§495.368 Combating fraud and abuse
(a) General rule.
(1) The State must comply with Federal requirements to—
(i) Ensure the qualifications of the providers who request Medicaid EHR incentive payments;
(ii) Detect improper payments; and
(iii) In accordance with §455.15 and §455.21 of this chapter, refer suspected cases of fraud and abuse to the Medicaid Fraud Control Unit.
(2) The State must take corrective action in the case of improper EHR payment incentives to Medicaid providers.
(b) Providers’ statements regarding submission of documentation containing falsification or concealment of a material fact on EHR incentive payment documentation. For any forms on which a provider submits information necessary to the determination of eligibility to receive EHR payments, the State must obtain a statement that meets the following requirements:
(1) Is signed by the provider and contains the following statement: ”This is to certify that the foregoing information is true, accurate, and complete. I understand that Medicaid EHR incentive payments submitted under this provider number will be from Federal funds, and that any falsification, or concealment of a material fact may be prosecuted under Federal and State laws.”
(2) Appears directly above the claimant’s signature, or if it is printed on the reverse of the form, a reference to the statements must appear immediately preceding the provider’s signature.
(3) Is resubmitted upon a change in provider representative.
(4) Is updated as needed.
(c) Overpayments. States must repay to CMS all Federal financial participation received by providers identified as an overpayment regardless of recoupment from such providers, within 60 days of discovery of the overpayment, in accordance with sections 1903(a)(1), (d)(2), and (d)(3) of the Act and part 433 subpart F of the regulations.
(d) Complying with Federal laws and regulations. States must comply with all Federal laws and regulations designed to prevent fraud, waste, and abuse, including, but not limited to applicable provisions of Federal criminal law, the False Claims Act (32 U.S.C. 3729 et seq.), and the anti-kickback statute (section 1128B(b) of the Act).
Make sure you are Omnibus Rule Compliant: HIPAA Privacy Checklist.