Rule 5160-26-06. Managed care: program integrity - fraud, waste and abuse, audits, reporting, and record retention

119.03 (A) A managed care entity (MCE) must have administrative and management arrangements or procedures, including a mandatory compliance plan, to guard against fraud, waste and abuse as required in the MCE provider agreement or contract with the Ohio department of medicaid (ODM) located at http://medicaid.ohio.gov/. (1) These arrangements or procedures must be made available to ODM upon request. (2) The MCE must annually submit to ODM a report that summarizes the MCE's fraud, waste, and abuse activities for the previous year and identifies any proposed changes to the MCE's fraud, waste, and abuse program for the coming year. (B) ODM or its designee, the state auditor's office, the state attorney general's office, and the U.S. department of health and human services may evaluate or audit the MCE's performance for the purpose of determining compliance with the requirements of Chapter 5160-26 of the Administrative Code, fraud, waste, and abuse statutes, applicable state and federal regulations, or requirements under federal waiver authority. (C) ODM or its designee may conduct on-site audits and reviews as deemed necessary based on periodic analysis of financial, utilization, provider network, and other information. (D) The MCE must submit required reports and additional information, as requested by ODM, as related to its duties and obligations and where needed to ensure operation in accordance with all state and federal regulations or requirements. (E) If the MCE fails to submit any ODM-requested materials, as specified in paragraph (D) of this rule, without cause as determined by ODM, on or before the due date, ODM may impose any or all of the sanctions listed in rule 5160-26-10 of the Administrative Code or the MCE's provider agreement or contract with ODM. (F) Record retention

rdance with all state and federal regulations or requirements. (E) If the MCE fails to submit any ODM-requested materials, as specified in paragraph (D) of this rule, without cause as determined by ODM, on or before the due date, ODM may impose any or all of the sanctions listed in rule 5160-26-10 of the Administrative Code or the MCE's provider agreement or contract with ODM. (F) Record retention. The MCE and its contracted providers and subcontractors shall retain and safeguard all hard copy or electronic records originated or prepared in connection with the MCE's performance of its obligations under the MCO provider agreement or the SPBM contract, including but not limited to working papers or information related to the preparation of reports, medical records, progress notes, charges, journals, ledgers, and fiscal reports, in accordance with applicable sections of the federal regulations, the Revised Code, and the Administrative Code. Records stored electronically must be produced at the MCE's expense, upon request, in the format specified by state or federal authorities. As specified in 42 C.F.R. 438.3 (October 1, 2021), such records must be maintained for a minimum of ten years from the renewal, amendment or termination date of the provider agreement. In the event the MCE has been notified that state or federal authorities have commenced an audit or investigation of the MCO provider agreement or the SPBM contract, records must be maintained until such time as the matter under audit or investigation has been resolved. For the initial three years of the retention period, the MCE and its contracted providers and subcontractors must store the records in a manner and place that provides readily available access. Last updated July 18, 2022 at 8:19 AM Supplemental Information Authorized By: 5167.02 Amplifies: 5162.03 , 5167.10 , 5167.03 , 5164.70 , 5164.02 7/18/2027 7/1/1996, 7/1/2001, 10/31/2005, 7/1/2017, 2/14/2019