HLT-42-14-00001-P Audited Financial Statements for Managed Care Organizations

10/22/14 N.Y. St. Reg. HLT-42-14-00001-P

NEW YORK STATE REGISTER

VOLUME XXXVI, ISSUE 42

October 22, 2014

RULE MAKING ACTIVITIES

DEPARTMENT OF HEALTH

PROPOSED RULE MAKING

NO HEARING(S) SCHEDULED

 

I.D No. HLT-42-14-00001-P

Audited Financial Statements for Managed Care Organizations

PURSUANT TO THE PROVISIONS OF THE State Administrative Procedure Act, NOTICE is hereby given of the following proposed rule:

Proposed Action:

Amendment of section 98-1.16(c); and addition of Subpart 98-3 to Title 10 NYCRR.

Statutory authority:

Public Health Law, sections 4403(2) and (f)(7)

Subject:

Audited Financial Statements for Managed Care Organizations.

Purpose:

To extend audit and reporting standards to all managed care organizations (MCOs), including PHSPs, HIV SNPs and MLTCPs.

Substance of proposed rule (Full text is posted at the following State website:www.health.ny.gov):

The purpose of the amendments is to extend audit and reporting standards to all managed care organizations (MCOs) certified under Article 44 of the Public Health Law. The amendments will apply to MCOs (Prepaid Health Services Plans, HIV Special Needs Plans and Managed Long Term Care Plans) (PHSPs, HIV SNPs and MLTCPs) that were not included under the Department of Financial Services Regulation 118. This will ensure that all MCOs authorized to operate under Article 44 must adhere to the same financial reporting requirements and standards in the filing of audited financial statements.

The proposed regulation is closely patterned upon 11 NYCRR 89 (Regulation 118) adopted by the Department of Financial Services and the National Association of Insurance Commissioners model audit rule ("NAIC model") that reflects a consensus of the insurance regulators of all states and territories of the United States as to scope, detail, needs and benefits. The NAIC model imposes additional rules patterned on the Sarbanes-Oxley Act of 2002, 15 U.S.C. § 7201 et seq. ("SOX"), and is similar to Regulation 118 and the proposed amendments to Part 98.

The proposal adds provisions to Part 98 regarding the following:

• Designation of CPA.

• Qualifications of CPA.

• Consolidated or combined audits.

• Scope of audit and report of CPA.

• Notification of adverse financial condition.

• Communication of internal control related matters noted in an audit.

• CPA’s letter of qualifications.

• Availability and maintenance of CPA work papers.

• Requirements for audit committees.

• Conduct of MCO in connection with the preparation of required reports and documents.

• Management’s report of internal control over financial reporting.

• Effective date and special rules.

Text of proposed rule and any required statements and analyses may be obtained from:

Katherine Ceroalo, DOH, Bureau of House Counsel, Reg. Affairs Unit, Room 2438, ESP Tower Building, Albany, NY 12237, [phone], email: [e-mail]

Data, views or arguments may be submitted to:

Same as above.

Public comment will be received until:

45 days after publication of this notice.

Regulatory Impact Statement

Statutory Authority:

Sections 4403(2), 4403-f(7) of the Public Health Law. These sections establish the Commissioner’s authority to promulgate regulations governing the operations of managed care organizations (MCOs), including the preparation and filing of audited financial statements.

Public Health Law section 4403(2) states the Commissioner may adopt and amend rules and regulations pursuant to the state administrative procedures act to effectuate the purposes and provisions of Article 44.

Public Health Law section 4403-f(7) states the Commissioner shall promulgate regulations to implement this section and to ensure the quality, appropriateness and cost-effectiveness of the services provided by managed long term care plans.

Legislative Objectives:

10 NYCRR 98 was extensively amended in 2005 to further implement the provisions of Article 44 of the Public Health Law. The proposed amendment to section 98-1.16(c) and the promulgation of the new section 98-3 adds new provisions consistent with the provisions of the Sarbanes-Oxley Act of 2002, 15 U.S.C. § 7201 et seq. ("SOX") and 11 NYCRR 89.

Needs and Benefits:

SOX imposes a comprehensive regime of audits and internal management controls and reports designed to ensure greater transparency and accountability.

The proposed regulation is closely patterned upon 11 NYCRR 89 (Regulation 118) adopted by the Department of Financial Services (DFS), formerly the NYS Department of Insurance, and the National Association of Insurance Commissioners model regulation ("NAIC model") that reflects a consensus of the insurance regulators of all states and territories of the United States as to scope, detail, needs and benefits. The NAIC model imposes additional rules patterned on SOX and is similar to Regulation 118 and the proposed amendments to Part 98. For example, the NAIC model, Regulation 118 and the proposed amendments to Part 98 all require the regulated insurer to forbid its certified independent public accountant (CPA) from entering into an agreement of indemnity or release from liability.

