This guidance does not constitute rulemaking by OMIG and does not have the force of law or regulation. Nothing in this guidance alters any statutory or regulatory requirement. In the event of a conflict between statements in this guidance and either statutory or regulatory requirements, the requirements of the statutes and regulations shall govern.
A Medicaid provider’s legal obligations are determined by the applicable federal and state statutory and regulatory law. OMIG cannot provide individual advice or counseling, whether medical, legal, or otherwise. If you are seeking specific advice or counseling, you should contact an attorney or a compliance consultant.
This guidance supersedes any prior guidance issued by OMIG addressing, or relating to, self-disclosure requirements of New York State Social Services Law (SOS) § 363-d and 18 NYCRR SubPart 521-3 (SubPart 521-3). OMIG may amend this guidance as necessary.
This guidance is also available as a PDF for Download.
Contents
Self-Disclosure Introduction
Overpayment Identification
Managed Care
OMIG’s Anticipated Timeframes
Eligibility
How to Participate
1. Apply
2. Provide Information if requested
3. Determination & Payment
Compliance with the Self-Disclosure Process
Monetary Penalties
Disclosing Damaged, Lost or Destroyed Records
For More Information
Self-Disclosure Introduction
Medicaid Entities, including Medicaid enrolled Providers, Medicaid Managed Care Organizations (MMCOs), and other Entities involved in the billing or receipt of Medicaid funds (Medicaid Entities/Providers), are required to report, return, and explain any overpayments they have received to the New York State Office of the Medicaid Inspector General (OMIG) Self-Disclosure Program within sixty (60) days of identification, or by the date any corresponding cost report was due, whichever is later. See Social Services Law (SOS) § 363-d(6).
OMIG has enacted self-disclosure processes to afford Medicaid Entities/Providers a mechanism to report, return, and explain overpayments from the Medicaid program. These processes cover all Medicaid enrolled Providers, MMCOs, and other Entities involved in the billing or receipt of Medicaid funds.
Additionally, the Self-Disclosure Program accepts provider reports of damaged, lost or destroyed records. Pursuant to Title 18 of the New York Codes Rules and Regulations, Section 504.3, providers are required to prepare and maintain contemporaneous records demonstrating their right to receive payment under the medical assistance program and furnish the records, upon request. If a provider becomes aware that their records have been damaged, lost or destroyed they are required to report that information as soon as practicable, but no later than thirty (30) calendar days after discovery.
Additional citations of the Regulatory Authority which enables and governs OMIG’s Self-Disclosure Program can be found here: https://omig.ny.gov/self-disclosure-regulatory-authority
Overpayment Identification
An overpayment has been identified when a Medicaid Entity/Provider has, or should have, through the exercise of reasonable diligence, determined that a Medicaid fund overpayment was received, and they have quantified the amount of the overpayment to the best of their ability.
Medicaid Entities/Providers who have a compliance program should be utilizing routine internal audits to review compliance with Medicaid requirements and identify any Medicaid fund overpayments that may have been received. Additionally, if a Medicaid Entity/Provider is the subject of a government audit, part of that Medicaid Entity’s/Provider’s due diligence is to review the results of the audit and look at past and future periods – not covered in the audit scope – to identify any overpayments resulting from similar issues. If overpayments exist, Medicaid Entities/Providers are obligated to take corrective action, which includes reporting, explaining and returning any Medicaid overpayment identified.
Please Note: Voiding or adjusting claims does not satisfy the Medicaid Entity’s/Provider’s obligation to report and explain the identified overpayment.
Managed Care
MMCOs are required to establish Self-Disclosure Programs, including policies and procedures, for participating providers and other subcontractors to report, return and explain Managed Care overpayments within sixty (60) days of identification. Network Providers should self-disclose identified Managed Care overpayments to their MMCO in accordance with the applicable MMCO’s Self-Disclosure policies and procedures. If an MMCO is unresponsive, the Network Provider should document their attempts to contact the MMCO and submit that documentation, along with a completed Full Self-Disclosure, to OMIG’s Self-Disclosure Program. OMIG’s Self-Disclosure Unit will review the submission and work with the Network Provider to determine the appropriate course of action.
Additionally, MMCOs are required to report, return and explain any identified Capitation Payment overpayments to OMIG within sixty (60) days of identification. These types of overpayments are appropriate for the Full Self-Disclosure Process.
