An MCO or its responsible subcontractor shall implement and maintain arrangements or procedures that are designed to detect and prevent fraud, waste, and abuse, which includes a compliance program that has, at a minimum, the following elements: Written policies, procedures, and standards of conduct that include the MCO’s commitment to comply with all applicable: Requirements and standards under the contract; and Federal and State requirements including: Written policies for all employees and those of any contractor or agent that provide detailed information about the False Claims Act and other Federal and State laws described in §1902(a)(68) of the Social Security Act; and Information about rights of employees to be protected as whistleblowers. The designation of a compliance officer, who reports directly to the chief executive officer and the board of directors and is responsible for developing and implementing policies, procedures, and practices designed to ensure compliance with the requirements of the contract, and at minimum the following staff members: An investigator who is responsible for fraud, waste, and abuse investigations; An auditor who is responsible for identifying potential fraud, waste, and abuse through analysis of claims and related information; and An analyst capable of reviewing data and codes who is responsible for reviewing and researching evidence of potential fraud, waste, and abuse. Staffing and resources located in Maryland to identify and investigate potential fraud, waste, and abuse, which shall be based on criteria determined by the Department that may include but are not limited to: Number of enrollees; Number of claims received on an annual basis; Volume of suspected fraudulent and abusive claims currently being detected; Other factors relating to the vulnerability of the MCO to fraud and abuse; and An assessment of optimal caseload which can be handled by an investigator on an annual basis. The establishment of a regulatory compliance committee, which reports to the board of directors and to the MCO’s senior management level and is charged with overseeing the organization’s compliance program and its compliance with the requirements under the contract; A system for training and educating the compliance officer, the organization’s senior management, and the organization’s employees regarding the federal and State standards and requirements under the contract; Effective lines of communication between the compliance officer and the organization’s employees; Enforcement of standards through well-publicized disciplinary guidelines; Establishment and implementation of procedures and a system with dedicated staff for: Routine internal monitoring and auditing of compliance risks; Prompt response to compliance issues as they are raised; Investigation of potential compliance problems as identified in the course of self-evaluation and audits; Correction of problems, identified under §A(7)(c) of this regulation, promptly and thoroughly, or coordination of suspected criminal acts with law enforcement agencies, to reduce the potential for recurrence; and Ongoing compliance with the requirements under the contract. An MCO shall ensure that a subcontractor is legally qualified to furnish the services provided for in the subcontract. An MCO may not contract with the State unless conflict of interest safeguards at least equal to federal safeguards under section 27 of 41 U.S.C. §423, as amended, are in place. An MCO may not knowingly have a relationship of the type described in §E of this regulation with the following: An individual or entity that is debarred, suspended, or otherwise excluded from: Participating in procurement activities under the Federal Acquisition Regulation; or Participating in non-procurement activities under Executive Order Number 12549, 3 CFR 189 (1986); or An individual or entity who is an affiliate, as defined in 48 CFR §2.101, of a person described in §D(1) of this regulation. The relationships described in §D of this Regulation, are as follows: A director, officer, or partner of the MCO; A subcontractor of the MCO; A person with beneficial ownership of 5 percent or more of the MCO’s equity; or A network provider or person with an employment, consulting or other arrangement with the MCO for the provision of items and services that is significant and material to the MCO’s obligations under its contract with the Department. An MCO may not have a relationship with an individual or entity that is excluded from participation in any Federal health care program under §1128 or 1128A of the Social Security Act. An MCO shall monitor the Department’s correspondence and any database publicizing Department-initiated terminations of providers from the Program. An MCO shall terminate the contract of, or refrain from contracting with, providers terminated or excluded from participation in the Program. An MCO shall suspend payments to a network provider for which the Department has determined that there is a credible allegation of fraud in accordance with 42 CFR §455.23. An MCO shall establish a system to verify, by sampling or other methods, whether services that have been represented to have been delivered by network providers were received by enrollees and shall apply such verification processes at least annually. An MCO shall require and have a mechanism for a network provider to report to the MCO when it has received an overpayment and to: Return the overpayment to the MCO within 60 calendar days after the date on which the overpayment was identified; and Notify the MCO in writing of the reason for the overpayment. Overpayments to Providers and Subcontractors. Overpayments recovered by an MCO, including those recovered due to waste, fraud and abuse, may be retained by the MCO, so long as it is reported to the Department. If the Department, Federal government, or its agents identified the potential fraud, waste, or abuse that leads to recovery of funds paid to an MCO provider, and the MCO did not previously identify and report the provider for potential overpayments, the State shall have the right to recover from the MCO the entire amount of the overpayment. The State shall have the sole right of recovery of an overpayment when the MCO has identified the overpayment and the MCO has not initiated recovery within 90 days after the completion of the MCO’s investigation. The MCO shall have the right to appeal, pursuant to COMAR 10.67.10.02, the Department’s recovery of an overpayment. The Department has the authority to recover any overpayments made to MCOs. An MCO shall ensure that all of its network providers are screened, enrolled, and revalidated by the State as Medicaid providers, in accordance with 42 CFR part 455, subparts B and E. An MCO, its subcontractors, and its subcontractor’s subcontractors shall permit the following organizations or their designees to inspect, evaluate, or audit books, records, contracts, computer or other electronic systems, premises, and facilities that pertain to the MCO’s Medicaid enrollees, and any aspect of services and activities performed, or determination of amounts payable under, the MCO’s contract with the Department: The Department and its agents; The Medicaid Fraud Control Unit of the Office of the Attorney General; The Insurance Fraud Division of the Maryland Insurance Administration; The Centers for Medicare and Medicaid Services; The Inspector General