UPMC ISD issues Qualified Health Plans (QHPs) through Pennsylvania’s state-based exchange, known as Pennie, which customers can access through the UPMC Health Plan Marketplace/Exchange website or directly at Pennie.com. The Centers for Medicare & Medicaid Services (CMS) requires QHP issuers to maintain oversight of third parties that perform administrative functions or provide health care services on behalf of the issuer. These third parties, referred to as delegated and downstream entities (DDEs), must comply with all applicable federal and state requirements related to QHP operations.

What Are Delegated and Downstream Entities?

Delegated entity: Any party, including an agent or broker, that enters into an agreement with a QHP issuer to provide administrative services or health care services to qualified individuals, qualified employers, or qualified employees and their dependents (45 CFR § 156.20).

Downstream entity: Any party, including an agent or broker, that enters into an agreement with a delegated entity or with another downstream entity for purposes of providing administrative or health care services related to the agreement between the delegated entity and the QHP issuer. The term ‘‘downstream entity’’ is intended to reach the entity that directly provides administrative services or health care services to qualified individuals, qualified employers, or qualified employees and their dependents (45 CFR § 156.20).

Examples of functions performed by DDEs include (but are not limited to): plan design, marketing, enrollment, customer service, claims administration, network development, benefit management, quality improvement.

As a DDE, you must comply with the compliance program requirements below. Additionally, you must attest to your compliance on an annual basis.

Annual Compliance Attestation

An authorized representative from your organization is required to complete the Third-Party Compliance Program Attestation on behalf of your organization on an annual basis. In doing so, you attest to your organization’s compliance with the Third-Party Compliance Program requirements. For the purposes of this attestation, an authorized representative is an individual who has responsibility, directly or indirectly, for all employees, contracted personnel, and delegated vendors who provide administrative and/or health care services for UPMC ISD; this would include a Chief Compliance Officer, Chief Medical Officer, Chief Operating Officer, or other executive position.

Third-Party Compliance Program Attestation Form

UPMC ISD will send a notification to each DDE to communicate the deadline for completion of the annual Attestation. All DDEs must complete the Attestations within the designated time frame.

Code of Conduct/Compliance Policies/Conflict of Interest Policy

A Code of Conduct or Standards of Conduct state the overarching principles and values by which an organization operates and defines the underlying framework for an organization’s compliance policies and procedures. The Code of Conduct and compliance policies describe your organization’s expectations that all employees conduct themselves in an ethical manner; that issues of noncompliance and potential fraud, waste, and abuse (FWA) are reported through appropriate mechanisms, and that reported issues will be addressed and corrected.

The Code of Conduct communicates to employees of your organization that compliance is everyone’s responsibility, from the top to the bottom of the organization. As a DDE who contracts with UPMC ISD to provide administrative or health care services for our Marketplace business, you are required to distribute the Code of Conduct and any additional compliance policies and procedures to all employees (and those of your downstream entities) who provide services for UPMC Health Plan Marketplace/Exchange within 90 days of hire or contracting, and annually thereafter.

Code of Conduct (PDF)

In addition to the Code of Conduct and compliance policies, you must ensure that all of your employees (and those of your downstream entities) who provide services for UPMC Health Plan Marketplace/Exchange have reviewed either the UPMC Conflict of Interest policy or your own equivalent version. Any potential conflicts of interest as they relate to administering or delivering Marketplace/Exchange benefits on behalf of our organization must be disclosed to senior management within your organization and to UPMC ISD. If necessary, your organization must promptly address all conflicts of interest by any of the following:

Determine that the potential conflict does not impact administering or delivering Marketplace/Exchange benefits
Eliminate any potential conflicts
Remove anyone who has a conflict of interest from administering or delivering Marketplace/Exchange benefits

General Compliance & Fraud, Waste, and Abuse Training

What is fraud, waste, and abuse (FWA)?

Fraud is an intentional misrepresentation that is made to obtain something of value.

Waste is an overutilization of services that, directly or indirectly, results in unnecessary costs.

Abuse is an affirmative action that is inconsistent with sound medical, business or fiscal practices, and that is not medically necessary.

As a DDE who provides administrative or health care services to Marketplace/Exchange beneficiaries on behalf of UPMC Health Plan Marketplace/Exchange, you must provide any new employee, temporary employee, volunteer, consultant, governing body member, or delegated vendors FWA training and general compliance training within 90 days of initial hiring, and annually thereafter.

To reduce the potential burden on our DDEs, UPMC ISD has developed and made available standardized General Compliance and FWA training and education modules. Those trainings can be found at the below links. You can use provided FWA and General Compliance trainings that were created by UPMC ISD, or a similar FWA and General Compliance training program.

FWA training includes, but is not limited to the following:

Relevant laws and regulations (e.g., HIPAA/HITECH, etc.);
Obligations of DDEs to have appropriate policies and procedures to address FWA;
Processes for employees of your organization or those of any of your downstream entities to report suspected FWA;
Protections for employees of your organization or those of any of your downstream entities who report suspected FWA; and
Types of FWA that can occur in the setting of your organization or those of any of your downstream entities.

*UPMC ISD requires that all training documentation be retained for a minimum of 10 years.

