PART 455—PROGRAM INTEGRITY: MEDICAID Authority: 42 U.S.C. 1302. Source: 43 FR 45262, Sept. 29, 1978, unless otherwise noted. § 455.1 Basis and scope. This part sets forth requirements for a State fraud detection and investigation program, and for disclosure of information on ownership and control. (a) Under the authority of sections 1902(a)(4), 1903(i)(2), and 1909 of the Social Security Act, Subpart A provides State plan requirements for the identification, investigation, and referral of suspected fraud and abuse cases. In addition, the subpart requires that the State— (1) Report fraud and abuse information to the Department; and (2) Have a method to verify whether services reimbursed by Medicaid were actually furnished to beneficiaries. (b) Subpart B implements sections 1124, 1126, 1902(a)(36), 1903(i)(2), and 1903(n) of the Act. It requires that providers and fiscal agents must agree to disclose ownership and control information to the Medicaid State agency. (c) Subpart C implements section 1936 of the Act. It establishes the Medicaid Integrity Program under which the Secretary will promote the integrity of the program by entering into contracts with eligible entities to carry out the activities of subpart C. [51 FR 34787, Sept. 30, 1986, as amended at 72 FR 67655, Nov. 30, 2007] § 455.2 Definitions. As used in this part unless the context indicates otherwise— Abuse Conviction Convicted Credible allegation of fraud. (1) Fraud hotline tips verified by further evidence. (2) Claims data mining. (3) Patterns identified through provider audits, civil false claims cases, and law enforcement investigations. Allegations are considered to be credible when they have indicia of reliability and the State Medicaid agency has reviewed all allegations, facts, and evidence carefully and acts judiciously on a case-by-case basis. Exclusion Fraud Fraud hotline tip. Furnished Practitioner Suspension [48 FR 3755, Jan. 27, 1983, as amended at 50 FR 37375, Sept. 13, 1985; 51 FR 34788, Sept. 30, 1986; 76 FR 5965, Feb. 2, 2011; 86 FR 6131, Jan. 19, 2021] § 455.3 Other applicable regulations. Part 1002 of this title sets forth the following: (a) State plan requirements for excluding providers for fraud and abuse, and suspending practitioners convicted of program-related crimes. (b) The limitations on FFP for services furnished by excluded providers or suspended practitioners. (c) The requirements and procedures for reinstatement after exclusion or suspension. (d) Requirements for the establishment and operation of State Medicaid fraud control units and the rates of FFP for their fraud control activities. [51 FR 34788, Sept. 30, 1986] Subpart A—Medicaid Agency Fraud Detection and Investigation Program § 455.12 State plan requirement. A State plan must meet the requirements of §§ 455.13 through 455.23. [52 FR 48817, Dec. 28, 1987] § 455.13 Methods for identification, investigation, and referral. The Medicaid agency must have— (a) Methods and criteria for identifying suspected fraud cases; (b) Methods for investigating these cases that— (1) Do not infringe on the legal rights of persons involved; and (2) Afford due process of law; and (c) Procedures, developed in cooperation with State legal authorities, for referring suspected fraud cases to law enforcement officials. [43 FR 45262, Sept. 29, 1978, as amended at 48 FR 3755, Jan. 27, 1983] § 455.14 Preliminary investigation. If the agency receives a complaint of Medicaid fraud or abuse from any source or identifies any questionable practices, it must conduct a preliminary investigation to determine whether there is sufficient basis to warrant a full investigation. [48 FR 3756, Jan. 27, 1983] § 455.15 Full investigation. If the findings of a preliminary investigation give the agency reason to believe that an incident of fraud or abuse has occurred in the Medicaid program, the agency must take the following action, as appropriate: (a) If a provider is suspected of fraud or abuse, the agency must— (1) In States with a State Medicaid fraud control unit certified under subpart C of part 1002 of this title, refer the case to the unit under the terms of its agreement with the unit entered into under § 1002.309 of this title; or (2) In States with no certified Medicaid fraud control unit, or in cases where no referral to the State Medicaid fraud control unit is required under paragraph (a)(1) of this section, conduct a full investigation or refer the case to the appropriate law enforcement agency. (b) If there is reason to believe that a beneficiary has defrauded the Medicaid program, the agency must refer the case to an appropriate law enforcement agency. (c) If there is reason to believe that a beneficiary has abused the Medicaid program, the agency must conduct a full investigation of the abuse. [48 FR 3756, Jan. 27, 1983, as amended at 51 FR 34788, Sept. 30, 1986] § 455.16 Resolution of full investigation. A full investigation must continue until— (a) Appropriate legal action is initiated; (b) The case is closed or dropped because of insufficient evidence to support the allegations of fraud or abuse; or (c) The matter is resolved between the agency and the provider or beneficiary. This resolution may include but is not limited to— (1) Sending a warning letter to the provider or beneficiary, giving notice that continuation of the activity in question will result in further action; (2) Suspending or terminating the provider from participation in the Medicaid program; (3) Seeking recovery of payments made to the provider; or (4) Imposing other sanctions provided under the State plan. [43 FR 45262, Sept. 29, 1978, as amended at 48 FR 3756, Jan. 27, 1983] § 455.17 Reporting requirements. The agency must report the following fraud or abuse information to the appropriate Department officials at intervals prescribed in instructions. (a) The number of complaints of fraud and abuse made to the agency that warrant preliminary investigation. (b) For each case of suspected provider fraud and abuse that warrants a full investigation— (1) The provider's name and number; (2) The source of the complaint; (3) The type of provider; (4) The nature of the complaint; (5) The approximate range of dollars involved; and (6) The legal and administrative disposition of the case, including actions taken by law enforcement officials to whom the case has been referred. (Approved by the Office of Management and Budget under control number 0938-0076) [43 FR 45262, Sept. 29, 1978, as amended at 48 FR 3756, Jan. 27, 1983] § 455.18 Provider's statements on claims forms. (a) Except as provided in § 455.19, the agency must provide that all provider claims forms be imprinted in boldface type with the following statements, or with alternate wording that is approved by the Regional CMS Administrator: (1) “This is to certify that the foregoing information is true, accurate, and complete.” (2) “I understand that payment of this claim will be from Federal and State funds, and that any falsification, or concealment of a material fact, may be prosecuted under Federal and State laws.” (b) The statements may be printed above the claimant's signature or, if they are printed on the reverse of the form, a reference to the statements must appear immediately preceding the claimant's signature. § 455.19 Provider's statement on check. As an alternative to the statements required in § 455.18, the agency may print the following wording above the claimant's endorsement on the reverse of checks or warrants payable to each provider: “I understand in endorsing or depositing this check that payment will be from Federal and State funds and that any falsification, or concealment of a material fact, may be prosecuted under Federal and State laws.” § 455.20 Beneficiary verification procedure. (a) The agency must have a method for verifying with beneficiaries whether services billed by providers were received. (b) In States receiving