of the Department of Health and Human Services; The Comptroller General; and Other authorized State or federal agencies. The right to inspect, audit, and evaluate shall exist for 10 years from the final date of the contract period or from the completion of any audit, whichever is later, except, if the Department, Centers for Medicare and Medicaid Services, or the Department of Health and Human Services Inspector General determines that there is a reasonable possibility of fraud, or similar risk, those agencies may inspect, audit, and evaluate at any time. Notwithstanding §B of this regulation, the Department has the right to inspect the accuracy, truthfulness, and completeness of the encounter data submitted by, or on behalf of, the MCO. An MCO shall submit to the Department the following: Encounter data in the form and manner described in COMAR 10.67.04.15B, 42 CFR §438.242(c), and 42 CFR §438.818. Data required by the Department in order to certify the actuarial soundness of capitation rates to an MCO, under 42 CFR §438.3, including base data described in 42 CFR §438.5(c) that is generated by the MCO. Data required by the Department to determine compliance of the MCO with the medical loss ratio requirement described in 42 CFR §438.8. Data required by the Department and the Maryland Insurance Administration to determine that the MCO has made adequate provision against the risk of insolvency as required under 42 CFR §438.116. Documentation described in 42 CFR §438.207(b) on which the Department bases its certification that the MCO has complied with the State’s requirements for availability and accessibility of services, including the adequacy of the provider network, as set forth in 42 CFR §438.206. In accordance with §F of this regulation, information on ownership and control described in 42 CFR §455.104 from an MCO and its subcontractors, as governed by 42 CFR §438.230. An annual report of overpayment recoveries as required in 42 CFR §438.608(d)(3). Any other data, documentation, or information relating to the performance of the entity’s obligations under its contract with the Department, or required by the Department or the Secretary of the Department of Health and Human Services. An MCO shall report to the Department any identified inaccuracies in the encounter data reported by the MCO or its subcontractors within 30 days of the date discovered regardless of the effect which the inaccuracy has upon MCO reimbursement. An MCO shall promptly report to the Department’s Office of Inspector General (OIG) any potential fraud, waste, abuse, or information it has received from whistleblowers relating to the integrity of the MCO, its network providers, or its subcontractors. An MCO shall report any potential fraud directly to the Medicaid Fraud Control Unit and the Department’s OIG, including fraud by providers, employees and subcontractors of the MCO, enrollment agents, and enrollees. After reporting any potential fraud, waste, or abuse to the Department’s OIG and to the Medicaid Fraud Control Unit, the MCO may not take the following actions without prior written approval from the State: Contact the subject of the investigation about any matter related to the investigation; Enter into or attempt to negotiate any settlement or agreement regarding the incident; or Accept any monetary or other type of consideration offered by the subject of the investigation in connection with the incident. For complaints of provider fraud and abuse that warrant a preliminary investigation, the MCO’s reports required in §§C and D of this regulation shall include: The number of complaints; The name and identification number of the provider being investigated; The source of the complaint; The type of provider; The nature of the complaint; The approximate dollar amount involved; The legal and administrative disposition of the case; and The method by which the MCO verified that the services being investigated were actually provided to the enrollee. An MCO shall provide to the Department written disclosure of any affiliation prohibited under 42 CFR §438.610 and take action as directed by the Department. An MCO shall provide to the Department written disclosures of information on ownership and control required under 42 CFR §455.104, including: The following information for any individual or corporation with an ownership or control interest in the MCO: For individuals: Name; Address; Date of birth; and Social Security number; and For corporate entities: Name; Applicable primary business address; Every business location and applicable P.O. Box address; and Other tax identification number or any subcontractor in which the MCO has a 5 percent or more interest; Whether the individual or corporation with an ownership or control interest in the MCO: Is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or Whether the individual or corporation with an ownership or control interest in any subcontractor in which the MCO has a 5 percent or more interest is related to another person with ownership or control interest in the MCO as a spouse, parent, child, or sibling; The name of any other MCO in which an owner of the MCO has an ownership or control interest; The name, address, date of birth, and Social Security number of any managing employee or agent of the MCO; Disclosures of ownership and control information from MCOs are due at the following times: Upon application; Upon the managed care entity executing the contract with the State; Upon renewal or extension of the contract; and Within 35 days after any change in ownership of the managed care entity. An MCO shall report to the Department all overpayments identified and recovered, specifying the overpayments due to fraud. An MCO shall report third-party liability collection activities as described in COMAR 10.67.04.18. An MCO shall report to the Department the amounts the MCO has cost-avoided and the number of third-party liability cases the MCO has handled. An MCO shall notify the Department promptly when it has knowledge of an enrollee’s change of residence or death. An MCO shall notify the Department promptly when the MCO receives information about a change in a network provider’s circumstances that may affect the network provider’s eligibility to participate in the Program, including the termination of the provider agreement with the MCO. An MCO shall submit all required data, documentation and information in the format specified by the Department. An MCO’s chief executive officer, chief financial officer, or directly-reporting authorized employee shall certify to the best of that individual’s information, knowledge, and belief, that any records, data, or other documents requested under regulations are accurate, complete and truthful. As directed by the Department’s OIG, the MCO shall submit written reports documenting its Program Integrity efforts, including but not limited to: The dollar amount of losses and recoveries attributable to overpayment, abuse, and fraud; and The number of referrals to the Department’s OIG during the prior State fiscal year. Health-General Article, Title 15, Subtitle 1, Annotated Code of Maryland Effective date: February 26, 2018 (45:4 Md. R. 205) Regulation .01L amended effective December 31, 2018 (45:26 Md. R. 1244) Regulation .01N adopted effective December 31, 2018 (45:26 Md. R. 1244) Chapter transferred from COMAR 10.09.68 effective November 1, 2019 (46:22 Md. R. 977)