1Proprietary Information of UnitedHealth Group. Do not distribute or reproduce without express permission of UnitedHealth Group.

New Policy: CMS’s Right to Contact FDRs Directly

In May 2014, CMS issued a final rule which allows CMS and its designees to collect records directly from any first tier, downstream, or related entity (FDRs).

Purpose of Rule: To allow CMS access to FDR data in a timely manner. CMS noted that they will default to requesting information through the Plan and will use the ‘‘direct access route in circumstances where either (a) the results of data analytics, complaints, and/or investigations indicate a suspicion of fraud, waste, or abuse in the Medicare Part C or D programs or (b) in the case of an urgent law enforcement matter.”

Additional guidance: Sub-regulatory guidance on CMS’ standards for determining when direct requests of FDRs would be appropriate is forthcoming.

Policy Highlights• Outlines the rule• Describes UHC’s immediate obligations to prepare for the changes• Outlines the actions required by UHC and the FDR when either

party receives notification of a direct request

Policy Details… Action Now

United is in the process of the following actions:

• Notify the business leaders, compliance owners and vendor relationship owners (VROs) of the rule.

• Ensure the VRO reviews service level agreements, statement of works, memorandums of understandings, or other applicable documents to ensure the requirement to respond to a direct request for information from CMS is included.

• Evaluate policy and procedure revisions, as necessary, to outline the requirement to respond to CMS requests.

2Proprietary Information of UnitedHealth Group. Do not distribute or reproduce without express permission of UnitedHealth Group.

Policy Details: United Action

Actions United must take when notice is received:

• Contact the FDR to confirm their receipt of the notice;

• Confirm the timeline to complete the request and the FDR’s ability to submit the requested information within the required timeframe; and

• Assist the FDR with review of the material to ensure responsiveness and appropriateness of the request.

3Proprietary Information of UnitedHealth Group. Do not distribute or reproduce without express permission of UnitedHealth Group.

Policy Details: FDR Action

Actions the FDR must take when notice is received:

• Notify United within 24 hours of receipt of the request. • Including details of the request, notifying party and timeframe.

• Work with United to identify any potential contractual or compliance deficiencies related to the request, any inability to produce the information or failure to meet the timeframe.

• Provide the information in a timely manner and ensure that the response to request for information is appropriate.

• Provide United a copy the response as delivered to CMS

• Copy should be sent to edo_compliance@uhc.com

4Proprietary Information of UnitedHealth Group. Do not distribute or reproduce without express permission of UnitedHealth Group.

Next Steps

• Oversight Committee approval

• Formal adoption to eGRC; including interfacing with the Governance team to align with other compliance policies

• Compliance Officers will circulate to delegate owners• Compliance Executive Communication• Network Provider Bulletin (monthly)• Delegated Entity Annual Compliance Communication • Other communications, as necessary (which may vary by leader)

5Proprietary Information of UnitedHealth Group. Do not distribute or reproduce without express permission of UnitedHealth Group.