Exclusion Screenings

As a DDE that provides administrative or health care services to Marketplace/Exchange beneficiaries, UPMC ISD requires you to review the DHHS Office of Inspector General (OIG) List of Excluded Individuals and Entities (LEIE) and the General Services Administration (GSA) System for Award Management (SAM). These checks must be performed prior to the hiring or contracting of any new employee, temporary employee, volunteer, consultant, governing body member, or delegated vendors and monthly thereafter, to ensure that none of these persons or entities are excluded or become excluded from participation in federal programs.

The websites utilized to perform the required screening are:

Reporting FWA and Compliance Concerns

We at UPMC ISD take compliance concerns and suspected or actual violations related to the Marketplace/Exchange very seriously. As a DDE that contracts with UPMC ISD, you must ensure that all of your employees (and those of any of your downstream entities) are informed of how to report compliance concerns and suspected misconduct. UPMC ISD will perform an internal investigation of each concern after your organization reports any incidents.

UPMC Health Plan Compliance Hotline: 1-877-983-8442

Fraud, Waste, and Abuse:
Fraud Hotline: 1-866-372-8301
Special Investigations Unit: specialinvestigationsunit@upmc.edu

Third-party Compliance:
Thirdpartycompliance@upmc.edu

Marketplace/Exchange Compliance:
Exchangecompliance@upmc.edu

Ongoing Monitoring and Auditing

As a DDE that contracts with UPMC ISD, you must ensure that your organization and your downstream entities are in compliance with state and federal regulations. UPMC ISD reserves the right to request that you provide evidence of your compliance with the above requirements or other requirements within the scope of our delegation to you. If you fail to comply with the Third-party Compliance Program requirements, UPMC ISD will request remedial action. The remedial action will depend upon the severity of your noncompliance and may include requiring a corrective action plan or terminating your contract.

About downstream and delegated entities

They are vendors that support Marketplace/Exchange lines of business.
The function of the vendor is a requirement of UPMC Health Plan's Marketplace/Exchange contract or applicable guidance (law or regulation).
The vendor provides administrative services and/or health care services to qualified individuals, qualified employers, or qualified employees and their dependents.
Vendor deliverables are management/service-related (e.g., processing functions), not product-related (e.g., software).

Section 1557 Final Rule

On April 26, 2024, the Department of Health and Human Services’ (HHS) Office of Civil Rights (OCR) released a Final Rule on the Affordable Care Act’s (ACA) Section 1557 Non-discrimination in Health Programs and Activities. The rule was published in the Federal Register on May 6, 2024. The Section 1557 Final Rule (Final Rule) prohibits discrimination in certain health programs and activities on the basis of race, color, national origin, sex, age, or disability.

The final rule applies to health programs or activities that receive HHS funding, health programs or activities administered by HHS (such as the Medicare Part D program), and the health insurance Marketplace (and all plans offered by issuers that participate in those Marketplaces that receive Federal financial assistance). Those covered by the rule may include hospitals, health clinics, health insurance issuers, state Medicaid agencies, community health centers, physicians’ practices, and home health care agencies.

Health programs or activities may comprise more than one recipient of Federal financial assistance. For example, a primary recipient (or “direct” recipient) is an entity that accepts Federal financial assistance from a Federal agency. The direct recipient may then distribute the Federal financial assistance to a subrecipient (or “indirect” recipient) to carry out all or part of the health program or activity. Primary recipients and all subrecipients are covered and must comply with section 1557. Under general civil rights principles, both the primary recipient and subrecipient are responsible for complying with applicable civil rights laws. Therefore, if an entity receives Federal financial assistance—directly as a primary recipient or indirectly as a subrecipient—it would be a covered entity and responsible for complying with Section 1557 and the part. As a recipient of Federal financial assistance, UPMC is a primary “direct” recipient and by executing a contract with UPMC, all delegated entities are subrecipients or “indirect” recipients and are to be considered a covered entities that are responsible for complying with Section 1557.

Covered entities include FDRs; marketplace/exchange DDEs; and Subcontractors. As a covered entity under the Final Rule, your organization is required to maintain written policies and procedures that include: (1) a non-discrimination policy, (2) grievance procedures, (3) language access procedures, (4) effective communication procedures, and (5) reasonable modification procedures.

All covered entities are required to train relevant employees in their health programs and activities on their Section 1557 policies and procedures. Additionally, all covered entities are required to provide a notice of non-discrimination to participants, beneficiaries, enrollees, and applicants of their health programs and activities, and to members of the public. Under the Final Rule, all covered entities are required to notify the public of the availability of language assistance services and auxiliary aids and services for their health programs and activities. Covered entities must take reasonable steps to provide meaningful access to each limited English proficiency (LEP) individual to be served or likely be directly affected by its health programs and activities. The Final Rule also requires all covered entities to take appropriate steps to ensure that communications with individuals with disabilities and companions with disabilities are as effective as communications with individuals without disabilities in its health programs and activities. Covered entities are required to make reasonable modifications to policies, practices, or procedures when such modifications are necessary to avoid discrimination on the basis of disability, unless the covered entity can demonstrate that making the modifications would fundamentally alter the nature of the health program or activity.

Code of Federal Regulations (89 FR 37522) – Nondiscrimination in Health Programs and Activities Final Rule (Full Text)

Third-Party Newsletter Article on the Section 1557 Final Rule (Q3-Issue 25, 2024)

Who We Are

Community Engagement

Signature Initiatives

News & Media

Quality & Safety

Vendor Information

Third-Party Compliance Oversight

Regulatory Compliance Program Requirements for Marketplace/Exchange Delegated and Downstream Entities