(a) Administrative and management arrangements or procedures to detect and prevent fraud, waste and abuse. The State, through its contract with the MCO, PIHP or PAHP, must require that the MCO, PIHP, or PAHP, or subcontractor to the extent that the subcontractor is delegated responsibility by the MCO, PIHP, or PAHP for coverage of services and payment of claims under the contract between the State and the MCO, PIHP, or PAHP, implement and maintain arrangements or procedures that are designed to detect and prevent fraud, waste, and abuse. The arrangements or procedures must include the following:

(1) A compliance program that includes, at a minimum, all of the following elements:

(i) Written policies, procedures, and standards of conduct that articulate the organization's commitment to comply with all applicable requirements and standards under the contract, and all applicable Federal and State requirements.

(ii) The designation of a Compliance Officer who is responsible for developing and implementing policies, procedures, and practices designed to ensure compliance with the requirements of the contract and who reports directly to the Chief Executive Officer and the board of directors.

(iii) The establishment of a Regulatory Compliance Committee on the Board of Directors and at the senior management level charged with overseeing the organization's compliance program and its compliance with the requirements under the contract.

(iv) A system for training and education for the Compliance Officer, the organization's senior management, and the organization's employees for the Federal and State standards and requirements under the contract.

(v) Effective lines of communication between the compliance officer and the organization's employees.

(vi) Enforcement of standards through well-publicized disciplinary guidelines.

(vii) Establishment and implementation of procedures and a system with dedicated staff for routine internal monitoring and auditing of compliance risks, prompt response to compliance issues as they are raised, investigation of potential compliance problems as identified in the course of self-evaluation and audits, correction of such problems promptly and thoroughly (or coordination of suspected criminal acts with law enforcement agencies) to reduce the potential for recurrence, and ongoing compliance with the requirements under the contract.

(2) Provision for prompt reporting of all overpayments identified or recovered, specifying the overpayments due to potential fraud, to the State.

(3) Provision for prompt notification to the State when it receives information about changes in an enrollee's circumstances that may affect the enrollee's eligibility including all of the following:

(i) Changes in the enrollee's residence;

(ii) The death of an enrollee.

(4) Provision for notification to the State when it receives information about a change in a network provider's circumstances that may affect the network provider's eligibility to participate in the managed care program, including the termination of the provider agreement with the MCO, PIHP or PAHP.

(5) Provision for a method to verify, by sampling or other methods, whether services that have been represented to have been delivered by network providers were received by enrollees and the application of such verification processes on a regular basis.

(6) In the case of MCOs, PIHPs, or PAHPs that make or receive annual payments under the contract of at least $5,000,000, provision for written policies for all employees of the entity, and of any contractor or agent, that provide detailed information about the False Claims Act and other Federal and State laws described in section 1902(a)(68) of the Act, including information about rights of employees to be protected as whistleblowers.

(7) Provision for the prompt referral of any potential fraud, waste, or abuse that the MCO, PIHP, or PAHP identifies to the State Medicaid program integrity unit or any potential fraud directly to the State Medicaid Fraud Control Unit.

(8) Provision for the MCO's, PIHP's, or PAHP's suspension of payments to a network provider for which the State determines there is a credible allegation of fraud in accordance with §455.23 of this chapter.

(b) Provider screening and enrollment requirements. The State, through its contracts with a MCO, PIHP, PAHP, PCCM, or PCCM entity must ensure that all network providers are enrolled with the State as Medicaid providers consistent with the provider disclosure, screening and enrollment requirements of part 455, subparts B and E of this chapter. This provision does not require the network provider to render services to FFS beneficiaries.

(c) Disclosures. The State must ensure, through its contracts, that each MCO, PIHP, PAHP, PCCM, PCCM entity, and any subcontractors:

(1) Provides written disclosure of any prohibited affiliation under §438.610.

(2) Provides written disclosures of information on ownership and control required under §455.104 of this chapter.

(3) Reports to the State within 60 calendar days when it has identified the capitation payments or other payments in excess of amounts specified in the contract.

(d) Treatment of recoveries made by the MCO, PIHP or PAHP of overpayments to providers.

(1) Contracts with a MCO, PIHP, or PAHP must specify:

(i) The retention policies for the treatment of recoveries of all overpayments from the MCO, PIHP, or PAHP to a provider, including specifically the retention policies for the treatment of recoveries of overpayments due to fraud, waste, or abuse.

(ii) The process, timeframes, and documentation required for reporting the recovery of all overpayments.

(iii) The process, timeframes, and documentation required for payment of recoveries of overpayments to the State in situations where the MCO, PIHP, or PAHP is not permitted to retain some or all of the recoveries of overpayments.

(iv) This provision does not apply to any amount of a recovery to be retained under False Claims Act cases or through other investigations.

(2) Each MCO, PIHP, or PAHP requires and has a mechanism for a network provider to report to the MCO, PIHP or PAHP when it has received an overpayment, to return the overpayment to the MCO, PIHP or PAHP within 60 calendar days after the date on which the overpayment was identified, and to notify the MCO, PIHP or PAHP in writing of the reason for the overpayment.

(3) Each MCO, PIHP, or PAHP must report annually to the State on their recoveries of overpayments.

(4) The State must use the results of the information and documentation collected in paragraph (d)(1) of this section and the report in paragraph (d)(3) of this section for setting actuarially sound capitation rates for each MCO, PIHP, or PAHP consistent with the requirements in §438.4.