The Pennsylvania Department of Human Services (DHS) requires Managed Care Organizations (MCOs) to oversee the activities of third-party Subcontractors who perform delegated functions on behalf of the MCO.

What is a Subcontractor?

Subcontractor (CHIP): Subcontractor means an individual or entity that has a contract with an MCO, prepaid inpatient health plan (PIHP), prepaid ambulatory patient health plan (PAHP), or primary care case management (PCCM) entity that relates directly or indirectly to the performance of the MCO's, PIHP's, PAHP's, or PCCM entity's obligations under its contract with the state. A network provider is not a Subcontractor by virtue of the network provider agreement with the MCO, PIHP, or PAHP. (Source: CHIP Procedures Manual, effective 3/1/2019, requires MCO to adhere to 42 C.F.R. § 438.230(c), which uses this definition.)

Subcontractor (Medicaid): An individual or entity that has a contract with a PH-MCO that relates directly or indirectly to the performance of the PH-MCO’s obligation under its contract with the Department. A network provider is not a Subcontractor by virtue of the network Provider Agreement with the MCO, PIHP, or PAHP (42 C.F.R. § 438.2).

Subcontractor (CHC): An individual or entity that has a contract with a CHC-MCO that relates directly or indirectly to the performance of the CHC-MCO’s obligation under its contract with the Department. A network provider is not a Subcontractor by virtue of the network Provider Agreement with the MCO, PIHP, or PAHP (42 C.F.R. § 438.2).

Subcontractor (Community Care Behavioral Health Organization "Community Care"): An individual or entity that has a primary contract with a Primary Contractor or its BH-MCO, that relates directly or indirectly to the performance of the Primary Contractor or BH-MCO's obligation under its contract with the department. (42 C.F.R. § 438.230(c).

Annual Compliance Attestation

An authorized representative from your organization is required to complete the Third-party Compliance Program Attestation on behalf of your organization on an annual basis. In doing so, you attest to your organization’s compliance with the Third-Party Compliance Program requirements. For the purposes of this attestation, an authorized representative is an individual who has responsibility, directly or indirectly, for all employees, contracted personnel, and delegated vendors who provide administrative and/or health care services for UPMC; this would include a Chief Compliance Officer, Chief Medical Officer, Chief Operating Officer, or other executive position.

Third-Party Compliance Program Attestation Form

UPMC will send a notification to each Subcontractor to communicate the deadline for completion of the annual attestation. All Subcontractors must complete the attestation within the designated time frame.

Code of Conduct/Compliance Policies

A Code of Conduct or Standards of Conduct state the overarching principles and values by which an organization operates and defines the underlying framework for an organization’s compliance policies and procedures. The Code of Conduct and compliance policies describe your organization’s expectations that all employees conduct themselves in an ethical manner, that issues of noncompliance and potential fraud, waste, and abuse (FWA) are reported through appropriate mechanisms, and that reported issues will be addressed and corrected. The Code of Conduct communicates to employees of your organization that compliance is everyone’s responsibility, from the top to the bottom of the organization. As a Subcontractor who contracts with UPMC ISD, you are required to distribute the Code of Conduct and any additional compliance policies and procedures to all employees who provide services for UPMC ISD. Subcontractors must retain proof of distribution for each employee.

Code of Conduct (PDF)

General Compliance and Fraud, Waste, and Abuse Training

As an entity that has a contract with UPMC ISD that relates directly or indirectly to the performance of UPMC ISD’s obligation under its contract with DHS, you must, at a minimum, provide any new employee or contractor training on Fraud, Waste, and Abuse (FWA) and General Compliance at hiring/contracting and annually thereafter.

To reduce the potential burden on our Subcontractors, UPMC ISD has developed and made available standardized General Compliance and FWA training and education modules. Those trainings can be found in the below links. You can use the provided FWA and General Compliance trainings that were created by UPMC ISD, or a similar FWA and General Compliance training program.

What is fraud, waste, and abuse?

Fraud is an intentional misrepresentation that is made to obtain something of value.

Waste is an overutilization of services that, directly or indirectly, results in unnecessary costs.

Abuse is an affirmative action that is inconsistent with sound medical, business or fiscal practices, and that is not medically necessary.

Subcontractors are required to support our fraud, waste, and abuse (FWA) prevention and detection efforts and establish written policies and procedures (P&Ps).

Subcontractors must have an established compliance program and P&Ps that describe:

False Claim Act:
FWA prevention;
State-specific requirements;
Implementation of reporting expectations;
The mechanism for employees/Subcontractors to report FWA; and
How to document completion of employee training.

Exclusion Screenings

Federal law prohibits the payment of Medicare, Medicaid, or any other federal health care program for any item or service furnished by a person or entity excluded from participation in these federal programs.

Subcontractors are required to review the DHHS Office of Inspector General (OIG) List of Excluded Individuals and Entities (LEIE), the General Services Administration (GSA) System for Award Management (SAM), and Pennsylvania Medicheck lists. These checks must be performed prior to the hiring or contracting of any new employee, temporary employee, volunteer, consultant, or governing body member, and monthly thereafter, to ensure that none of these persons are excluded or become excluded from participation in federal and state programs.

