§ 363-d. Provider compliance program. 1. The legislature finds that
medical assistance providers may be able to detect and correct payment
and billing mistakes and fraud if required to develop and implement
compliance programs. It is the purpose of such programs to organize
provider resources to resolve payment discrepancies and detect
inaccurate billings, among other things, as quickly and efficiently as
possible, and to impose systemic checks and balances to prevent future
recurrences. The legislature accordingly declares that it is in the
public interest that providers within the medical assistance program
implement compliance programs. The legislature also recognizes the wide
variety of provider types in the medical assistance program and the need
for compliance programs that reflect a provider's size, complexity,
resources, and culture. For a compliance program to be effective, it
must be designed to be compatible with the provider's characteristics.
At the same time, however, the legislature determines that there are key
components that must be included in every compliance program and such
components should be required if a provider is to be a medical
assistance program participant. Accordingly, the provisions of this
section require providers to adopt effective compliance program
elements, and make each provider responsible for implementing such a
program appropriate to its characteristics.

2. Every provider of medical assistance program items and services
that is subject to subdivision four of this section shall adopt and
implement a compliance program. The office of Medicaid inspector general
shall create and make available on its website guidelines, which may
include a model compliance program, that reflect the requirements of
this section. Such compliance programs shall meet the requirements
included in this subdivision as a condition of payment from the medical
assistance program. The compliance program required pursuant to this
section may be a component of more comprehensive compliance activities
by the medical assistance provider so long as the requirements of this
section are met. Every provider shall adopt and implement an effective
compliance program, which shall include measures that prevent, detect,
and correct non-compliance with medical assistance program requirements
as well as measures that prevent, detect, and correct fraud, waste, and
abuse. The compliance program shall include the following requirements:

(a) Written policies, procedures, and standards of conduct that:

(1) articulate the organization's commitment to comply with all
applicable federal and state standards;

(2) describe compliance expectations as embodied in the standards of
conduct;

(3) implement the operation of the compliance program;

(4) provide guidance to employees and others on dealing with potential
compliance issues;

(5) identify how to communicate compliance issues to appropriate
compliance personnel;

(6) describe how potential compliance issues are investigated and
resolved by the organization;

(7) include a policy of non-intimidation and non-retaliation for good
faith participation in the compliance program, including but not limited
to reporting potential issues, investigating issues, conducting
self-evaluations, audits and remedial actions, and reporting to
appropriate officials; and

(8) all requirements listed under 42 U.S.C.1396-a(a)(68).

(b) Designation of a compliance officer and a compliance committee who
report directly and are accountable to the organization's chief
executive or other senior management.

(c)(1) Each provider shall establish and implement effective training
and education for its compliance officer and organization employees, the
chief executive and other senior administrators, managers and governing
body members.

(2) Such training and education shall occur at a minimum annually and
shall be made a part of the orientation for a new employee and new
appointment of a chief executive, manager, or governing body member.

(d) Establishment and implementation of effective lines of
communication, ensuring confidentiality, between the compliance officer,
members of the compliance committee, the organization's employees,
managers and governing body, and the organizations first tier,
downstream, and related entities. Such lines of communication shall be
accessible to all and allow compliance issues to be reported including a
method for anonymous and confidential good faith reporting of potential
compliance issues as they are identified.

(e) Well-publicized disciplinary standards through the implementation
of procedures which encourage good faith participation in the compliance
program by all affected individuals.

(f) Establishment and implementation of an effective system for
routine monitoring and identification of compliance risks. The system
should include internal monitoring and audits and, as appropriate,
external audits, to evaluate the organization's compliance with the
medical assistance program requirements and the overall effectiveness of
the compliance program.

(g) Establishment and implementation of procedures and a system for
promptly responding to compliance issues as they are raised,
investigating potential compliance problems as identified in the course
of self-evaluations and audits, correcting such problems promptly and
thoroughly to reduce the potential for recurrence, and ensure ongoing
compliance with the medical assistance programs requirements.

3. Upon enrollment in the medical assistance program, a provider shall
certify to the department that the provider satisfactorily meets the
requirements of this section. Additionally, the commissioner of health
and Medicaid inspector general shall have the authority to determine at
any time if a provider has a compliance program that satisfactorily
meets the requirements of this section.

(a) A compliance program that is accepted by the federal department of
health and human services office of inspector general and remains in
compliance with the standards promulgated by such office shall be deemed
in compliance with the provisions of this section, so long as such plans
adequately address medical assistance program risk areas and compliance
issues.

