First-Tier, Downstream and Related Entities (FDRs)
CMS Compliance Program Requirements*

Kaiser Foundation Health Plan, Inc. and its subsidiaries (collectively "Kaiser Foundation Health Plan") contract with the Centers for Medicare & Medicaid Services (CMS) to provide services under Medicare Parts C and D. To help fulfill its obligations to CMS, Kaiser Foundation Health Plan has entered into contracts with external vendors and providers to provide administrative or health care services to Kaiser Foundation Health Plan's Medicare enrollees. For the purposes of complying with CMS regulations,* these vendors and providers are generally referred to as first-tier, downstream, and related entities (FDR).

Determining FDR Status

Suppliers and contractors are identified as an FDR based on the type of service provided to Kaiser Foundation Health Plan and how that service relates to Kaiser Foundation Health Plan's Medicare Parts C and D contracts. Suppliers and contractors already identified as an FDR by Kaiser Foundation Health Plan will have a Medicare Administrative Contracting Requirements exhibit within their contract with Kaiser Foundation Health Plan.

If you have any questions regarding whether these requirements apply to your organization, please send your inquiry to FDR-CMS@kp.org.

Requirements for FDRs

CMS requires Kaiser Foundation Health Plan to establish and maintain an FDR monitoring and auditing program to ensure that its FDRs meet Medicare program requirements.

Below, is a list of Medicare program requirements that apply to all FDRs. Depending on the nature of the services provided, additional requirements may apply.

Requirements:

Each of these requirements are described in greater detail below.

REQUIREMENT: Vendor Code of Conduct

FDRs are required to comply with, and make available annually to their employees and any subcontractors providing services under the FDR's contract with Kaiser Foundation Health Plan, the Kaiser Permanente Vendor Code of Conduct.

Employees are defined as those individuals (including temporary workers and volunteers) who are involved in the administration or delivery of services under the FDR's contract with Kaiser Foundation Health Plan.

The Kaiser Permanente Vendor Code of Conduct is available for review and download here: Vendor Code of Conduct

REQUIREMENT: Compliance Training

All FDRs are required to complete CMS's general compliance training and fraud, waste, and abuse (FWA) training. CMS has provided two training modules to fulfill this requirement:

  • Medicare Parts C and D General Compliance Training
  • Combatting Medicare Parts C and D Fraud, Waste, and Abuse Training

These courses are available as web-based training modules or for download on CMS's Medicare Learning Network's (MLN) Learning Management and Product Ordering System at https://learner.mlnlms.com.

Methods for Completing the Training
FDRs have two options for ensuring they have satisfied the compliance training requirement

  1. FDRs can complete the CMS general compliance and FWA training modules located on the CMS MLN. Once an individual completes the training, the system will generate a certificate of completion. The MLN certificates of completion will be accepted by Kaiser Foundation Health Plan as satisfaction of this requirement.

    For additional guidance on how to access CMS's web-based training modules, see: Accessing CMS's Web-Based Training Modules.

  2. FDRs can download and incorporate the content of the CMS general compliance and FWA training modules from the CMS website into their organizations' existing compliance training materials/systems.

    For additional guidance on how to download CMS's training modules and CMS's requirements concerning incorporating the materials into existing compliance training materials/systems, see: Downloading and Incorporating CMS's Compliance Training Courses.

Who Must Complete the Training?
The number of FDR employees who must satisfy the CMS general compliance and FWA training requirement will vary depending on the nature of the service being provided to Kaiser Foundation Health Plan, and how the service relates to the Medicare Part C and D plan. At a minimum, individuals holding the following positions must complete the CMS general compliance and FWA training modules:

  • senior administrators or managers directly responsible for the FDR's contract with Kaiser Foundation Health Plan (e.g., senior vice president, departmental managers, chief medical or pharmacy officer)
  • individuals directly involved with establishing and administering Kaiser Foundation Health Plan's formulary and/or medical benefits coverage policies and procedures
  • individuals involved with decision-making authority on behalf of Kaiser Foundation Health Plan (e.g., clinical decisions, coverage determinations, appeals and grievances, enrollment/disenrollment functions, processing of pharmacy or medical claims)
  • reviewers of beneficiary claims and services submitted for payment
  • individuals with job functions that place the FDR in a position to commit significant noncompliance with CMS program requirements or health care FWA

If you have questions concerning who must satisfy the CMS general compliance and FWA training requirements, please email your question to FDR-CMS@kp.org.

When does the CMS Compliance Training have to be completed?
FDR employees who meet the training criteria must complete the training within 90 days of initial hire and annually thereafter. If the FDR has just recently contracted with Kaiser Foundation Health Plan, all employees must complete the training within 90 days of the contract's effective date.

The annual training can be completed any time between January 1 – December 31 of any given contract year.

Documenting Completion of CMS Compliance Training
FDRs must document the completion of CMS Compliance Training for each FDR employee who meets the training criteria. Documentation can include:

  • MLN certificates of completion
  • Sign-in sheets for group/instructor-led training
  • Spreadsheets containing:
    • FDR employee's job title
    • FDR employee's date of hire
    • Course completion date

Records of training completions must be retained for ten (10) years from the final date of the FDR's contract with Kaiser Foundation Health Plan. Records of training must be made available to Kaiser Foundation Health Plan for evaluation, audit, and inspection upon request.

