The proposed regulation is closely patterned upon 11 NYCRR 89 (Regulation 118) adopted by the Department of Financial Services and the National Association of Insurance Commissioners model audit rule ("NAIC model") that reflects a consensus of the insurance regulators of all states and territories of the United States as to scope, detail, needs and benefits. The NAIC model imposes additional rules patterned on the Sarbanes-Oxley Act of 2002, 15 U.S.C. § 7201 et seq. ("SOX"), and is similar to Regulation 118 and the proposed amendments to Part 98.

The proposal adds provisions to Part 98 regarding the following:

• Designation of CPA.

• Qualifications of CPA.

• Consolidated or combined audits.

• Scope of audit and report of CPA.

• Notification of adverse financial condition.

• Communication of internal control related matters noted in an audit.

• CPA’s letter of qualifications.

• Availability and maintenance of CPA work papers.

• Requirements for audit committees.

• Conduct of MCO in connection with the preparation of required reports and documents.

• Management’s report of internal control over financial reporting.

• Effective date and special rules.

Statutory Authority:

Sections 4403(2), 4403-f(7) of the Public Health Law. These sections establish the Commissioner’s authority to promulgate regulations governing the operations of managed care organizations (MCOs), including the preparation and filing of audited financial statements.

Public Health Law section 4403(2) states the Commissioner may adopt and amend rules and regulations pursuant to the state administrative procedures act to effectuate the purposes and provisions of Article 44.

Public Health Law section 4403-f(7) states the Commissioner shall promulgate regulations to implement this section and to ensure the quality, appropriateness and cost-effectiveness of the services provided by managed long term care plans.

Legislative Objectives:

10 NYCRR 98 was extensively amended in 2005 to further implement the provisions of Article 44 of the Public Health Law. The proposed amendment to section 98-1.16(c) and the promulgation of the new section 98-3 adds new provisions consistent with the provisions of the Sarbanes-Oxley Act of 2002, 15 U.S.C. § 7201 et seq. ("SOX") and 11 NYCRR 89.

Needs and Benefits:

SOX imposes a comprehensive regime of audits and internal management controls and reports designed to ensure greater transparency and accountability.

The proposed regulation is closely patterned upon 11 NYCRR 89 (Regulation 118) adopted by the Department of Financial Services (DFS), formerly the NYS Department of Insurance, and the National Association of Insurance Commissioners model regulation ("NAIC model") that reflects a consensus of the insurance regulators of all states and territories of the United States as to scope, detail, needs and benefits. The NAIC model imposes additional rules patterned on SOX and is similar to Regulation 118 and the proposed amendments to Part 98. For example, the NAIC model, Regulation 118 and the proposed amendments to Part 98 all require the regulated insurer to forbid its certified independent public accountant (CPA) from entering into an agreement of indemnity or release from liability.

The proposed amendments will apply to managed care organizations (MCOs), such as PHSPs, HIV SNPs and MLTCPs, that were not included under Regulation 118. This will ensure that all MCOs authorized to operate under Article 44 must adhere to the same financial reporting requirements and standards.

The proposed amendments, once adopted, will ensure that regulated companies engage in best practices related to auditor independence, corporate governance and internal controls over financial reporting.

Costs:

This regulation imposes no compliance costs on state or local governments. There will be no additional costs incurred by the Health Department. Costs to be incurred by the parties affected differ depending upon the size of the company and whether that company is publicly held and thus already required to comply with SOX. Companies regulated by SOX will incur few additional costs. Compliance cost estimates received by DFS from a cross-section of affected companies that are not subject to SOX are most often estimated to be minimal or negligible. Of those companies that stated compliance would require additional expenditures, the cost is estimated to be about $25,000.

Local Government Mandates:

The regulation imposes no new programs, services, duties or responsibilities on any county, city, town, village, school district, fire district or other special district.

Paperwork:

Paperwork associated with filings to the commissioner should be minimal. The paperwork associated with the audit and controls regime required by the proposed regulation should also be minimal.

Duplication:

The proposal does not duplicate any existing federal, state, or local regulations.

Alternatives:

In developing Regulation 118, the DFS obtained industry input and hued to the model regulation developed by the National Association of Insurance Commissioners (the "NAIC model") to implement SOX to the extent possible. However, the model has been modified as necessary to comply with New York statutes and regulations. The proposed regulation also restricts its application only to those entities over which the Health Department has jurisdiction unlike the NAIC model, which also contains rules that apply to CPAs.

Several comments received by DFS noted the compliance difficulties faced by foreign companies and United States branches of alien insurers, specifically with respect to the roles to be performed by persons not residing in the United States and for the reporting requirements to be imposed upon an integrated enterprise containing insurers in New York as well as entities with no nexus to New York. In response, the DFS modified Regulation 118, as reflected in the proposed amendments to part 98, to provide detailed rules as to whether members of management may attest to filings, and to establish limited exceptions available only to these entities, in addition to the provision that permits a waiver of any provision of the regulation upon evidence of financial or organizational hardship.