Federal matching funds for a mechanized claims processing and information retrieval system under part 433, subpart C, of this subchapter, the agency must provide prompt written notice as required by § 433.116 (e) and (f). [48 FR 3756, Jan. 27, 1983, as amended at 56 FR 8854, Mar. 1, 1991] § 455.21 Cooperation with State Medicaid fraud control units. In a State with a Medicaid fraud control unit established and certified under subpart C of this part, (a) The agency must— (1) Refer all cases of suspected provider fraud to the unit; (2) If the unit determines that it may be useful in carrying out the unit's responsibilities, promptly comply with a request from the unit for— (i) Access to, and free copies of, any records or information kept by the agency or its contractors; (ii) Computerized data stored by the agency or its contractors. These data must be supplied without charge and in the form requested by the unit; and (iii) Access to any information kept by providers to which the agency is authorized access by section 1902(a)(27) of the Act and § 431.107 of this subchapter. In using this information, the unit must protect the privacy rights of beneficiaries; and (3) On referral from the unit, initiate any available administrative or judicial action to recover improper payments to a provider. (b) The agency need not comply with specific requirements under this subpart that are the same as the responsibilities placed on the unit under subpart D of this part. (c) The agency must enter into a written agreement with the unit under which: (1) The agency will agree to comply with all requirements of § 455.21(a); (2) The unit will agree to comply with the requirements of § 1007.11(c) of this title; and (3) The agency and the unit will agree to— (i) Establish a practice of regular meetings or communication between the two entities; (ii) Establish procedures for how they will coordinate their efforts; (iii) Establish procedures for §§ 1007.9(e) through 1007.9(h) of this title; (iv) Establish procedures by which the unit will receive referrals of potential fraud from managed care organizations, if applicable, either directly or through the agency, as required at § 438.608(a)(7) of this title; and (v) Review and, as necessary, update the agreement no less frequently than every five (5) years to ensure that the agreement reflects current law and practice. [43 FR 45262, Sept. 29, 1978, as amended at 84 FR 10713, Mar. 22, 2019] § 455.23 Suspension of payments in cases of fraud. (a) Basis for suspension. (2) The State Medicaid agency may suspend payments without first notifying the provider of its intention to suspend such payments. (3) A provider may request, and must be granted, administrative review where State law so requires. (b) Notice of suspension. (i) Five days of taking such action unless requested in writing by a law enforcement agency to temporarily withhold such notice. (ii) Thirty days if requested by law enforcement in writing to delay sending such notice, which request for delay may be renewed in writing up to twice and in no event may exceed 90 days. (2) The notice must include or address all of the following: (i) State that payments are being suspended in accordance with this provision. (ii) Set forth the general allegations as to the nature of the suspension action, but need not disclose any specific information concerning an ongoing investigation. (iii) State that the suspension is for a temporary period, as stated in paragraph (c) of this section, and cite the circumstances under which the suspension will be terminated. (iv) Specify, when applicable, to which type or types of Medicaid claims or business units of a provider suspension is effective. (v) Inform the provider of the right to submit written evidence for consideration by State Medicaid Agency. (vi) Set forth the applicable State administrative appeals process and corresponding citations to State law. (c) Duration of suspension. (i) The agency or the prosecuting authorities determine that there is insufficient evidence of fraud by the provider. (ii) Legal proceedings related to the provider's alleged fraud are completed. (2) A State must document in writing the termination of a suspension including, where applicable and appropriate, any appeal rights available to a provider. (d) Referrals to the Medicaid fraud control unit. (i) To a Medicaid fraud control unit established and certified under part 1007 of this title; or (ii) In States with no certified Medicaid fraud control unit, to an appropriate law enforcement agency. (2) The fraud referral made under paragraph (d)(1) of this section must meet all of the following requirements: (i) Be made in writing and provided to the Medicaid fraud control unit not later than the next business day after the suspension is enacted. (ii) Conform to fraud referral performance standards issued by the Secretary. (3)(i) If the Medicaid fraud control unit or other law enforcement agency accepts the fraud referral for investigation, the payment suspension may be continued until such time as the investigation and any associated enforcement proceedings are completed. (ii) On a quarterly basis, the State must request a certification from the Medicaid fraud control unit or other law enforcement agency that any matter accepted on the basis of a referral continues to be under investigation thus warranting continuation of the suspension. (4) If the Medicaid fraud control unit or other law enforcement agency declines to accept the fraud referral for investigation the payment suspension must be discontinued unless the State Medicaid agency has alternative Federal or State authority by which it may impose a suspension or makes a fraud referral to another law enforcement agency. In that situation, the provisions of paragraph (d)(3) of this section apply equally to that referral as well. (5) A State's decision to exercise the good cause exceptions in paragraphs (e) or (f) of this section not to suspend payments or to suspend payments only in part does not relieve the State of the obligation to refer any credible allegation of fraud as provided in paragraph (d)(1) of this section. (e) Good cause not to suspend payments. (1) Law enforcement officials have specifically requested that a payment suspension not be imposed because such a payment suspension may compromise or jeopardize an investigation. (2) Other available remedies implemented by the State more effectively or quickly protect Medicaid funds. (3) The State determines, based upon the submission of written evidence by the individual or entity that is the subject of the payment suspension, that the suspension should be removed. (4) beneficiary access to items or services would be jeopardized by a payment suspension because of either of the following: (i) An individual or entity is the sole community physician or the sole source of essential specialized services in a community. (ii) The individual or entity serves a large number of beneficiaries within a HRSA-designated medically underserved area. (5) Law enforcement declines to certify that a matter continues to be under investigation per the requirements of paragraph (d)(3) of this section. (6) The State determines that payment suspension is not in the best interests of the Medicaid program. (f) Good cause to suspend payment only in part. (1) beneficiary access to items or services would be jeopardized by a payment suspension in whole or part because of either of the following: (i) An individual or entity is the sole community physician or the sole source of essential specialized services in a community. (ii) The individual or entity serves a large number of beneficiaries within a HRSA-designated medically underserved area. (2) The State determines, based upon the submission of written evidence by the individual or entity that is the subject of a whole payment suspension, that such suspension should