(b) A compliance program that meets Federal requirements for managed
care provider compliance programs, as specified in the contract or
contracts between the department and the Medicaid managed care provider
shall be deemed in compliance with the provisions in this section, so
long as such programs adequately address medical assistance program risk
areas and compliance issues. For purposes of this section, a managed
care provider is as defined in paragraph (c) of subdivision one of
section three hundred sixty-four-j of this chapter, and includes managed
long term care plans.

(c) In the event that the commissioner of health or the Medicaid
inspector general finds that the provider does not have a satisfactory
program within ninety days after the effective date of the regulations
issued pursuant to subdivision four of this section, the provider may be
subject to any sanctions or penalties permitted by federal or state laws
and regulations, including revocation of the provider's agreement to
participate in the medical assistance program.

(d)(1) In the first instance of the Medicaid inspector general's
determination that the provider, including a Medicaid managed care
provider, that has failed to adopt and implement a compliance program
which satisfactorily meets the requirements of this section, the
Medicaid inspector general may impose a monetary penalty of five
thousand dollars per calendar month, for a maximum of twelve calendar
months against a provider, including Medicaid managed care providers.

(2) The Medicaid inspector general may impose a monetary penalty of up
to ten thousand dollars per calendar month, for a maximum of twelve
calendar months against a provider, including a Medicaid managed care
provider, that has failed to adopt and implement a compliance program
which satisfactorily meets the requirements of this section, if a
penalty was previously imposed under subparagraph one of this paragraph
within the previous five years.

(e) A provider, including a Medicaid managed care provider, against
whom a monetary penalty is imposed pursuant to paragraph (d) of this
subdivision shall be entitled to notice and an opportunity to be heard,
including the right to request a hearing pursuant to section twenty-two
of this chapter.

4. Providers that shall be subject to the provisions of this section
include, but are not limited to:

(a) those subject to the provisions of articles twenty-eight and
thirty-six of the public health law;

(b) those subject to the provisions of articles sixteen and thirty-one
of the mental hygiene law;

(c) notwithstanding the provisions of section forty-four hundred
fourteen of the public health law, managed care providers, as defined in
section three hundred sixty-four-j of this title and includes managed
long-term care plans; and

(d) other providers of care, services and supplies under the medical
assistance program for which the medical assistance program is a
substantial portion of their business operations.

5. (a) The Medicaid inspector general, in consultation with the
department of health, shall promulgate any regulations necessary to
implement this section.

(b) The Medicaid inspector general shall accept programs and processes
implemented pursuant to section forty-four hundred fourteen of the
public health law as satisfying the obligations of this section and the
regulations promulgated thereunder when such programs and processes
incorporate the objectives contemplated by this section.

6. (a) If a person has received an overpayment under the medical
assistance program, the person shall:

(1) report and return the overpayment to the department; and

(2) notify the Medicaid inspector general in writing of the reason for
the overpayment.

(b) An overpayment shall be reported and returned under paragraph (a)
of this subdivision by the later of: (1) the date which is sixty days
after the date on which the overpayment was identified; or (2) the date
any corresponding cost report is due, if applicable. A person has
identified an overpayment when the person has or should have through the
exercise of reasonable diligence, determined that the person has
received an overpayment and quantified the amount of the overpayment. A
person should have determined that the person received an overpayment
and quantified the amount of the overpayment if the person fails to
exercise reasonable diligence and the person in fact received an
overpayment.

(c) The deadline for returning overpayments shall be tolled when the
following occurs:

(1) the Medicaid inspector general acknowledges receipt of a
submission to the Medicaid inspector general's self-disclosure program
under subdivision seven of this section, and shall remain tolled until
such time as a self-disclosure and compliance agreement, pursuant to
subdivision seven of this section is fully executed, the person
withdraws from the self-disclosure program, the person repays the
overpayment and any interest due, or the person is removed from the
self-disclosure program by the Medicaid inspector general; or

(2) in the absence of a finding of fraud a person may repay an
overpayment through installment payments as described in subdivision
seven of this section and shall remain tolled until such time as the
provider repays the overpayment and any interest due, the Medicaid
inspector general rejects the installment payment schedule requested by
the provider, or the provider fails to comply with the terms of the
installment payment schedule.

