Attestation

1. Has your organization distributed the established compliance policies, procedures, and Standards of Conduct in accordance with the requirements outlined in the FDR Guide?^*

Yes No

2. Does your organization require employees involved with providing or supporting Medicare Advantage services on behalf of MMO, to take the General Compliance training within 90 days of hire and annually thereafter?^* (If your organization is a sole proprietorship, please include yourself as an employee.)

Yes No

3. Does your organization require employees involved with providing or supporting Medicare Advantage services on behalf of MMO to take the Fraud, Waste, and Abuse (FWA) training within 90 days of hire and annually thereafter or has your organization been deemed to have met the FWA certification requirements through enrollment in the Medicare program or accreditation as a supplier of Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS)?^*

Yes No

4. Does your organization confirm that prior to hiring and then monthly thereafter that it and all employees, board members, officers, consultants, volunteers, temporary employees, providers and contractors involved in the administration or delivery of Medicare Advantage services are not excluded from participating in any Federally funded programs?^* (If your organization is a sole proprietorship, please include yourself as an employee.)

Yes No

5. Does your organization have at least one anonymous mechanism for employees to report suspected FWA or noncompliance, and has the reporting mechanism been distributed to employees?^* (If your organization is a sole proprietorship, please include yourself as an employee.)

Yes No

6. Does your organization maintain all books, records, and documents regarding the Medicare Advantage services you perform for Medical Mutual of Ohio, as well as documentation of compliance with all Medicare requirements for at least ten (10) years, consistent with 42 C.F.R. §§ 422.504(d)–(e) and/or 423.505(d)–(e)?^*

Yes No

7. Does your organization confirm that all subcontracted, downstream entities that assist with Medicare Advantage services, if any, adhere to these compliance requirements? If you do not sub-contract other entities to perform delegated functions, answer not applicable.^*

Yes No Not Applicable

If you answered yes or no, please describe the entities and what services they perform:

8. Is your organization free of any conflict of interest in administering or delivering Medicare Advantage or other Federally-funded program benefits to Medical Mutual beneficiaries?^*

Yes No

9. Does your organization employ or utilize any offshore entities to perform Medicare Advantage services for Medical Mutual of Ohio that involves processing, handling, or accessing Protected Health Information (PHI)? ^*

Yes No

Please answer these additional questions regarding Offshore Entities:

Offshore subcontractor Name^*

Offshore subcontractor Address:

Address^* Address Line 2 City^* State / Province / Region ^* ZIP / Postal Code^* Country^*

Check if you have multiple offshore subcontractor locations.

Describe offshore subcontractor functions.^*

Proposed or actual effective date for offshore subcontractor (in MM/DD/YYYY format). ^*

Describe the Protected Health Information (PHI) that will be provided to the offshore subcontractor. ^*

Discuss why providing PHI is necessary to accomplish the offshore subcontractor objectives. ^*

Describe alternatives considered to avoid providing PHI and why each alternative was rejected. ^*

9.1. Offshore subcontracting arrangement has policies and procedures in place to ensure that Medicare beneficiary Protected Health Information (PHI) and other personal information remains secure.^*

Yes No

9.2. Offshore subcontracting arrangements prohibits subcontractor's access to Medicare data not associated with the sponsor's contract with the offshore subcontractor.^*

Yes No

9.3. Offshore subcontracting arrangement has policies and procedures in place that allow for immediate termination of the subcontract upon discovery of a significant security breach.^*

Yes No

9.4. Offshore subcontracting arrangement includes all required Medicare Part C and D language (e.g., record retention requirements, compliance with all Medicare Part C and D requirements, etc.)^*

Yes No

9.5. Organization will conduct an annual audit of the offshore subcontractor.^*

Yes No

9.6. Audit results will be used by organization to evaluate the continuation of its relationship with the offshore subcontractor.^*

Yes No

9.7. Organization agrees to share offshore subcontractor's audit results with CMS, upon request.^*

Yes No

Additional Required Documents

Attachment 1: Policies and procedures that document the process used to ensure the security of Medicare Member PHI and other personal information.

Attachment 2: Policies and procedures that document the process used for the immediate termination of the subcontract upon discovery of a significant breach.

Attachment 3: The agreement (proprietary information removed) with the offshore subcontractor.

Attachment 4: Policies and procedures that document the process used for conducting annual audits, monitoring and tracking results, and resolving and identifying deficiencies.

Note: You do not need to upload documents in order to submit this form but you will still be required to send them to Medical Mutual in order for your attestation to be complete. Additional information on how to do this will be provided in your confirmation email.

Provider Attestation

Please Confirm:

Please answer these additional questions regarding Offshore Entities:

Offshore subcontractor Address:

Additional Required Documents

Responses provided on this attestation are subject to audit or verification by Medical Mutual.