly screening can occur. With respect to pending DMC applications, DHCS compiled all names and conducted a 5 search of the LEIE and EPLS for those names and as staff conduct their full analysis, these database checks occur again. In addition, as soon as the automated enrollment system is implemented, this will become an automated process (tentatively Fall 2014). Contact Name, Title and Division: Tanya Homman, Chief, Provider Enrollment Division 8. Designate provider applicants as moderate or high risk in accordance with federal regulations. Department of Health Care Services July 2014 Page 11 94 California State Auditor Report 2013-119 August 2014 Response: DHCS agrees with the recommendation. DHCS will designate non-governmental DMC providers as high risk through regulatory bulletins. Contact Name, Title and Division: Tanya Homman, Chief, Provider Enrollment Division 9. Establish a mechanism to identify the number of program sites the provider applicants’ medical directors’ work at, and ensure the physician ratio does not exceed 1 – to – 3 in accordance with state law and the certification standards. Response: DHCS agrees with the recommendation to the extent applicable. Welfare and Institutions Code section 14043.47 applies to providers doing business as sole proprietorships, partnerships, professional corporations under section 14301 of the Corporations Code, or as rendering providers in a group practice that utilizes nonphysician medical staff. Section 14043.47(c), which establishes the prohibition on providers enrolling at more than three business addresses unless there is at least a ratio of one physician supervisor per three locations, applies to the foregoing types of practices. Upon implementation of the automated enrollment system for all PED approved certified DMC providers, DHCS will be able to automatically identify the medical directors and their specific DMC affiliations. To the extent that any DMC medical director falls within the scope of section 14043.37(c), DHCS will take action to enforce the stated physician ratio. Contact Name, Title and Division: Tanya Homman, Chief, Provider Enrollment Division 10.Identify and perform an immediate recertification of providers that signed the Compliance Agreement to ensure that these providers are currently meeting all program requirements. Response: DHCS agrees with the recommendation. DHCS has already implemented a recertification process that will capture all providers that signed the Compliance Agreement. In July of 2013, the department began a 6 recertification process of all DMC providers that billed or could bill for services during fiscal year 2012-2013, regardless of their original enrollment method. The current continued certification process is required of all DMC providers therefore providers that signed the Compliance Agreement are required to submit a current and complete application package, including all attachments and disclosure information. They will also be subject to an onsite inspection. DHCS will conclude all DMC continued Department of Health Care Services July 2014 Page 12 California State Auditor Report 2013-119 95 August 2014 certifications by early fall 2015 at the latest. Contact Name, Title and Division: Tanya Homman, Chief, Provider Enrollment Division 11.Use a risk-based approach for recertifying program providers. Response: DHCS agrees with the recommendation. DHCS will designate non-governmental DMC providers as high risk through regulatory bulletins. Contact Name, Title and Division: Tanya Homman, Chief, Provider Enrollment Division 12.Develop policies and procedures for its program recertification process Response: DHCS agrees with the recommendation. DHCS has developed new policies and procedures for the DMC recertification process, and will continue to update these policies and procedures as warranted. DHCS has 7 developed a DMC enrollment and certification section whose sole purpose is to conduct continued certification and certification functions for all DMC provider applicants. PED staff work collaboratively with SUDs staff and the Audits and Investigations Division staff in implementing its policies and procedures. Additionally, in January 2014, the department began the process of implementing emergency regulations regarding the enrollment of DMC providers with a targeted effective date of July 1, 2015. As part of the emergency regulation package, all DMC providers will be required to adhere to current CCR Title 22 requirements used to enroll and revalidate fee-for-service providers. Contact Name, Title and Division: Tanya Homman, Chief, Provider Enrollment Division 13.Develop a schedule for recertifying all program providers every five years Response: DHCS agrees with the recommendation. DHCS will conduct a revalidation of all DMC program providers at least once every five years. For the last two years, DHCS has been engaged in the development of a web- based automated enrollment system to manage the workload more efficiently. DHCS seeks to implement the automated enrollment system in Spring 2015. This automated system will identify providers who are due for recertification. Department of Health Care Services July 2014 Page 13 96 California State Auditor Report 2013-119 August 2014 Contact Name, Title and Division: Tanya Homman, Chief, Provider Enrollment Division 14.Continue its implementation of automated provider enrollment system. Response: DHCS agrees with the recommendation. DHCS will continue its implementation of the automated provider enrollment system. The projected final implementation date is Spring 2015; however, the automated monthly database checks will begin in Fall 2014 for all providers enrolled in the PED PMF. Contact Name, Title and Division: Tanya Homman, Chief, Provider Enrollment Division 15.Complete its program recertifications on or before March 24, 2016, as