The websites utilized to perform the required screening are:

If an employee or contractor appear on an exclusion list, he or she must be removed from any work directly or indirectly related to federal or state health care programs, and appropriate corrective action must be taken.

Subcontractors must maintain evidence of exclusionary reviews (e.g., logs or other records) to document that each employee and contractor has been screened in accordance with regulations and requirements.

Reporting FWA and Compliance Concerns

UPMC ISD takes compliance concerns and suspected or actual violations program very seriously. As a Subcontractor, you must ensure that all of your employees are informed of how to report compliance concerns and suspected misconduct. We will perform an internal investigation of each concern after your organization reports any incidents.

Good faith reporting of suspected noncompliance or FWA is expected and accepted behavior. Anyone who in good faith reports a violation is referred to as a “whistleblower” and is protected from any retaliation by the Company. A number of laws contain whistleblower protection, including the False Claims Act. You are expected to cooperate with any investigation resulting from a report. We have various reporting mechanisms for your use to ensure confidentiality when reporting compliance concerns and/or suspected or actual misconduct.

UPMC Health Plan Compliance Hotline: 1-877-983-8442

Third-party Compliance:
Thirdpartycompliance@upmc.edu

Medicaid Compliance:
medicaidcompliance@upmc.edu

CHIP Compliance:
CHIPcompliance@upmc.edu

CHC Compliance:
CHCcompliance@upmc.edu

Community Care Behavioral Health Compliance:
CCBH_Comp@upmc.edu

Ongoing Monitoring and Auditing

As a Subcontractor, you must ensure that your organization is in compliance with state and federal regulations. UPMC ISD reserves the right to request that you provide evidence of your compliance with the above requirements or other requirements within the scope of our delegation to you. If you fail to comply with the Subcontractor Compliance Program requirements, UPMC ISD will request remedial action. The remedial action will depend upon the severity of your noncompliance and may include requiring a corrective action.

Section 1557 Final Rule

On April 26, 2024, the Department of Health and Human Services’ (HHS) Office of Civil Rights (OCR) released a Final Rule on the Affordable Care Act’s (ACA) Section 1557 Non-discrimination in Health Programs and Activities. The rule was published in the Federal Register on May 6, 2024. The Section 1557 Final Rule (Final Rule) prohibits discrimination in certain health programs and activities on the basis of race, color, national origin, sex, age, or disability.

The final rule applies to health programs or activities that receive HHS funding, health programs or activities administered by HHS (such as the Medicare Part D program), and the health insurance Marketplace (and all plans offered by issuers that participate in those Marketplaces that receive Federal financial assistance). Those covered by the rule may include hospitals, health clinics, health insurance issuers, state Medicaid agencies, community health centers, physicians’ practices, and home health care agencies.

Health programs or activities may comprise more than one recipient of Federal financial assistance. For example, a primary recipient (or “direct” recipient) is an entity that accepts Federal financial assistance from a Federal agency. The direct recipient may then distribute the Federal financial assistance to a subrecipient (or “indirect” recipient) to carry out all or part of the health program or activity. Primary recipients and all subrecipients are covered and must comply with section 1557. Under general civil rights principles, both the primary recipient and subrecipient are responsible for complying with applicable civil rights laws. Therefore, if an entity receives Federal financial assistance—directly as a primary recipient or indirectly as a subrecipient—it would be a covered entity and responsible for complying with Section 1557 and the part. As a recipient of Federal financial assistance, UPMC is a primary “direct” recipient and by executing a contract with UPMC, all delegated entities are subrecipients or “indirect” recipients and are to be considered a covered entities that are responsible for complying with Section 1557.

Covered entities include FDRs; marketplace/exchange DDEs; and Subcontractors. As a covered entity under the Final Rule, your organization is required to maintain written policies and procedures that include: (1) a non-discrimination policy, (2) grievance procedures, (3) language access procedures, (4) effective communication procedures, and (5) reasonable modification procedures.

All covered entities are required to train relevant employees in their health programs and activities on their Section 1557 policies and procedures. Additionally, all covered entities are required to provide a notice of non-discrimination to participants, beneficiaries, enrollees, and applicants of their health programs and activities, and to members of the public. Under the Final Rule, all covered entities are required to notify the public of the availability of language assistance services and auxiliary aids and services for their health programs and activities. Covered entities must take reasonable steps to provide meaningful access to each limited English proficiency (LEP) individual to be served or likely be directly affected by its health programs and activities. The Final Rule also requires all covered entities to take appropriate steps to ensure that communications with individuals with disabilities and companions with disabilities are as effective as communications with individuals without disabilities in its health programs and activities. Covered entities are required to make reasonable modifications to policies, practices, or procedures when such modifications are necessary to avoid discrimination on the basis of disability, unless the covered entity can demonstrate that making the modifications would fundamentally alter the nature of the health program or activity.

Code of Federal Regulations (89 FR 37522) – Nondiscrimination in Health Programs and Activities Final Rule (Full Text)

Third-Party Newsletter Article on the Section 1557 Final Rule (Q3-Issue 25, 2024)

Who We Are

Community Engagement

Signature Initiatives

News & Media

Quality & Safety

Vendor Information

Third-Party Compliance Oversight

Regulatory Compliance Program Requirements for Medical Assistance, Community HealthChoices, Community Care Behavioral Health, and Children’s Health Insurance Program Subcontractors