Additional information regarding Regulatory Authority of Medicaid Managed Care can be found here: https://omig.ny.gov/self-disclosure-regulatory-authority
OMIG’s Anticipated Timeframes
While both Federal and State regulations require a Medicaid Entity/Provider to report, return, and explain an overpayment within sixty (60) days from identification, the actual timeframes for processing can vary.
In a typical Full Self-Disclosure submission
A Medicaid Entity/Provider would submit a completed Full Self-Disclosure to OMIG electronically through the secure online portal available in the Self-Disclosure section of the OMIG website. The Medicaid Entity/Provider would receive an automatic confirmation reply notifying them that the disclosure was received, which occurs on the same day the disclosure was submitted. A Medicaid Entity’s/Provider’s 60-day time frame will be tolled, or paused, when a completed Self-Disclosure is received from an eligible Medicaid Entity/Provider. The time frame to repay will remain tolled during OMIG’s review.
Subsequent to receipt, OMIG staff review the information and data submitted in an effort to understand the error that occurred. For overpayments disclosed using the Self-Disclosure Full Statement, OMIG staff will verify that the disclosed overpayment amount is correct. OMIG staff will notify the Medicaid Entity/Provider within twenty (20) days from the date of receipt confirming acceptance of the submission or rejecting the submission for failure to meet eligibility criteria.
The review process includes steps to understand the reason that caused the overpayment including any law, regulation or policy that was violated. The claims data is reviewed and verified against paid Medicaid claim information when applicable. For disclosures using the Self-Disclosure Full Statement, OMIG staff also review the Medicaid Entity’s/Provider’s disclosed plan of corrective action to confirm it is sufficient to prevent the error from reoccurring in the future. If additional information is needed, OMIG staff will request it from the Medicaid Entity/Provider to complete the disclosure. OMIG staff will request that a Medicaid Entity/Provider respond with appropriate information within fifteen (15) days of notification.
The overpayment amount will be determined by OMIG and, if not already voided or adjusted, must be paid within fifteen (15) days from the date of the Determination Notice detailing the overpayment amount due, or no later than the expiration of the deadline to report, return and explain.
If a Medicaid Entity/Provider submits a Self-Disclosure Full Statement and is unable to pay in full within fifteen (15) days of notification, the Medicaid Entity/Provider may request an installment-payment agreement, which includes the execution of a Self-Disclosure Compliance Agreement (SDCA). Requests for full repayment within two (2) years will be considered and may be approved based on a review of the Medicaid Entity’s/Provider’s annual billings. A request for an extended repayment plan (beyond two (2) years) is not guaranteed to be approved, and a Medicaid Entity/Provider must demonstrate a financial need for extended repayment options through the submission of a financial hardship application. Please see OMIG’s website for more information: https://omig.ny.gov/information-resources/financial-hardship-application-information
The self-disclosure process, and the information required to determine confirmation of the overpayment amount, is unique to the circumstances disclosed. OMIG staff update disclosing Medicaid Entities/Providers at each stage of the case process and are available to discuss any questions or concerns that may arise. OMIG staff make every effort to process cases within 90 days.
In a typical Abbreviated Self-Disclosure submission
A Medicaid-enrolled Provider would submit a completed Abbreviated Self-Disclosure to OMIG through the secure online portal available in the Self-Disclosure section of the OMIG website. Providers may either submit an Abbreviated Self-Disclosure each time they identify and void or adjust a claim appropriate for this process, or they may use the Abbreviated Self-Disclosure Statement to document voided or adjusted overpayments appropriate for self-disclosure through this process and submit one Abbreviated Self-Disclosure each month for the overpayments identified and voided or adjusted in the previous month. Either process is acceptable as long as the disclosed claims are FFS claims overpaid due to routine or transactional errors, the claims have been voided or adjusted as repayment, and they are self-disclosed through the Abbreviated process within sixty (60) days from the date the overpayments were identified.
Once the Abbreviated Self-Disclosure is successfully submitted, the Provider would receive an automatic confirmation reply notifying them that the disclosure was received, which occurs on the same day the disclosure was submitted. The notification will contain a unique code for the submission, which should be reference the Abbreviated Self-Disclosure if needed. Abbreviated Self-Disclosure Submissions are processed as they are received. Unless additional information is necessary, this notice also constitutes final action and confirmation that the Provider’s obligation to report and explain is satisfied.
OMIG staff will verify that the voids or adjustment transactions were completed successfully and will review to ensure no larger issues exist that need further corrective action. OMIG will only contact the Provider if additional information is needed, or if it is determined that a Full Self-Disclosure submission is required for the disclosed overpayments.