federal regulations require. Response: DHCS agrees with the recommendation. DHCS is on track to complete all DMC recertifications on or before the federally required date of March 24, 2016. On July 15, 2013, DHCS initiated the continued certification process by noticing certified Drug Medi-Cal (DMC) providers of the requirement to re-certify. The continued certification process is occurring in phases and requires the submission of a complete application package with supporting documentation for review by the Department. DHCS terminated the certifications of DMC providers that failed to respond timely to the request for continue certification. Contact Name, Title and Division: Tanya Homman, Chief, Provider Enrollment Division 16.Establish a plan for eliminating its backlog of applications for new sites and services and changes to existing certifications. Response: DHCS agrees with the recommendation. DHCS has already established a plan for eliminating the application backlog. To eliminate its backlog, in May 2014, PED’s Application Section prioritized the review of the backlogged applications and any other applications for new Drug Medi-Cal sites over Drug Medi-Cal sites seeking revalidation. New sites, unlike those in compliance Department of Health Care Services July 2014 Page 14 California State Auditor Report 2013-119 97 August 2014 with the continued certification process, are unable to render services or to render services or to receive payment until certified. Division staff have completed the initial review of all backlog applications received prior to January 1, 2014, and 72.5% of applications for new sites received since January 1, 2014 (and as of July 18, 2014). Most reviewed applications await remediation by the provider but some have been referred to DHCS Audits & Investigations Medical Review Branch to conduct the onsite inspection. DHCS has approved 22 new Drug Medi-Cal program sites. These are all county – operated sites in the counties of: San Luis Obispo (14 sites) , Tehama (2 sites), San Benito (5 sites), San Bernardino (1 site). Each site is required to submit an application so our counts are by sites, not by provider. Contact Name, Title and Division: Tanya Homman, Chief, Provider Enrollment Division To ensure it appropriately and consistently reviews provider applications and conducts site visits, Health Care Services Should: (pg. 65) 1. Update its program checklist to reflect current federal and state laws and regulations. Response: DHCS agrees with the recommendation. As part of PED’s existing process, reviews are conducted with the aid of a set of checklists designed to ensure review is completed in adherence to current federal and 8 state laws and regulations. Effective July 2013 for all DMC providers targeted for continued certification, and effective January 2014 for new and backlogged certification applicants, staff review applications with the aid of checklists that were developed specifically for DMC applicants and, where appropriate, mirrorrequirements for all other FFS providers. DHCS will continue to update these checklists periodically as necessary to reflect any future changes in law or regulation. Contact Name, Title and Division: Tanya Homman, Chief, Provider Enrollment Division 2. Retain the documentation, such as checklists, that it uses to support its certification decisions in accordance with its retention policy. Response: DHCS agrees with the recommendation. DHCS currently retains, in accordance with its retention policy, the documentation that it 9 uses to support certification decisions. The PED Document Management System Department of Health Care Services July 2014 Page 15 98 California State Auditor Report 2013-119 August 2014 (DMS) is a computer program developed in 2001 and was designed for the purpose of maintaining a complete electronic record of all documents received by PED. All applicant-submitted documents, PED working papers, correspondence to and from providers, Special Claims Review action letters, A&I findings, and other miscellaneous documents are scanned into DMS to maintain a permanent record. Additionally, PETS and PETSII are programs that maintain dates, notes, and all action items made on an application. All application review requires extensive usage of at least two of these programs. Any documents associated with approved applications for DMC continued certification or new certification will also be maintained in DMS. Contact Name, Title and Division: Tanya Homman, Chief, Provider Enrollment Division 3. Ensure that supervisors perform detailed reviews of all provider applicants’ files including the application, disclosure statement, and checklists, and that they evidence their reviews by signing off on the appropriate forms. 10 Response: DHCS agrees with the recommendation, in part. DHCS will ensure that the Total Quality Management Unit (TQMU) staff perform detailed reviews of all provider applicants’ files, including the application, disclosure statement, and checklists, and that they evidence their reviews by signing off on appropriate forms. It is PED’s process to forward all applications to theTQMU within PED, which is dedicated to re-reviewing all documents, research, and recommendations made by primary research analysts. All applications must be reviewed for accuracy and correctness, and signed by a TQM reviewer before being considered complete. All DMC recertification applications or applications for a new certification undergo the same process for quality control. Contact Name, Title and Division: Tanya Homman, Chief, Provider Enrollment Division Department of Health Care Services July 2014 Page 16 California State Auditor Report 2013-119 99 August 2014 Chapter 3 (pg. 76): To improve coordination between its divisions and branches and ensure that it addresses allegations of fraud in a timely manner, Health