The proposed amendments will apply to managed care organizations (MCOs), such as PHSPs, HIV SNPs and MLTCPs, that were not included under Regulation 118. This will ensure that all MCOs authorized to operate under Article 44 must adhere to the same financial reporting requirements and standards.

The proposed amendments, once adopted, will ensure that regulated companies engage in best practices related to auditor independence, corporate governance and internal controls over financial reporting.

Costs:

This regulation imposes no compliance costs on state or local governments. There will be no additional costs incurred by the Health Department. Costs to be incurred by the parties affected differ depending upon the size of the company and whether that company is publicly held and thus already required to comply with SOX. Companies regulated by SOX will incur few additional costs. Compliance cost estimates received by DFS from a cross-section of affected companies that are not subject to SOX are most often estimated to be minimal or negligible. Of those companies that stated compliance would require additional expenditures, the cost is estimated to be about $25,000.

Local Government Mandates:

The regulation imposes no new programs, services, duties or responsibilities on any county, city, town, village, school district, fire district or other special district.

Paperwork:

Paperwork associated with filings to the commissioner should be minimal. The paperwork associated with the audit and controls regime required by the proposed regulation should also be minimal.

Duplication:

The proposal does not duplicate any existing federal, state, or local regulations.

Alternatives:

In developing Regulation 118, the DFS obtained industry input and hued to the model regulation developed by the National Association of Insurance Commissioners (the "NAIC model") to implement SOX to the extent possible. However, the model has been modified as necessary to comply with New York statutes and regulations. The proposed regulation also restricts its application only to those entities over which the Health Department has jurisdiction unlike the NAIC model, which also contains rules that apply to CPAs.

Several comments received by DFS noted the compliance difficulties faced by foreign companies and United States branches of alien insurers, specifically with respect to the roles to be performed by persons not residing in the United States and for the reporting requirements to be imposed upon an integrated enterprise containing insurers in New York as well as entities with no nexus to New York. In response, the DFS modified Regulation 118, as reflected in the proposed amendments to part 98, to provide detailed rules as to whether members of management may attest to filings, and to establish limited exceptions available only to these entities, in addition to the provision that permits a waiver of any provision of the regulation upon evidence of financial or organizational hardship.

Another commenter objected to restrictions on using the same CPA for SOX audit work and tax return preparation for more than a five-year period for small companies. The exemption from any provision of the proposed regulation available upon proof of financial or organization hardship now addresses this comment.

Several comments noted that a company may be required to file both SOX reports and the reports required by the NAIC model as adopted by the various states. Companies want to avoid making duplicative filings to those required by the state of domicile. The proposed regulation contemplates accepting the domiciliary state filings as New York filings to the extent that they are substantially similar to those required by the proposed regulation.

Several comments noted differences between the NAIC model and the proposed regulation on filing deadlines, exceptions and the rules governing confidentiality of work papers. Different dates or deadlines are due to restrictions in New York law that require modification to the NAIC model. Certain automatic exclusions from the NAIC model could not be included in the proposed regulation to the extent that they conflict with New York law. Finally, the confidentiality of commercial information, including work papers, obtained by state and local government is already subject in New York to a comprehensive regime of rules, exceptions and requirements, and thus did not need to be addressed in the proposed regulation.

Federal Standards:

The federal rules under SOX are extensive. The provisions in the proposed regulation are similar to the comparable federal provisions. The regulation does not conflict with any federal rules.

Compliance Schedule:

The regulation would apply beginning with the reporting period ending December 31, 2014. The initial audited financial statements completed under this regulation would be the 2014 annual statements due April 1, 2015.

Regulatory Flexibility Analysis

The Health Department finds that this regulation would not impose reporting, recordkeeping or other requirements on small businesses since the provisions contained therein apply only to regulated MCOs authorized to do business in New York State. Inasmuch as most of these companies are not independently owned and operated and employ more than 100 individuals, they do not fall within the definition of "small business" as found in section 102(8) of the State Administrative Procedure Act. MCOs that qualify as a small business will need to document that the processes and rules established by the regulation have been followed, consistent with current recordkeeping requirements. The Health Department has determined that such recordkeeping will be routine and will not have an adverse economic impact on the MCO.

Compliance costs estimates reported by the Department of Financial Services varies from $25,000 a year to in excess of $2 million (for one large mutual insurance company that is not a MCO covered by Part 98). However, the proposed amendments allow any company, including a small business, to request an exemption from any and all of its requirements upon written application to the commissioner based upon a financial or organizational hardship upon the company.