Eligibility
Self-Disclosure of identified Medicaid overpayments is required. Eligibility for a self-disclosure submission to be processed through OMIG’s Self-Disclosure Program is detailed in SOS § 363-d(7)(c). To be eligible, a Medicaid Entity/Provider must meet all the following criteria:
- The Medicaid Entity/Provider must not currently be under audit, investigation, or review by OMIG, unless the overpayment and the related conduct being disclosed does not relate to OMIG’s audit, investigation, or review.
- The Medicaid Entity/Provider is disclosing an overpayment and related conduct that OMIG has not determined, calculated, researched, or identified at the time of disclosure.
- The Medicaid Entity/Provider has reported the overpayment and conduct within sixty (60) days from identification, or by the date any corresponding cost report was due, whichever is later.
- Please note that disclosures submitted more than sixty (60) days after identification may be accepted and processed, however, that submission may not be eligible for the waiver of interest or consideration of extended repayment.
- The Medicaid Entity/Provider is not currently a party to any criminal investigation conducted by the deputy attorney general for the Medicaid Fraud Control Unit (MFCU) or any agency of the United States government or any political subdivision thereof.
- The Medicaid Entity/Provider must submit the Self-Disclosure Statement appropriate to their overpayment type in the format required by OMIG. Links to the Self-Disclosure forms can be found here:
How to participate
1. Apply
If a Medicaid Entity/Provider meets the eligibility criteria and has identified an overpayment, OMIG’s self-disclosure processes provide the mechanism for reporting and returning the overpayment.
A self-disclosure submission related to a Medicaid program overpayment requires completion of either a Self-Disclosure Full Statement (including a Claims Data File of affected Medicaid claims or Mixed Payer Calculation (MPC) form) for Excluded providers, or a completed Self-Disclosure Abbreviated Statement. If the Medicaid program overpayment is not related to claims data or is related to an excluded or non-enrolled provider, disclosure using a Self-Disclosure Full Statement and additional explanation to allow for the verification of the overpayment is required.
The determination of which form is appropriate for a Medicaid Entity’s/Provider’s self-disclosure should be based on the error identified. Errors that require formal corrective action plans should always be self-disclosed using the Self-Disclosure Full Statement, while errors that are more transactional or routine in nature and already repaid through voids or adjustments may be better suited to for the Self-Disclosure Abbreviated Statement.
Self-Disclosure Full Statement
Examples to be self-disclosed using the Self-Disclosure Full Statement include but are not limited to:
- Any error that requires a Medicaid Entity/Provider to create and implement a formal corrective action plan
- Actual, potential or credible allegations of fraudulent behavior by employees or others
- Discovery of an employee on the Excluded Provider list
- Documentation errors that resulted in overpayments
- Overpayments that resulted from software or billing systems updates
- Systemic billing or claim processing issues
- Non-claim based Medicaid overpayments
- Any error with substantial monetary or program impacts
- Any instance upon direction by OMIG
Note: The Self-Disclosure Full Statement includes embedded links to the Claims Data File and MPC form.
For disclosures using the Self-Disclosure Full Statement, OMIG requires:
- The overpayment amount
- A detailed explanation of the reason that the Medicaid Entity/Provider received the overpayment or caused the overpayment to be received, including an explanation of the circumstances that led to the overpayment
- Identification of any rule, policy, regulation or statute that was violated
- Identification of the individuals involved in the error and discovery of the error
- The type of Medicaid program affected
- Corrective measures put in place to prevent a recurrence, etc.