be imposed only in part. (3)(i) The credible allegation focuses solely and definitively on only a specific type of claim or arises from only a specific business unit of a provider; and (ii) The State determines and documents in writing that a payment suspension in part would effectively ensure that potentially fraudulent claims were not continuing to be paid. (4) Law enforcement declines to certify that a matter continues to be under investigation per the requirements of paragraph (d)(3) of this section. (5) The State determines that payment suspension only in part is in the best interests of the Medicaid program. (g) Documentation and record retention. (1) Maintain for a minimum of 5 years from the date of issuance all materials documenting the life cycle of a payment suspension that was imposed in whole or part, including the following: (i) All notices of suspension of payment in whole or part. (ii) All fraud referrals to the Medicaid fraud control unit or other law enforcement agency. (iii) All quarterly certifications of continuing investigation status by law enforcement. (iv) All notices documenting the termination of a suspension. (2)(i) Maintain for a minimum of 5 years from the date of issuance all materials documenting each instance where a payment suspension was not imposed, imposed only in part, or discontinued for good cause. (ii) This type of documentation must include, at a minimum, detailed information on the basis for the existence of the good cause not to suspend payments, to suspend payments only in part, or to discontinue a payment suspension and, where applicable, must specify how long the State anticipates such good cause will exist. (3) Annually report to the Secretary summary information on each of following: (i) Suspension of payment, including the nature of the suspected fraud, the basis for suspension, and the outcome of the suspension. (ii) Situation in which the State determined good cause existed to not suspend payments, to suspend payments only in part, or to discontinue a payment suspension as described in this section, including describing the nature of the suspected fraud and the nature of the good cause. [76 FR 5966, Feb. 2, 2011] Subpart B—Disclosure of Information by Providers and Fiscal Agents Source: 44 FR 41644, July 17, 1979, unless otherwise noted. § 455.100 Purpose. This subpart implements sections 1124, 1126, 1902(a)(38), 1903(i)(2), and 1903(n) of the Social Security Act. It sets forth State plan requirements regarding— (a) Disclosure by providers and fiscal agents of ownership and control information; and (b) Disclosure of information on a provider's owners and other persons convicted of criminal offenses against Medicare, Medicaid, or the title XX services program. The subpart also specifies conditions under which the Administrator will deny Federal financial participation for services furnished by providers or fiscal agents who fail to comply with the disclosure requirements. § 455.101 Definitions. Additional disclosable party (1) Exercises operational, financial, or managerial control over the facility or a part thereof, or provides policies or procedures for any of the operations of the facility, or provides financial or cash management services to the facility; (2) Leases or subleases real property to the facility, or owns a whole or part interest equal to or exceeding 5 percent of the total value of such real property; or (3) Provides management or administrative services, management or clinical consulting services, or accounting or financial services to the facility. Affiliation (1) A 5 percent or greater direct or indirect ownership interest that an individual or entity has in another organization. (2) A general or limited partnership interest (regardless of the percentage) that an individual or entity has in another organization. (3) An interest in which an individual or entity exercises operational or managerial control over, or directly or indirectly conducts, the day-to-day operations of another organization (including, for purposes of this paragraph (3), sole proprietorships), either under contract or through some other arrangement, regardless of whether or not the managing individual or entity is a W-2 employee of the organization. (4) An interest in which an individual is acting as an officer or director of a corporation. (5) Any payment assignment relationship under § 447.10(g) of this chapter. Agent Disclosable event (1) Currently has an uncollected debt to Medicare, Medicaid, or CHIP, regardless of— (i) The amount of the debt; (ii) Whether the debt is currently being repaid (for example, as part of a repayment plan); or (iii) Whether the debt is currently being appealed; (2) Has been or is subject to a payment suspension under a federal health care program (as that latter term is defined in section 1128B(f) of the Act), regardless of when the payment suspension occurred or was imposed; (3) Has been or is excluded by the OIG from participation in Medicare, Medicaid, or CHIP, regardless of whether the exclusion is currently being appealed or when the exclusion occurred or was imposed; or (4) Has had its Medicare, Medicaid, or CHIP enrollment denied, revoked or terminated, regardless of— (i) The reason for the denial, revocation, or termination; (ii) Whether the denial, revocation, or termination is currently being appealed; or (iii) When the denial, revocation, or termination occurred or was imposed. Disclosing entity Other disclosing entity (a) Any hospital, skilled nursing facility, home health agency, independent clinical laboratory, renal disease facility, rural health clinic, or health maintenance organization that participates in Medicare (title XVIII); (b) Any Medicare intermediary or carrier; and (c) Any entity (other than an individual practitioner or group of practitioners) that furnishes, or arranges for the furnishing of, health-related services for which it claims payment under any plan or program established under title V or title XX of the Act. Fiscal agent Group of practitioners Health insuring organization (HIO) Indirect ownership interest Managed care entity (MCE) Managing employee (1) A general manager, business manager, administrator, director, or other individual who exercises operational or managerial control over, or who directly or indirectly conducts, the day-to-day operation of an institution, organization, or agency, either under contract or through some other arrangement, whether or not the individual is a W-2 employee of the institution, organization, or agency; or (2) With respect to the additional requirements at § 455.104(e) for a nursing facility defined in section 1919(a) of the Act, an individual, including a general manager, business manager, administrator, director, or consultant, who directly or indirectly manages, advises, or supervises any element of the practices, finances, or operations of the facility. Organizational structure (1) A corporation. (2) A limited liability company. (3) A general partnership. (4) A limited partnership. (5) A trust. (6) An individual. Ownership interest Person with an ownership or control interest (a) Has an ownership interest totaling 5 percent or more in a disclosing entity; (b) Has an indirect ownership interest equal to 5 percent or more in a disclosing entity; (c) Has a combination of direct and indirect ownership interests equal to 5 percent or more in a disclosing entity; (d) Owns an interest of 5 percent or more in any mortgage, deed of trust, note, or other obligation secured by the disclosing entity if that interest equals at least 5 percent of the value of the property or assets of the disclosing entity; (e) Is an officer or director of a disclosing entity that is organized as a corporation; or (f) Is a partner in a disclosing entity that is organized as a partnership. Prepaid ambulatory health plan (PAHP) Prepaid inpatient health plan (PIHP) Primary