These amendments contain minimum requirements that must be included in the contract between a regulated company and the CPA retained by the company. Accordingly, CPAs, regardless of whether they are small businesses or not, could be considered affected parties under this regulation. However, the Health Department estimates the impact of the continuation of these rules to be minimal, especially since if a CPA agrees to audit a regulated company, the price of the engagement will compensate the CPA for costs incurred. Additionally, CPAs retained by insurers tend to be large limited liability corporations or partnerships that are not small businesses. In any event, a CPA may choose not to audit a company that will require execution of a contract subject to these amendments.

There are no technological impediments to compliance with the proposed rule. Comments about the proposed rule were requested from the MCOs and MCO plan associations, and all responses were reviewed. One commentator indicated that compliance with the regulation could be a financial hardship for some small MCOs. However, as noted above, MCOs may request an exemption from any and all of its requirements upon written application to the commissioner based upon a financial or organizational hardship upon the company.

The amendments do not impose any impact, including any adverse impact, or reporting, recordkeeping, or other compliance requirement on any local government.

Rural Area Flexibility Analysis

Types and Estimated Number of Rural Areas:

Companies affected by the proposed regulation include PHSPs, HIV SNPs and MLTCPs authorized to do business in New York State. The companies affected by this regulation do business in certain "rural areas" as defined under section 102(1) of the State Administrative Procedure Act. Some of the home offices of these companies may lie within rural areas. Further, companies may establish new office facilities and/or relocate in the future depending on their requirements and needs.

Reporting, Recordkeeping and Other Compliance Requirements:

Many of the compliance requirements (such as filing due date and record retention period) are consistent with the requirements presently contained in Part 98 and should not impose upon any regulated party, regardless of whether they are located in a rural area or not, any additional paperwork, recordkeeping or compliance requirements. The obligations imposed by the proposed regulation with regard to establishment and maintenance of audit controls and standards are consistent with those required by current Part 98 and a federal statute, the Sarbanes-Oxley Act of 2002, 15 U.S.C. § 7201 et seq. ("SOX"), that imposes similar rules. If there are failures in the audit and controls process, a company is required to notify the Commissioner. The regulation contains automatic exclusions from compliance for certain small companies. Further, any company that faces organizational or financial hardship can seek an exemption from any requirement imposed by the regulation.

The proposed regulation requires a regulated company to perform the audit of its operation and controls with the assistance of CPA. The terms of the employment of the CPA and the period for which work papers and communications are to be retained are both specified in the proposed regulation. Accordingly, CPAs, regardless of whether they are located in rural areas or not, could be considered affected parties under this regulation. However, the Health Department estimates the impact of these rules on CPAs, regardless of whether they are located in rural areas or not, should be negligible, if any at all. Indeed, if a CPA agrees to audit a regulated company, the price of the engagement will compensate the CPA for costs incurred. Additionally, CPAs retained by insurers tend to be large limited liability corporations or partnerships that are not small businesses. In any event, a CPA may choose not to audit a company that will require execution of a contract subject to this regulation.

Costs:

The proposed regulation implements requirements largely based on the rules imposed by SOX. The cost of complying with the new requirements will depend on the size of the company and whether the company is already subject to SOX because it is publicly held. Companies regulated by SOX will incur few additional costs beyond those imposed by current Regulation 118 and the federal statute. Compliance cost estimates with respect to the proposed regulation were received from a cross-section of companies that are not subject to SOX. If the company is already required to comply with similar regulations in other states, the additional expense of the New York proposed regulation is estimated to be minimal or negligible. Of those companies that stated compliance would require additional expenditures, the cost is estimated to be about $25,000. However, the proposed regulation requires a regulated company to perform the audit of its operation and controls with the assistance of a CPA. The terms of the employment of a CPA is specified in the proposed regulation. Further, a CPA can obtain compensation for additional costs as part of the contract entered into with the regulated company. Accordingly, CPAs, regardless of whether they are located in rural areas or not, should not have to incur uncompensated additional costs to comply with the proposed regulation.

Minimizing Adverse Impact:

The proposed regulation applies PHSPs, HIV SNPs and MLTCPs authorized to do business throughout New York State, including rural areas. It does not impose any adverse impacts unique to rural areas.

Rural Area Participation:

In developing Regulation 118, the DFS conducted extensive outreach to regulated insurers, fraternal benefit societies and managed care organizations authorized to do business throughout New York State, including those located or domiciled in rural areas. Comments were also requested by the Department of Health from all PHSPs, HIV SNPs and MLTCPs affected by this regulation.

Job Impact Statement

The Health Department finds that these amendments will have no adverse impact on jobs and employment opportunities since, for publicly held companies, its requirements largely reflect obligations already imposed by the Sarbanes-Oxley Act of 2002, 15 U.S.C. § 7201 et seq. For MCOs, compliance may require the employment of additional personnel or outside contractors.

No region in New York should experience an adverse impact on jobs and employment opportunities. This regulation should not have a negative impact on self-employment opportunities.