- Contact information
- Signature of the disclosing Medicaid Entity/Provider on the form
- Signatory and Title of the responsible person who will sign the documents
- Claims Data File or MPC form if applicable
- Agreement to the terms of disclosure
- Confirmation that void or adjustment transactions have been processed, or agreement to return the overpayment amount within fifteen (15) days of written notification from OMIG, or if approved by the OMIG, agreement to executing an SDCA to repay in installments
The Claims Data File should include the following for each disclosed claim:
- Payer Name (Medicaid FFS or MCO/MLTC name)
- Claim Reference Number (CRN) or Transaction Control Number (TCN), a sixteen (16) digit number
- Claim Line Number
- Medicaid Group ID, an eight (8) digit number (if applicable)
- Billing Provider’s Medicaid MMIS ID, an eight digit number (Billing Provider ID)
- Billing Provider’s NPI number, a ten (10) digit number (if applicable)
- Servicing entity’s Medicaid MMIS ID (Servicing Provider ID if applicable)
- Servicing entity’s NPI number, a ten (10) digit number (if applicable)
- Medicaid recipient’s first name
- Medicaid recipient’s last name
- Medicaid recipient’s Medicaid ID number (CIN), an eight (8) character alphanumeric code (e.g., AA#####A)
- Medicaid recipient’s Date of Birth
- Medicaid recipient’s Social Security Number
- Date of service (not the date billed or payment date)
- Incorrect rate or procedure codes (if applicable)
- Correct rate or procedure codes (if applicable)
- Incorrect Units paid (if applicable)
- Correct Units (if applicable)
- Amount Medicaid paid
- Amount that Medicaid should have paid
- Amount paid by Medicare or any other third party (if applicable)
Self-Disclosure Abbreviated Statement
Examples to be self-disclosed using the Self-Disclosure Abbreviated Statement:
- Routine credit balance/coordination of benefits overpayments
- Typographical human errors
- Routine Net Available Monthly Income (NAMI) adjustments
- Instance of missing or faulty authorization for services due to human error
- Instance of missing or insufficient support documentation due to human error
- Inappropriate rate, procedure or fee code used due to typographical or human error
- Routine recipient enrollment issue
For disclosures using the Self-Disclosure Abbreviated Statement, OMIG requires:
- Provider Federal Employer Identification Number (FEIN) or Social Security Number (SSN)
- Provider Name or DBA
- Contact Name, title, phone number and email
- Overpayment Identification Period which details when the overpayment was identified
- Transaction Control Numbers (TCNs) of voided or adjusted claim(s)
- Overpayment Reason for each voided or adjusted claim
- Total amount voided or adjusted during the Identification Period
2. Provide additional information if requested
For Full Self-Disclosure submissions
OMIG will review the submission and determine if the disclosure can be processed through the Self- Disclosure Program (see the Eligibility section above). For disclosures made through a Self-Disclosure Full Statement, the Medicaid Entity/Provider will receive notification from OMIG with a project or case number for reference.
OMIG may ask for additional information to process the submission, or to determine eligibility for an installment payment plan requiring a SDCA. If requested, the Medicaid Entity/Provider must respond within the time frame indicated in the request. Failure to do so may result in the determination that the Medicaid Entity/Provider has become non-compliant with the Self-Disclosure process. The consequences for failing to cooperate with the Self-Disclosure process are detailed below in Compliance with the Self-Disclosure Process.
For Abbreviated Self-Disclosure submissions
Abbreviated Self-Disclosures are processed as they are received. Disclosing Providers will receive an auto reply email upon successful submission which will contain a unique identifier code. This code should be used to reference the Abbreviated Self-Disclosure if needed.
OMIG will only contact the Provider if additional information is needed, or if it is determined that a Full Self-Disclosure submission is required for the disclosed overpayments. If requested, the Provider must respond within the time frame indicated in the request. Failure to do so may result in the determination that the Medicaid Entity/Provider has become non-compliant with the Self-Disclosure process. The consequences for failing to cooperate with the Self-Disclosure process are detailed below in Compliance with the Self-Disclosure Process.
3. Determination and Payment
After OMIG’s review of all self-disclosure submission material provided in a Self- Disclosure Full Statement, the Medicaid Entity/Provider will receive a Determination Notice for their self-disclosure case.
It is expected that Medicaid Entities/Providers will implement the corrective action they have specified in their Self-Disclosure Full Statement to prevent recurrence of the disclosed issue. For those Medicaid Entities/Providers required to adopt and implement an effective compliance program, implementation (or failure to implement) corrective action(s) will be taken into consideration during any compliance program review by OMIG.
If OMIG determines that an overpayment is due, OMIG will send a Determination Notice confirming the overpayment amount, and the instructions regarding repayment.
To remain compliant with the self-disclosure process, payment of the full overpayment amount, plus any interest, must be paid within fifteen (15) days from the date of the Determination Notice, or no later than the expiration of the deadline to report, return, and explain, unless the Medicaid Entity/Provider had previously requested and was approved for an installment repayment agreement (SDCA).
