(a) General requirement. An issuer of a risk adjustment covered plan in a State where HHS is operating risk adjustment on behalf of the State for the applicable benefit year must have an initial and second validation audit performed on its risk adjustment data as described in this section.
(b) Initial validation audit. (1) An issuer of a risk adjustment covered plan must engage one or more independent auditors to perform an initial validation audit of a sample of its risk adjustment data selected by HHS. The issuer must provide HHS with the identity of the initial validation auditor, and must attest to the absence of conflicts of interest between the initial validation auditor (or the members of its audit team, owners, directors, officers, or employees) and the issuer (or its owners, directors, officers, or employees), to its knowledge, following reasonable investigation, and must attest that it has obtained an equivalent representation from the initial validation auditor, in a timeframe and manner to be specified by HHS.
(1) An issuer of a risk adjustment covered plan must engage one or more independent auditors to perform an initial validation audit of a sample of its risk adjustment data selected by HHS. The issuer must provide HHS with the identity of the initial validation auditor, and must attest to the absence of conflicts of interest between the initial validation auditor (or the members of its audit team, owners, directors, officers, or employees) and the issuer (or its owners, directors, officers, or employees), to its knowledge, following reasonable investigation, and must attest that it has obtained an equivalent representation from the initial validation auditor, in a timeframe and manner to be specified by HHS.
(2) The issuer must ensure that the initial validation auditors are reasonably capable of performing an initial data validation audit according to the standards established by HHS for such audit, and must ensure that the audit is so performed.
(3) The issuer must ensure that each initial validation auditor is reasonably free of conflicts of interest, such that it is able to conduct the initial validation audit in an impartial manner and its impartiality is not reasonably open to question.
(4) The issuer must ensure validation of the accuracy of risk adjustment data for a sample of enrollees selected by HHS. The issuer must ensure that the initial validation audit findings are submitted to HHS in a manner and timeframe specified by HHS.
(5) An initial validation audit must be conducted by medical coders certified as such and in good standing by a nationally recognized accrediting agency.
(6) An issuer must provide the initial validation auditor and the second validation auditor with all relevant source enrollment documentation, all claims and encounter data, and medical record documentation from providers of services to each enrollee in the applicable sample without unreasonable delay and in a manner that reasonably assures confidentiality and security in transmission.
(7) The risk score of each enrollee in the sample must be validated by--
(i) Validating the enrollee's enrollment data and demographic data in a manner to be determined by HHS.
(ii) Validating enrollee health status through review of all relevant medical record documentation. Medical record documentation must originate from the provider of the services and align with dates of service for the medical diagnoses, and reflect permitted providers and services. For purposes of this section, ``medical record documentation'' means clinical documentation of hospital inpatient or outpatient treatment or professional medical treatment from which enrollee health status is documented and related to accepted risk adjustment services that occurred during a specified period of time. Medical record documentation must be generated under a face-to-face or telehealth visit documented and authenticated by a permitted provider of services;
(iii) Validating medical records according to industry standards for coding and reporting; and
(iv) Having a senior reviewer confirm any enrollee risk adjustment error discovered during the initial validation audit. For purposes of this section, a ``senior reviewer'' is a reviewer certified as a medical coder by a nationally recognized accrediting agency who possesses at least 5 years of experience in medical coding. However, for validation of risk adjustment data for the 2014 and 2015 benefit years, a senior reviewer may possess 3 or more years of experience.
(8) The initial validation auditor must measure and report to the issuer and HHS, in a manner and timeframe specified by HHS, its inter-rater reliability rates among its reviewers. The initial validation auditor must achieve a consistency measure of at least 95 percent for his or her review outcomes. However, for validation of risk adjustment data for the 2014 and 2015 benefit years, the initial validation auditor may meet an inter-rater reliability standard of 85 percent for review outcomes.
(9) Enforcement actions. If an issuer of a risk adjustment covered plan fails to engage an initial validation auditor or to submit the results of an initial validation audit to HHS, HHS may impose civil money penalties in accordance with the procedures set forth in Sec. 156.805 of this subchapter.
(10) Default data validation charge. If an issuer of a risk adjustment covered plan fails to engage an initial validation auditor or to submit the results of an initial validation audit to HHS, HHS will impose a default risk adjustment charge.
(c) Second validation audit. HHS will select a subsample of the risk adjustment data validated by the initial validation audit for a second validation audit. The issuer must comply with, and must ensure the initial validation auditor complies with, standards for such audit established by HHS, and must cooperate with, and must ensure that the initial validation auditor cooperates with, HHS and the second validation auditor in connection with such audit.
(d) Data validation appeals. An issuer may appeal the findings of a second validation audit or the application of a risk score error rate to its risk adjustment payments and charges.
(e) Adjustment of payments and charges. HHS may adjust payments and charges for issuers that do not comply with audit requirements and standards, as specified in paragraphs (b) and (c) of this section.
(f) Data security and transmission. (1) An issuer must submit the risk adjustment data and source documentation for the initial and second validation audits specified by HHS to HHS or its designee in the manner and timeframe specified by HHS.
(1) An issuer must submit the risk adjustment data and source documentation for the initial and second validation audits specified by HHS to HHS or its designee in the manner and timeframe specified by HHS.
(2) An issuer must ensure that it and its initial validation auditor comply with the security standards described at 45 CFR 164.308, 164.310, and 164.312 in connection with the initial validation audit, the second validation audit, and any appeal. [78 FR 15531, Mar. 11, 2013, as amended at 79 FR 13836, Mar. 11, 2014]