Frequently Asked Questions

Yes, states may use UPL methodologies that are different from their payment methodologies. For example, a state may pay for inpatient hospital services using a Medicaid APR-DRG methodology, but use a cost methodology to compute the Medicare upper payment limit for its UPL demonstration.

FAQ ID:92386

When a hospital acquires another hospital, the state should use all available data to determine the UPL and work with CMS to assure appropriate reporting. When a hospital ceases operation, the state should not annualize data if it does not cover a 12-month period.

FAQ ID:92391

The UPL limits payment to the Medicare rate or cost. Providers paid at cost may receive no more than their reconciled amount. As a result, states cannot attribute the "UPL room" from other providers to pay additional amounts to any provider paid at cost. Due to this payment limitation, states should not include any provider paid at cost in their UPL demonstrations; however, they must account for these providers. Specifically, states must include with their UPL submissions documentation of those providers paid at cost and, therefore, excluded from the calculation of the UPL.

FAQ ID:92396

Section 1903(i)(7) of the Social Security Act specifies a separate UPL for CDL services which limits payment to no more than the Medicare rate on a per test basis. To meet the statutory provision, the UPL for CDL services must be separately demonstrated from the OPH services UPL. States do not have the ability to "borrow room" from the CDL UPL and apply it to the OPH UPL.

FAQ ID:92401

Yes, a state may choose between using all-payer data or Medicare-specific data from the Medicare Hospital Cost Report (CMS Form 2552) to determine the cost-to-charge ratios.

FAQ ID:92406

To date, CMS has not published a list of revenue codes that must be included or excluded from this service category.  Medicaid outpatient hospital services are defined at 42 Code of Federal Regulations (CFR) 440.20 and include “preventive, diagnostic, therapeutic, rehabilitative, or palliative services”.  In the state plan, states further define those services covered as outpatient hospital services.

FAQ ID:92411

Unlike the UPLs for other Medicaid institutional payments, which rely on an aggregate approach by ownership category (private, state owned, non state government owned) to ensure Medicaid payments are consistent with efficiency and economy, the PRTF UPL is calculated for each facility. Specifically, the UPL relies on 42 CFR 447.325 which states that Medicaid agencies “may pay the customary charges of the provider but must not pay more than the prevailing charges in the locality for comparable services under comparable circumstances." The plain language meaning of this requirement is that a state may pay a PRTF no more than it charges for covered Medicaid services provided to Medicaid recipients.

FAQ ID:92416

Yes, the state is required to report the number of Medicaid days. This information is recorded at variable 310 – Medicaid days.

FAQ ID:92421

The UPL data for out of state providers does not need to be included in the UPL demonstration. If the state has provider level data then it may include it in the demonstration within the private ownership category of providers.

FAQ ID:92426

State laws determine what information is required of the health plans. A health plan's disclosure and use of information that is required to be submitted under state law - such as, information from insurer eligibility files sufficient to determine during what period any individual may be, or have been, covered by a health insurer and the nature of the coverage that is or was provided by the health insurer — is consistent with the HIPAA privacy provisions.

Under HIPAA, both the state Medicaid agency and most health insurers are covered entities and must comply with the HIPAA Privacy Rule in 45 CFR Part 160 and Part 164, Subparts A and E. In their capacities as covered entities under HIPAA, the state Medicaid agency and health insurers are restricted from using and disclosing protected health information (PHI), as that term is defined in 45 CFR section 160.103, other than as permitted or required by the HIPAA Privacy Rule. However, as relevant here:

1. A covered entity may use or disclose PHI to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of the law. (45 CFR 164.512(a)(1)) Under this provision, each covered entity must be limited to disclosing or using only the PHI necessary to meet the requirements of the law that compels the use or disclosure. Anything required to be disclosed by a law can be disclosed without violating HIPAA under the "required by law" provisions. Therefore, health insurers may disclose data elements in addition to the four minimum data elements, up to and including submission of an entire insurer eligibility file, to the extent such information is required to be submitted by state law. (45 CFR 164.512(a))
2. Separately, a covered entity may use or disclose PHI, without the consent of an individual, for payment activities, including to facilitate payment. (45 CFR 164.502(a)(1) and 164.506) Under HIPAA, the term payment includes activities undertaken by a health plan to determine or fulfill its responsibility for coverage and provision of benefits under the health plan. These activities include determinations of eligibility or coverage, adjudication or subrogation of health benefits claims, and collection activities. (45 CFR 164.501) To the extent plans are releasing this information to the Medicaid program for payment purposes; this is a separate basis for disclosure under HIPAA.
3. The HIPAA Privacy Rule generally requires covered entities to take reasonable steps to limit the use and disclosure of PHI to the minimum necessary to accomplish the intended purpose. (45 CFR 164.502(b)(1)) However, among other limited exceptions, the minimum necessary requirements do not apply to uses or disclosures that are required by law under 45 CFR 164.512(a).

Supplemental Links:

• This FAQ was released as part of a larger set. View the full set. (PDF, 252.32 KB)

FAQ ID:91216