Payment can be made by:
- Lump-sum check, money order or electronic check payment. Please do not send payment in with your submission
- Voids or Adjustments of the overpaid claims
- Abbreviated Self-Disclosure: Claims disclosed using the Abbreviated Self-Disclosure process MUST be voided or adjusted to repay Medicaid prior to submitting the disclosure
- Full Self-Disclosure: Claims disclosed using the Full Self-Disclosure process may be voided or adjusted to repay Medicaid, and this is the recommended repayment option when feasible. Voids and adjustments MUST either be completed prior to submission, or the Medicaid Entity/Provider MUST notify OMIG within the Full Self-Disclosure Statement that they are in the process of voiding or adjusting the claims
In certain circumstances, and at the sole discretion of OMIG, installment repayment terms may be permitted. Medicaid Entities/Providers will be required to demonstrate financial need by including a detailed request for consideration of installment payments with their Self-Disclosure Full Statement, along with copies of any requested financial documentation. All installment payment agreements will require the Medicaid Entity/Providers to execute a Self-Disclosure Compliance Agreement (SDCA) within fifteen (15) days from the date the SDCA document is received.
Compliance with the Self-Disclosure Process
Once a Medicaid Entity/Provider has submitted a Self-Disclosure Full Statement or a Self- Disclosure Abbreviated Statement, they must remain compliant and cooperate with the self-disclosure process and share any additional information that may be requested.
Violations of Self-Disclosure process include, but are not limited to:
- Providing false material information in any disclosure documents
- Failure to cooperate in validating the overpayment amount disclosed
- Intentional omission of material information from any disclosure documents, including the failure to submit a completed Self-Disclosure Full Statement, when directed.
- Failure to pay the overpayment amount and interest as agreed
- Failure to execute the SDCA
- Violation of the provisions detailed in the SDCA
Violations of the Self-Disclosure Process, including the SDCA, shall result in:
- Termination of the Medicaid Entity’s/Provider’s participation in the self-disclosure process. The Medicaid Entity’s/Provider’s 60-day timeframe will un-toll. Failure to report, return, and repay a Medicaid overpayment within 60 days from identification is a violation of SOS § 363-d
- OMIG may seek to impose penalties pursuant to SOS §145-b(4)(a)(iii) for failure to report, return, and explain the overpayment
- Other penalties that may be applicable under State and Federal law
Please note that OMIG may use disclosed information and shall pursue any civil or criminal penalty that might apply to the misconduct disclosed as part of the program process.
Monetary Penalties
In addition to recovery of any overpayment, failure to participate or meet the requirements of the self-disclosure process may result in monetary penalties.
SOS §145-b(4) Penalty for failure to report, return and explain:
- The penalties imposed for failure to report, return, and explain shall be based on the guidelines specified in SOS § 145-b(4) and the process outlined 18 NYCRR Part 516.
- This penalty is not to exceed $10,000 per item or service, except when a penalty under this section has been imposed on the Medicaid entity/Provider within the previous five years. In those cases, the penalty shall not exceed $30,000 per item or service.
Disclosing Damaged, Lost or Destroyed Records
Pursuant to Title 18 of the New York Codes Rules and Regulations, Section 504.3, providers are required to prepare and maintain contemporaneous records demonstrating their right to receive payment under the medical assistance program and furnish the records, upon request. If a provider becomes aware that their records have been damaged, lost or destroyed, they are required to report that information to the Self-Disclosure Program as soon as practicable, but no later than thirty (30) calendar days after discovery.
How to Report
A submission for lost, destroyed, or damaged records requires completion of a Statement of Lost or Destroyed Records form and submission of any accompanying documentation to support the report of loss or damaged records.
For reports of lost, destroyed, or damaged records OMIG requires:
- Provider NYS Medicaid enrollment information including Medicaid Management Information System (MMIS) number and National Provider Identifier (NPI) number;
- Provider contact information; and
- Completed Statement of Lost, Damaged or Destroyed Records fully explaining the loss, damage or destruction of records including:
- A complete and full description of the loss/destruction that occurred, including when it occurred, and how and when it was discovered;
- A listing of the documents affected including document type, relevant recipients, and dates of service;
- Names and titles of individuals who discovered and documented the loss/destruction;
- A description of all actions taken to prevent recurrence of the event that caused the loss/destruction; and
- A complete listing and copies of any reports of the loss/destruction to insurance companies, police agencies, state agencies, or federal organizations, including contact information for those entities.
OMIG’s Response
A notification letter detailing the acceptance of the report will be issued to the provider or the provider’s authorized representative.
Recordkeeping
OMIG’s receipt and acknowledgement of a provider’s Self-Reporting Notification does not absolve the provider of its recordkeeping responsibilities. The paid claims and/or program associated with the lost/destroyed records remain available for audit, review, or investigation. OMIG will evaluate whether there are mitigating circumstances for the failure to maintain these documents in conjunction with any audit, review or investigation that involves the reportedly lost/destroyed records.
For More Information
Contact OMIG’s Self-Disclosure Unit by email at: [email protected].