care case manager (PCCM) Significant business transaction Subcontractor (a) An individual, agency, or organization to which a disclosing entity has contracted or delegated some of its management functions or responsibilities of providing medical care to its patients; or (b) An individual, agency, or organization with which a fiscal agent has entered into a contract, agreement, purchase order, or lease (or leases of real property) to obtain space, supplies, equipment, or services provided under the Medicaid agreement. Supplier Termination (1) For a— (i) Medicaid or CHIP provider, a State Medicaid program or CHIP has taken an action to revoke the provider's billing privileges, and the provider has exhausted all applicable appeal rights or the timeline for appeal has expired; and (ii) Medicare provider, supplier or eligible professional, the Medicare program has revoked the provider or supplier's billing privileges, and the provider has exhausted all applicable appeal rights or the timeline for appeal has expired. (2)(i) In all three programs, there is no expectation on the part of the provider or supplier or the State or Medicare program that the revocation is temporary. (ii) The provider, supplier, or eligible professional will be required to reenroll with the applicable program if they wish billing privileges to be reinstated. (3) The requirement for termination applies in cases where providers, suppliers, or eligible professionals were terminated or had their billing privileges revoked for cause which may include, but is not limited to— (i) Fraud; (ii) Integrity; or (iii) Quality. Wholly owned supplier [44 FR 41644, July 17, 1979, as amended at 51 FR 34788, Sept. 30, 1986; 76 FR 5967, Feb. 2, 2011; 84 FR 47856, Sept. 10, 2019; 88 FR 80168, Nov. 17, 2023] § 455.102 Determination of ownership or control percentages. (a) Indirect ownership interest. (b) Person with an ownership or control interest. § 455.103 State plan requirement. A State plan must provide that the requirements of §§ 455.104 through 455.107 are met. [84 FR 47856, Sept. 10, 2019] § 455.104 Disclosure by Medicaid providers and fiscal agents: Information on ownership and control. (a) Who must provide disclosures. (b) What disclosures must be provided. (1)(i) The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address. (ii) Date of birth and Social Security Number (in the case of an individual). (iii) Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest. (2) Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling. (3) The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest. (4) The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). (c) When the disclosures must be provided Disclosures from providers or disclosing entities. (i) Upon the provider or disclosing entity submitting the provider application. (ii) Upon the provider or disclosing entity executing the provider agreement. (iii) Upon request of the Medicaid agency during the re-validation of enrollment process under § 455.414. (iv) Within 35 days after any change in ownership of the disclosing entity. (2) Disclosures from fiscal agents. (i) Upon the fiscal agent submitting the proposal in accordance with the State's procurement process. (ii) Upon the fiscal agent executing the contract with the State. (iii) Upon renewal or extension of the contract. (iv) Within 35 days after any change in ownership of the fiscal agent. (3) Disclosures from managed care entities. (i) Upon the managed care entity submitting the proposal in accordance with the State's procurement process. (ii) Upon the managed care entity executing the contract with the State. (iii) Upon renewal or extension of the contract. (iv) Within 35 days after any change in ownership of the managed care entity. (4) Disclosures from PCCMs. (d) To whom must the disclosures be provided. (e) Nursing facilities. (i) Each member of the governing body of the facility, including the name, title, and period of service for each such member. (ii) Each person or entity who is an officer, director, member, partner, trustee, or managing employee (as defined in § 455.101) of the facility, including the name, title, and period of service of each such person or entity. (iii) Each person or entity who is an additional disclosable party of the facility (as defined in § 455.101). (iv) The organizational structure (as defined in § 455.101) of each additional disclosable party of the facility and a description of the relationship of each such additional disclosable party to the facility and to one another. (2) The State need not require the facility to disclose the same information described in this paragraph (e) more than once on the same enrollment application submission. (f) Consequences for failure to provide required disclosures. [76 FR 5967, Feb. 2, 2011, as amended at 88 FR 80169, Nov. 17, 2023] § 455.105 Disclosure by providers: Information related to business transactions. (a) Provider agreements. (b) Information that must be submitted. (1) The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and (2) Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. (c) Denial of Federal financial participation (FFP). (2) FFP will be denied in expenditures for services furnished during the period beginning on the day following the date the information was due to the Secretary or the Medicaid agency and ending on the day before the date on which the information was supplied. § 455.106 Disclosure by providers: Information on persons convicted of crimes. (a) Information that must be disclosed. (1) Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and (2) Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. (b) Notification to Inspector General. (2) The agency must also promptly notify the Inspector General of the Department of any action it takes on the provider's application for participation in the program. (c) Denial or termination of provider participation. (2) The Medicaid agency may refuse to enter into or may terminate a provider agreement if it determines that the provider did not fully and accurately make any disclosure required under paragraph (a) of this section. § 455.107 Disclosure of affiliations. (a) Definitions. (1) “Uncollected debt” only applies to the following: (i) Medicare, Medicaid, or CHIP overpayments for which CMS or the State has sent notice of the debt to the affiliated provider or supplier. (ii) Civil money penalties imposed under this title. (iii) Assessments imposed under this title. (2) “Revoked,” “Revocation,” “Terminated,” and “Termination” include situations where the affiliated provider or supplier voluntarily terminated its Medicare, Medicaid, or CHIP enrollment to avoid a potential revocation or termination. (b) General. Selection of option. (ii) Change of selection. (2)(i) First option. (ii) Second option. (c) Information. (1) General identifying information about the affiliated provider or supplier, which includes the following: (i) Legal name as reported to the Internal Revenue Service or the Social Security Administration (if the affiliated provider or supplier is an individual). (ii) “Doing business as” name (if applicable). (iii) Tax identification number. (iv) National Provider Identifier (NPI). (2) Reason for disclosing the affiliated provider or supplier. (3) Specific data regarding the affiliation relationship, including the following: (i) Length of the relationship. (ii) Type of relationship. (iii) Degree of affiliation. (4) If the affiliation has ended, the reason for the termination. (d) Mechanism. (e) Denial or termination. (f) Undue risk. (1) The duration of the affiliation. (2) Whether the affiliation still exists and, if not, how long ago the affiliation ended. (3) The degree and extent of the affiliation. (4) If applicable, the reason for the termination of the affiliation. (5) Regarding the affiliated provider's or supplier's disclosable event under paragraph (b) of