Another commenter objected to restrictions on using the same CPA for SOX audit work and tax return preparation for more than a five-year period for small companies. The exemption from any provision of the proposed regulation available upon proof of financial or organization hardship now addresses this comment.

Several comments noted that a company may be required to file both SOX reports and the reports required by the NAIC model as adopted by the various states. Companies want to avoid making duplicative filings to those required by the state of domicile. The proposed regulation contemplates accepting the domiciliary state filings as New York filings to the extent that they are substantially similar to those required by the proposed regulation.

Several comments noted differences between the NAIC model and the proposed regulation on filing deadlines, exceptions and the rules governing confidentiality of work papers. Different dates or deadlines are due to restrictions in New York law that require modification to the NAIC model. Certain automatic exclusions from the NAIC model could not be included in the proposed regulation to the extent that they conflict with New York law. Finally, the confidentiality of commercial information, including work papers, obtained by state and local government is already subject in New York to a comprehensive regime of rules, exceptions and requirements, and thus did not need to be addressed in the proposed regulation.

Federal Standards:

The federal rules under SOX are extensive. The provisions in the proposed regulation are similar to the comparable federal provisions. The regulation does not conflict with any federal rules.

Compliance Schedule:

The regulation would apply beginning with the reporting period ending December 31, 2015. The initial audited financial statements completed under this regulation would be the 2015 annual statements due April 1, 2016.

Changes made to the last published rule do not necessitate revision to the previously published Regulatory Flexibility Analysis, Rural Area Flexibility Analysis and Job Impact Statement.

The public comment period for this regulation ended on December 8, 2014. The Department received 4 comments.

One comment was submitted by Hinman Straub, P.C. on behalf of a prepaid health services plan (PHSP) in Western New York that offers Medicaid Managed Care (MMC), Family Health Plus (FHP) and CHP programs. The comment was a request to revise the regulation to allow PHSPs to file financial reports using either statutory accounting principles (SAP) or generally accepted accounting principles (GAAP).

The Model Audit Rule that was submitted for comment provided for PHSPs, MLTCs and HIV SNPs submitting their audited financial statements on a SAP basis. The proposed rule would clarify that PHSPs, MLTCs, and HIV SNPs may submit the audited financial statement in accordance with GAAP, as long as a reconciliation to SAP is also included, in order to align the Model Audit Rule with DFS Regulation 118.

Another comment was from the Health Plan Association (HPA), and it stated that PHSPs, HIV SNPs and MLTCs would need an additional year to come into compliance with the Proposed Regulation. In addition, the comment indicated that the Proposed Regulation did not apply the same standards to financial reports as DFS Regulation 118, therefore the financial reports HMOs file with DFS might not comply with this proposed regulation. The comment requested that Section 98-3.4 of the Proposed Regulation be revised to allow MCOs to file audited financial statements in accordance with GAAP, in conformance with Insurance Regulation 118. Also, the comment requested that Section 98-3.15 of the Proposed Regulation be amended to clarify that the $500 million premium threshold be based on December 31st of the prior year, for purposes of the requirement of preparing a report of the MCO’s internal control over financial reporting.

The Proposed Regulation had been discussed for several years with the MCOs and the health plan associations, which has provided adequate time for implementation. As previously indicated, the proposed rule is being clarified to allow PHSPs, MLTCs, and HIV SNPs to submit the audited financial statement in accordance with GAAP, with a reconciliation to SAP, in order to align with DFS Regulation 118. The intent of the internal control over financial reporting requirement is based on MCO premiums for prior year ending December 31st. For example, at year end 12/31/2015, the MCO will be required to file the internal control over financial report if total premium reached $500 million for 2014 as required in the regulation.

Another comment, from Greenberg Traurig, expressed concern that the reporting requirements for HMOs under the Proposed Model Audit Rule Regulation (Proposed 10 NYCRR 98-3) and under DFS Regulation 118 are not the same.

As indicated above, the proposed rule is being clarified to allow PHSPs, MLTCs, and HIV SNPs to submit the audited financial statement in accordance with GAAP, with a reconciliation to SAP, to align with DFS Regulation 118.

A comment from the State Assembly (Richard Gottfried & Kenneth Zebrowski) pointed out that the Proposed Regulation would result in a financial and organizational hardship for PHSPs, HIV SNPs and MLTCs. In addition, the comment requested that the Proposed Regulation be amended to include clarification as provided in a recent DFS Amendment, which requires that whenever a CPA is dismissed or resigns, the MCO must submit a letter within 15 business days “stating whether there were any disagreements at the decision-making level with the former CPA within the previous 2 years.”

While the Department understands that there will be a cost to plans in implementing the Proposed Regulation, the Department wants to have consistent financial reporting requirements for all plans. The regulation has been clarified in accordance with DFS Regulation 118 which clarifies when the MCO needs to submit a letter to DOH regarding when a CPA is dismissed or resigns.