Care Services should do the following: 1. Continue its efforts to develop its provider risk assessment model for PSPP unit Response: DHCS agrees with this recommendation. DHCS will continue its development of a provider risk assessment model for purposes of identifying ‘high risk’ providers and prioritizing annual Post-Service Post-Payment reviews. SUD management is leveraging clinical support and expertise from DHCS’ Medical Review Branch (MRB) to develop the model based upon MRB’s experience and role as the DHCS’ primary Medi-Cal anti-fraud unit. The categories of high, medium and low risk providers are based on multiple risk factors. Once provider risk levels are assessed, individuals and/or teams can be assigned responsibility for the reviews depending on the provider risk category. This methodology would mitigate the risk of fraud, waste and abuse within the DMC program, and give the Department some assurance that high risk providers are reviewed with a frequency that would not allow a return to fraudulent practices. Currently, this recommendation is partially implemented as PSPP reviews are occurring based on the data analytics and Strike Team recommendations. The full model will be developed and approved by October 17, 2014 with the first reviews conducted by the first week of November 2014. Contact Name, Title and Division: Don Braeger, Chief, SUD Prevention, Treatment and Recovery Services Division 2. Continue its efforts to establish a mechanism for PSPP unit to report the status of fraud referrals to SUD management and its investigations division. Response: DHCS agrees with this recommendation. DHCS will continue its efforts to establish a mechanism for the PSPP unit to report the status of fraud referrals to SUDs management and its investigations division. The referral process has been agreed upon and implemented by SUD management and the Audits and Investigations Division as outlined in Figure 4 – Substance Use Disorder Services Complaint Intake Process, page 51 of the Drug Medi-Cal Program Limited Scope Review report. A draft of the Drug Medi-Cal Complaint and Fraud Referral Process for PSPP has been completed and is being routed for approval to ensure appropriate internal control mechanisms are in place. The report template which will be used to report the status of fraud referrals is also being routed for approval. It is Department of Health Care Services July 2014 Page 17 100 California State Auditor Report 2013-119 August 2014 anticipated that the procedures and report template will be approved for use by August 8, 2014. Contact Name, Title and Division: Don Braeger, Chief, SUD Prevention, Treatment and Recovery Services Division 3. Fully implement the investigations division’s recommendations shown in Appendix B. If DHCS chooses not to implement a recommendation, it should document sufficiently the reasons for its decision. Response: DHCS agrees with this recommendation. DHCS will fully implement, to the best of its ability, the recommendations shown in Appendix B, and will document any exceptions. Many of the recommendations outlined in the DHCS A&I Limited Scope Review Report have already either been fully implemented or partially implemented. The DHCS Audits and Investigations Division (A&I) has reestablished the audits of NTP providers when a cost report is filed during the 2014/2015 fiscal year. Also, audits were reestablished to address corrective action plans (CAP) required pursuant to A133 audits of counties and A&I audits issued on county contracts, A&I plans to meet with Substance Use Disorder Services (SUDS) management quarterly to discuss findings that require a CAP. The first meeting between SUDS and A&I management to discuss next steps occurred in June 2014. Another meeting is scheduled for August 2014. Full implementation is anticipated in the third quarter of fiscal year 2014-2015. Contact Name, Title and Division: Bruce Lim, Deputy Director, Audits and Investigations; and Don Braeger, Chief, SUD Prevention, Treatment and Recovery Services Division Department of Health Care Services July 2014 Page 18 California State Auditor Report 2013-119 101 August 2014 Comments CALIFORNIA STATE AUDITOR’S COMMENTS ON THE RESPONSE FROM THE CALIFORNIA DEPARTMENT OF HEALTH CARE SERVICES To provide clarity and perspective, we are commenting on the California Department of Health Care Services’ (Health Care Services) response to our audit. The numbers below correspond to the numbers we have placed in the margin of Health Care Services’ response. 1 Health Care Services did not specifically address our recommendation related to recovering the overpayments we identified during our site visits. As we discuss on pages 29 through 34 of this report, providers could not locate the patient records or were missing critical documents from their patient records, such as treatment plans, progress notes, and sign‑in sheets. We look forward to Health Care Services’ 60‑day response to clarify the specific actions it has taken regarding these overpayments. 2 Health Care Services stated that the process of comparing the names of managing employees on Drug Medi‑Cal Treatment Program (program) providers’ applications and disclosure statements has been applied to the program provider recertification applications for more than a year. However, Health Care Services is referring to the processes of its Provider Enrollment Division (enrollment division) that did not assume responsibility for program certifications until January 1, 2014. As we present in Figure 1 on page 11, Health Care Services’ Licensing and Certification Branch (certification branch) was responsible for certifying new provider applicants before the responsibility was transferred to the enrollment division. Further, as we state on page 49, the enrollment division has not yet established any recertification policies and procedures, nor has it developed a schedule demonstrating that it will be recertifying program providers every five years. Health Care Services stated that the enrollment division will develop this information once it has recertified all current providers. In the meantime, the enrollment division will use the same process it uses for initially certifying provider applications. Because our audit period was from July 1, 2008 through December 31, 2013, we did not review the enrollment division’s certification processes. 