this section, all of the following: (i) The type of disclosable event. (ii) When the disclosable event occurred or was imposed. (iii) Whether the affiliation existed when the disclosable event occurred or was imposed. (iv) If the disclosable event is an uncollected debt— (A) The amount of the debt; (B) Whether the affiliated provider or supplier is repaying the debt; and (C) To whom the debt is owed. (v) If a denial, revocation, termination, exclusion, or payment suspension is involved, the reason for the disclosable event. (6) Any other evidence that the State, in consultation with CMS, deems relevant to its determination. (g) Determination of undue risk. (h) Undisclosed affiliations. [84 FR 47856, Sept. 10, 2019, as amended at 87 FR 70249, Nov. 18, 2022] Subpart C—Medicaid Integrity Program Source: 72 FR 67655, Nov. 30, 2007, unless otherwise noted. § 455.200 Basis and scope. (a) Statutory basis. (b) Scope. [73 FR 55771, Sept. 26, 2008] § 455.202 Limitation on contractor liability. (a) A program contractor, a person, or an entity employed by, or having a fiduciary relationship with, or who furnishes professional services to a program contractor will not be held to have violated any criminal law and will not be held liable in any civil action, under any law of the United States or of any State (or political subdivision thereof), by reason of the performance of any duty, function, or activity required or authorized under this subpart or under a valid contract entered into under this subpart, provided due care was exercised in that performance and the contractor has a contract with CMS under this subpart. (b) CMS pays a contractor, a person, or an entity described in paragraph (a) of this section, or anyone who furnishes legal counsel or services to a contractor or person, a sum equal to the reasonable amount of the expenses, as determined by CMS, incurred in connection with the defense of a suit, action, or proceeding, if the following conditions are met: (1) The suit, action, or proceeding was brought against the contractor, person or entity by a third party and relates to the contractor's, person's or entity's performance of any duty, function, or activity under a contract entered into with CMS under this subpart. (2) The funds are available. (3) The expenses are otherwise allowable under the terms of the contract. § 455.230 Eligibility requirements. CMS may enter into a contract with an entity to perform the activities described at § 455.232, if it meets the following conditions: (a) The entity has demonstrated capability to carry out the activities described below. (b) In carrying out such activities, the entity agrees to cooperate with the Inspector General of the Department of Health and Human Services, the Attorney General, and other law enforcement agencies, as appropriate, in the investigation and deterrence of fraud and abuse in relation to Title XIX of the Social Security Act and in other cases arising out of such activities. (c) Maintains an appropriate written code of conduct and compliance policies that include, without limitation, an enforced policy on employee conflicts of interest. (d) The entity complies with such conflict of interest standards as are generally applicable to Federal acquisition and procurement. (e) The entity meets such other requirements the Secretary may impose. [73 FR 55771, Sept. 26, 2008] § 455.232 Medicaid integrity audit program contractor functions. The contract between CMS and a Medicaid integrity audit program contractor specifies the functions the contractor will perform. The contract may include any or all of the following functions: (a) Review of the actions of individuals or entities furnishing items or services (whether on a fee-for-service, risk, or other basis) for which payment may be made under a State Plan approved under title XIX of the Act (or under any waiver of such plan approved under section 1115 of the Act) to determine whether fraud, waste, or abuse has occurred, is likely to occur, or whether such actions have the potential for resulting in an expenditure of funds under title XIX in a manner which is not intended under the provisions of title XIX. (b) Auditing of claims for payment for items or services furnished, or administrative services rendered, under a State Plan under title XIX to ensure proper payments were made. This includes: cost reports, consulting contracts, and risk contracts under section 1903(m) of the Act. (c) Identifying if overpayments have been made to individuals or entities receiving Federal funds under title XIX. (d) Educating providers of service, managed care entities, beneficiaries, and other individuals with respect to payment integrity and quality of care. [73 FR 55771, Sept. 26, 2008] § 455.234 Awarding of a contract. (a) CMS awards and administers Medicaid integrity audit program contracts in accordance with acquisition regulations set forth at 48 CFR chapters 1 and 3, this subpart, and all other applicable laws and regulations. These competitive procedures and requirements for awarding Medicaid integrity audit program contracts are to be used as follows: (1) When entering into new contracts under this section. (2) At any other time considered appropriate by the Secretary. (b) An entity is eligible to be awarded a Medicaid integrity audit program contract only if meets the eligibility requirements established in § 455.202, 48 CFR chapter 3, and all other applicable laws and requirements. [73 FR 55771, Sept. 26, 2008] § 455.236 Renewal of a contract. (a) CMS specifies the initial contract term in the Medicaid integrity audit program contract. CMS may, but is not required to, renew a Medicaid integrity audit program contract without regard to any provision of law requiring competition if the contractor has met or exceeded the performance requirements established in the current contract. (b) CMS may renew a Medicaid integrity audit program contract without competition if all of the following conditions are met: (1) The Medicaid integrity audit program contractor continues to meet the requirements established in this subpart. (2) The Medicaid integrity audit program contractor meets or exceeds the performance requirements established in its current contract. (3) It is in the best interest of the government. (c) If CMS does not renew a contract, the contract will end in accordance with its terms. The contractor will not have a right to a hearing or judicial review regarding CMS's renewal or non-renewal decision. [73 FR 55771, Sept. 26, 2008] § 455.238 Conflict of interest. (a) Offerors for Medicaid integrity audit program contracts, and Medicaid integrity audit program contractors, are subject to the following requirements: (1) The conflict of interest standards and requirements of the Federal Acquisition Regulation organizational conflict of interest guidance, found under 48 CFR subpart 9.5. (2) The standards and requirements that are contained in each individual contract awarded to perform activities described under section 1936 of the Act. (b) Post-award conflicts of interest: CMS considers that a post-award conflict of interest has developed if, during the term of the contract, one of the following occurs: (1) The contractor or any of its employees, agents, or subcontractors received, solicited, or arranged to receive any fee, compensation, gift (defined at 5 CFR 2635.203(b)), payment of expenses, offer of employment, or any other thing of value from any entity that is reviewed, audited, investigated, or contacted during the normal course of performing activities under the Medicaid integrity audit program contract. (2) CMS determines that the contractor's activities are creating a conflict of interest. (c) If CMS determines that a conflict of interest exists during the term of the contract, among other actions, CMS may: (1) Not renew the contract for an additional term. (2) Modify the contract. (3) Terminate