§ 153.630 Data validation requirements when HHS operates risk adjustment.
(a) General requirement. An issuer of a risk adjustment covered plan in a State where HHS is operating risk adjustment on behalf of the State for the applicable benefit year must have an initial and second validation audit performed on its risk adjustment data as described in this section.
(b) Initial validation audit. (1) An issuer of a risk adjustment covered plan must engage one or more independent auditors to perform an initial validation audit of a sample of its risk adjustment data selected by HHS. The issuer must provide HHS with the identity of the initial validation auditor, and must attest to the absence of conflicts of interest between the initial validation auditor (or the members of its audit team, owners, directors, officers, or employees) and the issuer (or its owners, directors, officers, or employees), to its knowledge, following reasonable investigation, and must attest that it has obtained an equivalent representation from the initial validation auditor, in a timeframe and manner to be specified by HHS.
(2) The issuer must ensure that the initial validation auditors are reasonably capable of performing an initial data validation audit according to the standards established by HHS for such audit, and must ensure that the audit is so performed.
(3) The issuer must ensure that each initial validation auditor is reasonably free of conflicts of interest, such that it is able to conduct the initial validation audit in an impartial manner and its impartiality is not reasonably open to question.
(4) The issuer must ensure validation of the accuracy of risk adjustment data for a sample of enrollees selected by HHS. The issuer must ensure that the initial validation audit findings are submitted to HHS in a manner and timeframe specified by HHS.
(5) An initial validation audit must be conducted by medical coders certified as such and in good standing by a nationally recognized accrediting agency.
(6) An issuer must provide the initial validation auditor and the second validation auditor with all relevant source enrollment documentation, all claims and encounter data, and medical record documentation from providers of services to each enrollee in the applicable sample without unreasonable delay and in a manner that reasonably assures confidentiality and security in transmission. Notwithstanding any other provision of this section, a qualified provider that is licensed to diagnose mental illness by the State and that is prohibited from furnishing a complete medical record by applicable State privacy laws concerning any enrollee's treatment for one or more mental or behavioral health conditions may furnish a signed mental or behavioral health assessment that, to the extent permissible under applicable Federal and State privacy laws, should contain: The enrollee's name; sex; date of birth; current status of all mental or behavioral health diagnoses; and dates of service. The mental or behavioral health assessment should be signed by the provider and submitted with an attestation that the provider is prohibited from furnishing a complete medical record by applicable State privacy laws.