(d) Any overpayment retained by a person after the deadline for
reporting and returning the overpayment under paragraph (b) of this
subdivision shall be subject to a monetary penalty pursuant to
subdivision four of section one hundred forty-five-b of this article.

(e) For purposes of this subdivision, "person" means a provider of
services or supplies, managed care provider, as defined in paragraph (b)
of subdivision one of section three hundred sixty-four-j of this title
and includes managed long-term care plans, and does not include
recipients of the medical assistance program.

7. Self-disclosure program. (a) Notwithstanding the provisions of any
other law to the contrary, there is hereby established a voluntary
self-disclosure program to be administered by the Medicaid inspector
general, in consultation with the commissioner, for all persons
described in this section owing any overpayment to the medical
assistance program.

(b) For purposes of this subdivision, "person" means any person
providing services or receiving payment under the medical assistance
program, a managed care provider as defined in paragraph (b) of
subdivision one of section three hundred sixty-four-j of this title,
including managed long-term care plans, and any subcontractors or
network providers thereof.

(c) In order to be eligible to participate in the self-disclosure
program, a person shall satisfy the following conditions:

(1) the person is not currently under audit, investigation or review
by the Medicaid inspector general, unless the overpayment and the
related conduct being disclosed does not relate to the Medicaid
inspector general's audit, investigation or review;

(2) the person is disclosing an overpayment and related conduct that
the Medicaid inspector general has not determined, calculated,
researched or identified at the time of the disclosure;

(3) the overpayment and related conduct is reported by the deadline
specified in subdivision six of this section; and

(4) the person is not currently a party to any criminal investigation
being conducted by the deputy attorney general for the Medicaid fraud
control unit or an agency of the United States government or any
political subdivision thereof.

(d) Notwithstanding subdivision three of section one hundred
forty-five-b of this article, the Medicaid inspector general may waive
interest on any overpayment reported, returned, and explained by an
eligible person under this subdivision. Furthermore, an eligible
person's good faith participation in the self-disclosure program may be
considered as a mitigating factor in the determination of an
administrative enforcement action.

(e) To participate in the self-disclosure program, an eligible person
shall apply by submitting a self-disclosure statement in the form and
manner prescribed by the Medicaid inspector general. The statement shall
contain all the information required by the Medicaid inspector general
to effectively administer the self-disclosure program.

(f) (1) The eligible person shall pay the overpayment amount
determined by the Medicaid inspector general to the department within
fifteen days of the Medicaid inspector general notifying the person of
the amount due.

(2) In the event the Medicaid inspector general is satisfied that the
person cannot make immediate full payment of the disclosed overpayment,
the Medicaid inspector general may permit the person to repay the
overpayment and any interest due through installment payments. The
Medicaid inspector general may require a financial disclosure statement
setting forth information concerning the person's current assets,
liabilities, earnings, and other financial information before entering
into an installment payment plan with the person.

(3) If the person and the overpayment are eligible under the
self-disclosure program, the Medicaid inspector general shall be
authorized to enter into a self-disclosure and compliance agreement with
the person. The self-disclosure and compliance agreement shall be in a
form to be established by the Medicaid inspector general and include
such terms as the Medicaid inspector general shall require for the
repayment of the person's disclosed overpayment and enable and require
the person to comply with the requirements of the medical assistance
program in the future. The person shall execute the self-disclosure and
compliance agreement within fifteen days of receiving said agreement
from the Medicaid inspector general, or such other timeframe permitted
by the Medicaid inspector general, provided however, that such other
period is not less than fifteen days.

(4) If the person provides false material information or omits
material information in his or her submissions to the Medicaid inspector
general, or attempts to defeat or evade an overpayment due pursuant to
the self-disclosure and compliance agreement executed under this
subdivision, or fails to comply with the terms of the self-disclosure
and compliance agreement, or refuses to execute the self-disclosure and
compliance agreement in the timeframes specified under this section,
such agreement shall be deemed rescinded and the provider's
participation in the self-disclosure program terminated.

(5) A person against whom a self-disclosure and compliance agreement
is rescinded and participation in the self-disclosure program is
terminated pursuant to subparagraph four of this paragraph shall be
entitled to notice.

(g) The Medicaid inspector general, in consultation with the
commissioner, may promulgate regulations, issue forms and instructions,
and take any and all other actions necessary to implement the provisions
of the self-disclosure program established under this section to
maximize public awareness and participation in such program.