the contract. [73 FR 55771, Sept. 26, 2008] § 455.240 Conflict of interest resolution. (a) Review Board: CMS may establish a Conflicts of Interest Review Board to assist in resolving organizational conflicts of interest. (b) Resolution: Resolution of an organizational conflict of interest is a determination by the contracting officer that: (1) The conflict is mitigated. (2) The conflict precludes award of a contract to the offeror. (3) The conflict requires that CMS modify an existing contract. (4) The conflict requires that CMS terminate an existing contract. (5) It is in the best interest of the government to contract with the offeror or contractor even though the conflict of interest exists and a request for waiver is approved in accordance with 48 CFR 9.503. [73 FR 55771, Sept. 26, 2008] Subpart D—Independent Certified Audit of State Disproportionate Share Hospital Payment Adjustments Source: 73 FR 77951, Dec. 19, 2008, unless otherwise noted. § 455.300 Purpose. This subpart implements Section 1923(j)(2) of the Act. § 455.301 Definitions. For the purposes of this subpart— Independent certified audit Medicaid State Plan Rate Year [73 FR 77951, Dec. 19, 2008, as amended at 89 FR 13947, Feb. 23, 2024] § 455.304 Condition for Federal financial participation (FFP). (a) General rule. (2) FFP is not available in expenditures for DSH payments that are found in the independent certified audit to exceed the hospital-specific eligible uncompensated care cost limit, except as provided in paragraph (e) of this section. (b) Timing. (c) Documentation. (1) Approved Medicaid State plan for the Medicaid State plan rate year under audit. (2) Payment and utilization information from the State's Medicaid Management Information System. (3) The Medicare 2552-96 hospital cost report(s) applicable to the Medicaid State plan rate year under audit. If the Medicare 2552-96 is superseded by an alternate Medicare developed cost reporting tool during an audit year, that tool must be used for the Medicaid State plan rate year under audit. (4) Audited hospital financial statements and hospital accounting records. (d) Specific requirements. (1) Verification 1. (2) Verification 2: (3) Verification 3. (4) Verification 4. (5) Verification 5: (6) Verification 6. (e) Transition Provisions: [73 FR 77951, Dec. 19, 2008, as amended at 89 FR 13947, Feb. 23, 2024] Subpart E—Provider Screening and Enrollment Source: 76 FR 5968, Feb. 2, 2011, unless otherwise noted. § 455.400 Purpose. This subpart implements sections 1866(j), 1902(a)(39), 1902(a)(77), and 1902(a)(78) of the Act. It sets forth State plan requirements regarding the following: (a) Provider screening and enrollment requirements. (b) Fees associated with provider screening. (c) Temporary moratoria on enrollment of providers. § 455.405 State plan requirements. A State plan must provide that the requirements of § 455.410 through § 455.450 and § 455.470 are met. § 455.410 Enrollment and screening of providers. (a) The State Medicaid agency must require all enrolled providers to be screened under to this subpart. (b) The State Medicaid agency must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. (c) The State Medicaid agency may rely on the results of the provider screening performed by any of the following: (1) Medicare contractors. (2) Medicaid agencies or Children's Health Insurance Programs of other States. (d) The State Medicaid agency must allow enrollment of all Medicare-enrolled providers and suppliers for purposes of processing claims to determine Medicare cost-sharing (as defined in section 1905(p)(3) of the Act) if the providers or suppliers meet all Federal Medicaid enrollment requirements, including, but not limited to, all applicable provisions of 42 CFR part 455, subparts B and E. This paragraph (d) applies even if the Medicare-enrolled provider or supplier is of a type not recognized by the State Medicaid Agency. [76 FR 5968, Feb. 2, 2011, as amended at 86 FR 45521, Aug. 13, 2021] § 455.412 Verification of provider licenses. The State Medicaid agency must— (a) Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State. (b) Confirm that the provider's license has not expired and that there are no current limitations on the provider's license. § 455.414 Revalidation of enrollment. The State Medicaid agency must revalidate the enrollment of all providers regardless of provider type at least every 5 years. § 455.416 Termination or denial of enrollment. The State Medicaid agency— (a) Must terminate the enrollment of any provider where any person with a 5 percent or greater direct or indirect ownership interest in the provider did not submit timely and accurate information and cooperate with any screening methods required under this subpart. (b) Must deny enrollment or terminate the enrollment of any provider where any person with a 5 percent or greater direct or indirect ownership interest in the provider has been convicted of a criminal offense related to that person's involvement with the Medicare, Medicaid, or title XXI program in the last 10 years, unless the State Medicaid agency determines that denial or termination of enrollment is not in the best interests of the Medicaid program and the State Medicaid agency documents that determination in writing. (c) Must deny enrollment or terminate the enrollment of any provider that is terminated on or after January 1, 2011, under title XVIII of the Act or under the Medicaid program or CHIP of any other State, and is currently included in the termination database under § 455.417. (d) Must terminate the provider's enrollment or deny enrollment of the provider if the provider or a person with an ownership or control interest or who is an agent or managing employee of the provider fails to submit timely or accurate information, unless the State Medicaid agency determines that termination or denial of enrollment is not in the best interests of the Medicaid program and the State Medicaid agency documents that determination in writing. (e) Must terminate or deny enrollment if the provider, or any person with a 5 percent or greater direct or indirect ownership interest in the provider, fails to submit sets of fingerprints in a form and manner to be determined by the Medicaid agency within 30 days of a CMS or a State Medicaid agency request, unless the State Medicaid agency determines that termination or denial of enrollment is not in the best interests of the Medicaid program and the State Medicaid agency documents that determination in writing. (f) Must terminate or deny enrollment if the provider fails to permit access to provider locations for any site visits under § 455.432, unless the State Medicaid agency determines that termination or denial of enrollment is not in the best interests of the Medicaid program and the State Medicaid agency documents that determination in writing. (g) May terminate or deny the provider's enrollment if CMS or the State Medicaid agency— (1) Determines that the provider has falsified any information provided on the application; or (2) Cannot verify the identity of any provider applicant. [73 FR 77951, Dec. 19, 2008, as amended at 88 FR 79552, Nov. 16, 2023; 90 FR 55619, Dec. 2, 2025] § 455.417 Termination periods and termination database periods. (a)(1) Subject to paragraph (c) of this section, a provider remains in the termination notification database referenced in section 1902(ll) of the Act for a period that is the lesser of: (i) The length of the termination period imposed by the State that initially terminated the provider or the reenrollment bar (as described in § 424.535(c) of this chapter) imposed by the Medicare program in the case of a Medicare revocation; or (ii) 10 years (for those Medicaid or CHIP terminations that are greater than 10 years). (2) All other State Medicaid agencies or CHIPs must terminate or deny the provider from their respective programs (pursuant to § 455.416(c)) for at least the same length of time as the termination database period described in paragraph (a)(1) of this section. (b)(1) Nothing in paragraph (a) of this section prohibits: (i) The initially terminating State from imposing a termination period of greater than 10 years consistent with that State's laws, or (ii) Another State from terminating the provider, based on the original State's termination, for a period: (A) Of greater than 10 years; or (B) That is otherwise longer than that imposed by the initially terminating State. (2) The period established under paragraph (b)(1)(ii) of this section must be no shorter than the period in which the provider is to be included in the termination database under paragraph (a) of this section. (c)(1) If the initially terminating State agency or the Medicare program reinstates the provider prior to the end of the termination period originally imposed by the initially terminating State agency or Medicare, CMS removes the provider from the termination database after the reinstatement has been reported to CMS. (2) If the provider is removed from the database pursuant to paragraph (c)(1), CMS may immediately reinclude the provider in the database (with no interval between the 2 periods) if a basis for doing so exists under part 455 or 424 of this chapter. (d) For purposes of this section only, terminations under § 455.416(c) are not considered “for cause” terminations and therefore need not be reported to CMS for inclusion in the termination database. [88 FR 79552, Nov. 16, 2023] § 455.420 Reactivation of provider enrollment. After deactivation of a provider enrollment number for any reason, before the provider's enrollment may be reactivated, the State Medicaid agency must re-screen the provider and require payment of associated provider application fees under § 455.460. § 455.422 Appeal rights. The State Medicaid agency must give providers terminated or denied under § 455.416 any appeal rights available under procedures established by State law or regulations. § 455.432 Site visits. The State Medicaid agency— (a) Must conduct pre-enrollment and post-enrollment site visits of providers who are designated as “moderate” or “high” categorical risks to the Medicaid program. The purpose of the site visit will be to verify that the information submitted to the State Medicaid agency is accurate and to determine compliance with Federal and State enrollment requirements. (b) Must require any enrolled provider to permit CMS, its agents, its designated contractors, or the State Medicaid agency to conduct unannounced on-site inspections of any and all provider locations. § 455.434 Criminal background checks. The State Medicaid agency— (a) As a condition of enrollment, must require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider. (b) Must establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. (1) Upon the State Medicaid agency determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets the State Medicaid agency's criteria hereunder for criminal background checks as a “high” risk to the Medicaid program, the State Medicaid agency will require that each such provider or person submit fingerprints. (2) The State Medicaid agency must require a provider, or any person with a 5 percent or more direct or indirect ownership interest in the provider, to submit a set of fingerprints, in a form and manner to be determined by the State Medicaid agency, within 30 days upon request from CMS or the State Medicaid agency. § 455.436 Federal database checks. The State Medicaid agency must do all of the following: (a) Confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. (b) Check the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. (c)(1) Consult appropriate databases to confirm identity upon enrollment and reenrollment; and (2) Check the LEIE and EPLS no less frequently than monthly. § 455.440 National Provider Identifier. The State Medicaid agency must require all claims for payment for items and services that were ordered or referred to contain the National Provider Identifier (NPI) of the physician or other professional who ordered or referred such items or services. § 455.450 Screening levels for Medicaid providers. A State Medicaid agency must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.” If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. (a) Screening for providers designated as limited categorical risk. (1) Verify that a provider meets any applicable Federal regulations, or State requirements for the provider type prior to making an enrollment determination. (2) Conduct license verifications, including State licensure verifications in States other than where the provider is enrolling, in accordance with § 455.412. (3) Conduct database checks on a pre- and post-enrollment basis to ensure that providers continue to meet the enrollment criteria for their provider type, in accordance with § 455.436. (b) Screening for providers designated as moderate categorical risk. (1) Perform the “limited” screening requirements described in paragraph (a) of this section. (2) Conduct on-site visits in accordance with § 455.432. (c) Screening for providers designated as high categorical risk. (1) Perform the “limited” and “moderate” screening requirements described in paragraphs (a) and (b) of this section. (2)(i) Conduct a criminal background check; and (ii) Require the submission of a set of fingerprints in accordance with § 455.434. (d) Denial or termination of enrollment. (1) Application denied under § 455.434; or (2) Enrollment terminated under § 455.416. (e) Adjustment of risk level. (1) The State Medicaid agency imposes a payment suspension on a provider based on credible allegation of fraud, waste or abuse, the provider has an existing Medicaid overpayment, or the provider has been excluded by the OIG or another State's Medicaid program within the previous 10 years. (2) The State Medicaid agency or CMS in the previous 6 months lifted a temporary moratorium for the particular provider type and a provider that was prevented from enrolling based on the moratorium applies for enrollment as a provider at any time within 6 months from the date the moratorium was lifted. § 455.452 Other State screening methods. Nothing in this subpart must restrict the State Medicaid agency from establishing provider screening methods in addition to or more stringent than those required by this subpart. § 455.460 Application fee. (a) Beginning on or after March 25, 2011, States must collect the applicable application fee prior to executing a provider agreement from a prospective or re-enrolling provider other than either of the following: (1) Individual physicians or nonphysician practitioners. (2)(i) Providers who are enrolled in either of the following: (A) Title XVIII of the Act. (B) Another State's title XIX or XXI plan. (ii) Providers that have paid the applicable application fee to— (A) A Medicare contractor; or (B) Another State. (b) If the fees collected by a State agency in accordance with paragraph (a) of this section exceed the cost of the screening program, the State agency must return that portion of the fees to the Federal government. § 455.470 Temporary moratoria. (a)(1) The Secretary consults with any affected State Medicaid agency regarding imposition of temporary moratoria on enrollment of new providers or provider types prior to imposition of the moratoria, in accordance with § 424.570 of this chapter. (2) The State Medicaid agency will impose temporary moratoria on enrollment of new providers or provider types identified by the Secretary as posing an increased risk to the Medicaid program. (3)(i) The State Medicaid agency is not required to impose such a moratorium if the State Medicaid agency determines that imposition of a temporary moratorium would adversely affect beneficiaries' access to medical assistance. (ii) If a