3 Health Care Services stated that, effective July 2013, all staff responsible for processing program applications for certification have been trained on the program requirements. However, as we state on page 39, according to the chief of its certification branch, 102 California State Auditor Report 2013-119 August 2014 the certification staff transferring from the California Department of Alcohol and Drug Programs (ADP) did not receive any training on evaluating the completeness of disclosure statements until the winter of 2013. Health Care Services appears to be focusing on the training it provided to the enrollment division staff. Because our audit period was from July 1, 2008 through December 31, 2013, we did not review the enrollment division’s certification processes and related training activities. 4 Health Care Services stated that it has already updated its procedures to include a search of the U.S. Social Security Administration’s Death Master File (Death Master File). However, as we indicate beginning on page 42, the chief of the certification branch stated that Health Care Services does not perform a search of the Death Master File because it is not part of the State’s review process. We also state on page 42 that its procedures did not include this database search. In fact, the chief of its policy and administrative branch (policy branch) stated that the branch is in the process of establishing periodic checks of provider applicants against the Death Master File. Therefore, we look forward to its 60‑day response to clarify the specific actions it has taken regarding this search. 5 Health Care Services stated that the enrollment division’s standard process is to conduct all federally required database searches of all individuals found in the application at the time of screening, which includes owners and managing employees. However, the enrollment division did not assume responsibility for program certifications until January 1, 2014, as we present in Figure 1 on page 11. Further, as we state on page 42, the policy branch chief stated that the enrollment division did not conduct monthly checks against the federal Excluded Parties List System during our audit period because it just completed system changes to the provider master file to capture the names of individuals and entities associated with the provider applicants. 6 Health Care Services fails to comprehend the sense of urgency in implementing this recommendation. Specifically, on pages 47 and 48, we found that Health Care Services’ use of the Compliance Agreement and the Front End Application Checklist was less robust than the initial Drug Medi‑Cal Parent Application Checklist that was previously used by its program certification staff. In fact, Health Care Services recently suspended one of the six providers we identified as being subject to the less robust certification process. Further, as we state on page 49, the enrollment division has not yet established any recertification policies and procedures, nor has it developed a schedule demonstrating that it will be recertifying program providers every five years. Health Care Services stated in its response that it will complete all program California State Auditor Report 2013-119 103 August 2014 continued certifications by early fall of 2015. However, in the meantime, Health Care Services may be allowing other providers subject to the less robust certification process to potentially engage in fraudulent activity. Health Care Services’ statement that it has developed new 7 policies and procedures for the program recertification process is inconsistent with earlier statements it has made to us. Specifically, as we state on page 49, the enrollment division has not yet established any recertification policies and procedures, nor has it developed a schedule demonstrating that it will be recertifying program providers every five years. Therefore, we look forward to its 60‑day response to clarify the specific actions it has taken regarding this process. Health Care Services appears to be focusing on the enrollment 8 division’s certification processes. Because our audit period was from July 1, 2008 through December 31, 2013, we did not review these processes. As we state on page 45, when we reviewed the four different certification processes that Health Care Services and ADP used to certify provider applicants during our audit period, we found that they did not incorporate all of the Medi‑Cal program legal requirements related to provider screening. Health Care Services’ statement is inconsistent with our audit 9 findings. As we state on page 38, when we selected 30 provider applicant files to review the applicants’ disclosure information, Health Care Services was unable to locate five of the files, even though ADP’s retention policy required staff to keep program certification files for five years after the certification was relinquished, revoked, or abandoned. Health Care Services stated that it agrees, in part, with our 10 recommendation to ensure and document that its supervisors perform detailed reviews of provider applicants’ files. However, Health Care services failed to identify the part of this recommendation with which it did not agree. Therefore, we look forward to its 60‑day response to clarify the specific actions it has taken regarding these reviews.