REQUIREMENT: Screening for Excluded Individuals

Kaiser Foundation Health Plan may not use federal funds to pay for services, equipment, or drugs prescribed or provided by a vendor that is debarred, suspended, excluded or that has opted out from receiving a contract or subcontract funded in whole or in part by federal or state funds, including without limitation Medicare and Medicaid funds.

FDRs must ensure that no persons or entities employed by or contracted with the FDR to provide services under the FDRs contract with Kaiser Foundation Health Plan are sanctioned by or debarred, suspended, excluded or have opted out from, participation in Medicare or Medicaid under Sections 1128 or 1128A of the Social Security Act.

FDRs will review the Department of Health and Human Services, Office of Inspector General List of Excluded Individuals and Entities (LEIE list) and the U.S. General Services Administration System for Award Management (SAM) prior to initial hiring or contracting and monthly thereafter to ensure that employees and contractors providing services under the contract are not so sanctioned, debarred, suspended, excluded, or have otherwise opted out of participating in Medicare. Employees are defined as those employees (including temporary workers and volunteers) who have involvement in administration or delivery of services under the FDR's contract with Kaiser Foundation Health Plan.

If the FDR becomes aware that it has employed or contracted with such a person or entity, the FDR will take prompt and appropriate remedial action to remove the employee or contractor from providing services under the FDRs agreement with Kaiser Foundation Health Plan.

The LEIE list and guidance on how to use this list can be found at https://oig.hhs.gov/exclusions/index.asp.

The SAM site and guidance on how to use this list can be found at www.sam.gov.

REQUIREMENT: Offshore Vendor Activities

FDRs must notify Kaiser Foundation Health Plan of any instances where they perform services offshore (i.e., on foreign soil) or contract with any offshore subcontractors that access, use, or disclose Medicare beneficiary protected health information (PHI).

  • Disclosure of all offshore activities must be made upon contracting with Kaiser Foundation Health Plan.
  • Notification of any new offshore activities must be made within 10 days of beginning those services
  • Kaiser Foundation Health Plan may also require an annual disclosure of all offshore activities.

As applicable, offshore activity disclosures and notifications should be made as follows:

  • For each offshore activity performed by the FDR, provide the following information.
    • description of activity
    • type of PHI used in the activity
    • physical location and address of the activity
  • For each offshore subcontractor the FDR is using to provide services to Kaiser Foundation Health Plan, provide the following information:
    • offshore subcontractor name
    • offshore subcontractor address
    • start and end dates for contract with subcontractor
    • the type(s) of PHI provided to the offshore subcontractor;
    • the functions that the subcontractor performs offshore that involve PHI;
    • whether Offshore Activities involving PHI are necessary, and whether alternatives to those Offshore Activities were considered; and
    • the contracting arrangement's safeguards to protect PHI, and provisions for audits of the offshore subcontractors' compliance with those safeguards

Disclosure/notification of offshore activities should be sent to FDR-CMS@kp.org. Please include the name and contact information of the individual at the FDR who can provide additional information about the offshore activity, if necessary.

REQUIREMENT: Annual Attestation

Each year, Kaiser Foundation Health Plan will require its administrative FDRs to attest and certify, in writing, to the following requirements:

  • Vendor Code of Conduct: FDR has made Kaiser Permanente's Vendor Code of Conduct available to its employees and subcontractors during the prior calendar year: January 1 – December 31.
  • General Compliance Training and Fraud, Waste and Abuse (FWA) Training: FDR has provided CMS's general compliance training and FWA training to its employees and subcontractors (within 90 days of hire or contracting in the case of new employees or new subcontractors) during the prior calendar year: January 1 – December 31.
  • Screening for Excluded Individuals:
    • FDR, its employees, and subcontractors are not sanctioned, debarred, suspended, or excluded from participation in Medicare or Medicaid under Sections 1128 or 1128A of the Social Security Act.
    • FDR has screened its employees and subcontractors prior to employment or contracting with them and has done so at least monthly thereafter against the CMS required exclusion lists: Department of Health and Human Services, Office of Inspector General List of Excluded Individuals and Entities (LEIE list) and the U.S. General Services Administration System for Award Management (SAM).
  • Compliance with Medicare Law: FDR and any downstream contractors (subcontractors) will comply with Kaiser Foundation Health Plan's contractual obligations to CMS and all applicable Medicare laws, regulations, and CMS instruction.
  • Data Accuracy: FDR certifies that the data submitted to Kaiser Foundation Health Plan and CMS (if applicable) is accurate, complete, and truthful (based on FDR's best knowledge, information, and belief).

FDRs may be required to provide evidence of compliance with these requirements as part of the FDR's attestation.

If you have questions concerning the FDR annual attestation, please email your question to FDR-CMS@kp.org.

*Reference: Compliance Program Guidelines, Prescription Drug Benefit Manual, Chapter 9 / Medicare Managed Care Manual, Chapter 21

 

 

Suspect Fraud, Waste, or Abuse?
Contact the Compliance Hotline