State Medicaid agency makes such a determination, the State Medicaid agency must notify the Secretary in writing. (b)(1) A State Medicaid agency may impose temporary moratoria on enrollment of new providers, or impose numerical caps or other limits that the State Medicaid agency identifies as having a significant potential for fraud, waste, or abuse and that the Secretary has identified as being at high risk for fraud, waste, or abuse. (2) Before implementing the moratoria, caps, or other limits, the State Medicaid agency must determine that its action would not adversely impact beneficiaries' access to medical assistance. (3) The State Medicaid agency must notify the Secretary in writing in the event the State Medicaid agency seeks to impose such moratoria, including all details of the moratoria; and obtain the Secretary's concurrence with imposition of the moratoria. (c)(1) The State Medicaid agency must impose the moratorium for an initial period of 6 months. (2) If the State Medicaid agency determines that it is necessary, the State Medicaid agency may extend the moratorium in 6-month increments. (3) Each time, the State Medicaid agency must document in writing the necessity for extending the moratorium. Subpart F—Medicaid Recovery Audit Contractors Program Source: 76 FR 57843, Sept. 16, 2011, unless otherwise noted. § 455.500 Purpose. This subpart implements section 1902(a)(42)(B) of the Act that establishes the Medicaid Recovery Audit Contractor (RAC) program. § 455.502 Establishment of program. (a) The Medicaid Recovery Audit Contractor program (Medicaid RAC program) is established as a measure for States to promote the integrity of the Medicaid program. (b) States must enter into contracts, consistent with State law and in accordance with this section, with one or more eligible Medicaid RACs to carry out the activities described in § 455.506 of this subpart. (c) States must comply with reporting requirements describing the effectiveness of their Medicaid RAC programs as specified by CMS. § 455.504 Definitions. As used in this subpart— Medicaid RAC program Medicare RAC program § 455.506 Activities to be conducted by Medicaid RACs and States. (a) Medicaid RACs will review claims submitted by providers of items and services or other individuals furnishing items and services for which payment has been made under section 1902(a) of the Act or under any waiver of the State Plan to identify underpayments and overpayments and recoup overpayments for the States. (1) States may exclude Medicaid managed care claims from review by Medicaid RACs. (b) States may coordinate with Medicaid RACs regarding the recoupment of overpayments. (c) States must coordinate the recovery audit efforts of their RACs with other auditing entities. (d) States must make referrals of suspected fraud and/or abuse, as defined in 42 CFR 455.2, to the MFCU or other appropriate law enforcement agency. (e) States must set limits on the number and frequency of medical records to be reviewed by the RACs, subject to requests for exception from RACs to States. § 455.508 Eligibility requirements for Medicaid RACs. An entity that wishes to perform the functions of a Medicaid RAC must enter into a contract with a State to carry out any of the activities described in § 455.506 under the following conditions: (a) The entity must demonstrate to a State that it has the technical capability to carry out the activities described in § 455.506 of this subpart. Evaluation of technical capability must include the employment of trained medical professionals, as defined by the State, who are in good standing with the relevant State licensing authorities, where applicable, to review Medicaid claims. (b) The entity must hire a minimum of 1.0 FTE Contractor Medical Director who is a Doctor of Medicine or Doctor of Osteopathy in good standing with the relevant State licensing authorities and has relevant work and educational experience. A State may seek to be excepted, in accordance with § 455.516, from requiring its RAC to hire a minimum of 1.0 FTE Contractor Medical Director by submitting to CMS a written request for CMS review and approval. (c) The entity must hire certified coders unless the State determines that certified coders are not required for the effective review of Medicaid claims. (d) The entity must work with the State to develop an education and outreach program, which includes notification to providers of audit policies and protocols. (e) The entity must provide minimum customer service measures including: (1) Providing a toll-free customer service telephone number in all correspondence sent to providers and staffing the toll-free number during normal business hours from 8:00 a.m. to 4:30 p.m. in the applicable time zone. (2) Compiling and maintaining provider approved addresses and points of contact. (3) Mandatory acceptance of provider submissions of electronic medical records on CD/DVD or via facsimile at the providers' request. (4) Notifying providers of overpayment findings within 60 calendar days. (f) The entity must not review claims that are older than 3 years from the date of the claim, unless it receives approval from the State. (g) The entity should not audit claims that have already been audited or that are currently being audited by another entity. (h) The entity must refer suspected cases of fraud and/or abuse to the State in a timely manner, as defined by the State. (i) The entity meets other requirements as the State may require. § 455.510 Payments to RACs. (a) General. (b) Overpayments. (1) The contingency fees paid to Medicaid RACs must be based on a percentage of the overpayment recovered. (2) States must determine at what stage in the Medicaid RAC audit process, after an overpayment has been recovered, Medicaid RACs will receive contingency fee payments. (3) If a provider appeals a Medicaid RAC overpayment determination and the determination is reversed, at any level, then the Medicaid RAC must return the contingency fees associated with that payment within a reasonable timeframe, as prescribed by the State. (4) Except as provided in paragraph (5) of this section, the contingency fee may not exceed that of the highest Medicare RAC, as specified by CMS in the Federal Register, (5) CMS will review and consider, on a case-by-case basis, a State's well-justified request that CMS provide FFP in paying a Medicaid RAC(s) a contingency fee in excess of the then-highest contingency fee paid to a Medicare RAC. (c) Underpayments. (2) States must adequately incentivize the detection of underpayments. (3) States must notify providers of underpayments that are identified by the RACs. § 455.512 Medicaid RAC provider appeals. States must provide appeal rights under State law or administrative procedures to Medicaid providers that seek review of an adverse Medicaid RAC determination. § 455.514 Federal share of State expense of the Medicaid RAC program. (a) Funds expended by States for the operation and maintenance of a Medicaid RAC program, not including fees paid to RACs, are considered necessary for the proper and efficient administration of the States' plan or waivers of the plan. (b) FFP is available to States for administrative costs of operation and maintenance of Medicaid RACs subject to CMS' reporting requirements. § 455.516 Exceptions from Medicaid RAC programs. A State may seek to be excepted from some or all Medicaid RAC contracting requirements by submitting to CMS a written justification for the request for CMS review and approval through the State Plan amendment process. § 455.518 Applicability to the territories. The aforementioned provisions in § 455.500 through § 455.516 of this subpart are applicable to Guam, Puerto Rico, U.S. Virgin Islands, American Samoa, and the Commonwealth of the Northern Mariana Islands. (Authority: Catalog of Federal Domestic Assistance Program No. 93.778, Medical Assistance Program)