Which Authorizes CMS To Enter Into Contracts With Entities To Perform Cost Report Auditing, Medical Review
Introduction
The Centers for Medicare & Medicaid Services (CMS) plays a pivotal role in overseeing and managing the administration of federal healthcare programs, including Medicare and Medicaid. A critical component of CMS’s oversight functions involves ensuring the integrity and accuracy of healthcare provider reimbursements. To fulfill these responsibilities effectively, CMS often contracts with external entities to perform tasks such as cost report auditing and medical reviews. But what legal and regulatory frameworks grant CMS the authority to establish these contractual relationships? Understanding the statutory, regulatory, and policy bases that authorize CMS to engage third-party organizations is essential for appreciating how healthcare program integrity is maintained.
Legal Foundations for Contracting Authority
Statutory Authority Under Federal Laws
The primary legal authorization for CMS to contract with external entities originates from several key federal statutes. These statutes outline the agency’s broad authority to administer, supervise, and ensure the proper functioning of Medicare and Medicaid programs, including contracting powers.
- Social Security Act (SSA): The foundation of Medicare law, the SSA, particularly sections related to the administration of the program, provides CMS with the authority to enter into agreements necessary for program operation. Notably, section 1874A of the SSA authorizes the Secretary of Health and Human Services (HHS) to establish programs for auditing and reviewing provider claims.
- Medicare Act of 1965: This act established Medicare and gave the Secretary broad authority to develop regulations, establish standards, and implement procedures necessary for program administration, including contracting for specialized functions.
- Section 1862 of the SSA: This section permits the Secretary to conduct audits and reviews of providers to prevent fraud, waste, and abuse, which can be delegated through contractual arrangements.
Regulatory Framework and Authority
Beyond statutes, CMS’s authority is further delineated through regulations that specify how the agency can implement statutory mandates.
- 42 CFR Part 405: This regulation covers principles for audits and investigations, including contractor roles and responsibilities, establishing the legal basis for contractual relationships.
- 42 CFR Part 488 and 495: These regulations detail the survey and certification process, including medical reviews and audits conducted by authorized entities.
- Authority Delegations: CMS often delegates specific responsibilities to contractors via formal agreements, such as Memoranda of Understanding (MOUs), which are grounded in the above statutes and regulations.
Delegation of Authority and Contracting Policies
CMS possesses the authority to delegate certain functions to qualified external organizations, including Medicare Administrative Contractors (MACs), Recovery Audit Contractors (RACs), and other entities performing medical review and cost report audits.
- Federal Acquisition Regulations (FAR): CMS adheres to FAR guidelines governing procurement processes, ensuring that contracts are awarded in compliance with federal procurement laws.
- Program Integrity and Fraud Prevention: Under authorities established by law, CMS contracts with entities to enhance oversight, reduce fraud, and recover improper payments.
- Performance of Specific Functions: Contracting is authorized for functions such as cost report audits, medical reviews, and claims investigations, as these are essential to the integrity of the programs.
Key Programs and Statutory Provisions Enabling Contractual Functions
Recovery Audit Contractors (RACs)
The RAC program exemplifies CMS’s authority to contract with external entities for claims review and audit functions. The statutory basis for RACs is rooted in the Medicare Modernization Act of 2003, which explicitly authorized the Secretary to establish RAC programs to identify improper payments.
- Medicare Modernization Act (MMA) of 2003: This act provided the statutory foundation for RACs, empowering CMS to enter into competitive contracts with private firms to audit Medicare claims and cost reports.
- Section 1893 of the SSA: It authorizes the Secretary to develop and implement programs to identify and correct improper payments, including contracting with external auditors.
Medicare Cost Report Audits
Cost report audits are essential for verifying the accuracy of provider reimbursements. CMS contracts with independent certified public accounting firms and other qualified entities to perform these audits based on the authority granted by the SSA and associated regulations.
- Section 1860D-12 of the SSA: This provision discusses the authority to review and audit provider cost reports as part of ensuring proper Medicare payments.
- Program Integrity Measures: The authority to audit cost reports is also supported by provisions aimed at reducing fraud and ensuring compliance with statutory and regulatory standards.
Medical Review and Certification Processes
Beyond financial audits, CMS authorizes external entities to perform medical reviews necessary for determining the medical necessity of services, reviewing coding accuracy, and compliance with coverage policies.
- 42 CFR Part 405.1801-1804: These regulations outline the procedures and authority for medical review activities, including the engagement of external reviewers.
- Peer Review and Quality Oversight: Statutes and regulations support contracting with medical review organizations to ensure healthcare quality and appropriateness.
Policy and Administrative Considerations
Procurement and Contracting Processes
CMS follows federal procurement regulations, including the FAR and agency-specific policies, to award contracts to external entities. The process involves:
- Developing detailed statements of work (SOW) and contract requirements
- Conducting competitive bidding processes or other authorized procurement methods
- Ensuring compliance with federal procurement standards
- Monitoring and oversight of contracted entities
Oversight and Compliance
Once contracts are awarded, CMS maintains oversight through:
- Regular audits and performance evaluations of contractors
- Enforcement of contractual obligations and compliance with applicable laws
- Adherence to privacy and data security requirements, especially for sensitive health information
Legal and Ethical Considerations
Contracted entities must operate within the bounds of federal laws, including:
- Federal Privacy Act and HIPAA regulations for data protection
- Anti-kickback statutes and fraud prevention laws
- Standards for impartial and fair review processes
Conclusion
The authority for CMS to enter into contracts with external entities for cost report auditing, medical reviews, and related functions is deeply rooted in the statutory framework of the Social Security Act, supported by regulations, and guided by federal procurement policies. These legal bases ensure that CMS can effectively delegate critical oversight functions to qualified organizations, thereby safeguarding the integrity of Medicare and Medicaid programs. Through these contractual arrangements, CMS enhances its capacity to detect improper payments, ensure medical necessity, and maintain the financial sustainability of healthcare programs. As the healthcare landscape evolves, this statutory and regulatory foundation continues to underpin CMS’s ability to collaborate with external partners in fulfilling its mission of program integrity and quality assurance.
