What Compliance Training Do Medicare Advantage and Part D Plans Need?

Medicare Advantage organizations and Part D sponsors must run a compliance program with seven core elements, and training is one of them. The rules are at 42 CFR 422.503(b)(4)(vi) for Medicare Advantage and 42 CFR 423.504(b)(4)(vi) for Part D, and the two sections track each other closely. The FAQ on compliance training covers the general concept.

The seven core elements. The compliance program must be effective in preventing, detecting and correcting noncompliance with CMS program requirements and fraud, waste and abuse. It must include:

• Written policies, procedures and standards of conduct, including a commitment to comply with federal and state standards and a policy of non-intimidation and non-retaliation.
• A compliance officer and a compliance committee that report to the CEO or senior management and to the governing body. The compliance officer must be an employee of the plan sponsor, its parent or a corporate affiliate, not of a first tier, downstream or related entity.
• Effective training and education.
• Effective lines of communication, including a way to report issues anonymously and confidentially.
• Well-publicized disciplinary standards.
• An effective system for routine monitoring, auditing and identifying compliance risks.
• Procedures for prompt response to compliance issues as they are raised.

Who must be trained. The training element covers the compliance officer, organization employees, the chief executive and other senior administrators, managers, and governing body members. Training must take place at least annually and be part of orientation for new employees and new appointments to a chief executive, manager or governing body member position (42 CFR 422.503(b)(4)(vi)(C) and 423.504(b)(4)(vi)(C)).

First tier, downstream and related entities. CMS's Contract Year 2019 rule (83 FR 16440, April 16, 2018, effective June 15, 2018) removed the regulatory requirements for sponsors to provide compliance training to first tier, downstream and related entities, including the mandatory use of CMS-developed training. The rule did not remove the sponsor's accountability. Plan sponsors remain responsible for compliance by the entities they contract with, and many sponsors still require their own training or attestations in contracts.

Board oversight. The governing body must be knowledgeable about the content and operation of the compliance program and exercise reasonable oversight of its implementation and effectiveness. Training for board members supports that duty.

Documentation. Sponsors should keep training rosters, completion dates, content outlines and board minutes. Records showing that each group received training within the year and at onboarding support the documentation of this element.

Related topics. CMS oversight of plan quality is covered in the Learn Laws® news item on NCQA deeming authority. Sponsors that handle protected health information also train staff under HIPAA, which the FAQ on whether HIPAA training is mandatory covers.