ZPICs, MICs, & RACs: Alphabet Auditors and the Risk to Your Practice

Transcription

1 ZPICs, MICs, & RACs: Alphabet Auditors and the Risk to Your Practice

2 Healthcare in Crisis The United States spends more per person on healthcare than any other nation in the world, Reuters

3 Healthcare in Crisis 16.7% of the country is uninsured 35% is underinsured An estimated 45 million will receive Medicaid in 2012, the highest to date since beneficiaries were first allowed to sign up on July 1st, 1966

4 Healthcare in Crisis Budget of Budget, source: Wikipedia(amounts in Billions of Dollars): Social Security $ % Medicare $ % Medicaid $ %

5 Changing Regulatory Climate The recent expansion in government regulations that address privacy and identity theft make healthcare providers vulnerable to allegations of fraud, abuse and electronic data misuse. Medical Claims Audits present significant risks to revenues & profit margins for healthcare providers. If deadlines are not met, civil monetary penalties and automatic recoupment of funds can occur.

6 Sample of the Alphabet Task Forces Medicare Recovery Audit Contractor (RAC) Medicaid Recovery Audit Contractor (RAC) Medicare Administrative Contractor (MAC) Zone Program Integrity Contractor (ZPIC) Medicaid Integrity Contractor (MIC) Medicaid Fraud Control Unit (MFCU) Health Care Fraud Prevention and Enforcement Action Team (HEAT)

7 Background: Legislation Medicare Modernization Act (MMA) of 2003 Medicare Administrative Contractors (MACs) replace FI s & Carriers, forming 15 jurisdictions, to improve service and make Medicare more efficient Created Medicare Recovery Audit Contractor (RAC) program to identify improper payments on health care services to Medicare beneficiaries 3 year demonstration, collected over $900 Million in FL, CA, NY, MA, SC & AZ Tax Relief and Health Care Act of 2006, Section 302 Congress Mandates Permanent & National RAC Program Gives Centers for Medicare and Medicaid Services (CMS) authority: To award contracts to provide recovery audit services To pay RACs on Contingency Fee Basis Affordable Care Act of 2010 Required states to establish Medicaid RAC Programs Florida s Medicaid State Plan Amendment (SPA) was approved on 3/9/12 Not expected to replace the existing MIC Program

8 RAC Distribution by Region RAC Medicare Recovery States in Region Recovery Region A Diversified Collection MD, DC,DE, NJ, PA, NY, ME Services, Inc. VT, NH, MA CT and RI B CGI MI, MN, WI, Technologies and IL, IN, Solutions, Inc. KY and OH D HealthDataInsights, WA, OR,CA, Inc. AK, HI, NV, ID, MT UT, AZ, WY, ND, SD datainsights.com NE, KS, LA & MO

9 Breakout of our RAC Region C Connolly Healthcare, Inc. Largest Region: 39% of U.S. AL, AR, CO, FL, GA, LA MS, NC, NM, OK, SC, TN, TX, VA, WV, Puerto Rico & the U. S. Virgin Islands RAC

10 Recovery Audit Contractor (RAC) Program Mission: To reduce Medicare improper payments through efficient detection and collection of overpayments, the identification of underpayments, and the implementation of actions that will prevent future improper payments. If you bill fee for service programs, your claims are subject to RAC review RACs review claims only a post payment basis RACs use same Medicare policies, National & Local Coverage Determinations (NCDs, LCDs) & CMS Manuals as Carriers, F.I.s and MACs Targeted classes include, but are not limited to: Hospitals Medical Groups Physicians Durable Medical Equipment DME suppliers Outpatient Rehabilitation Facilities

11 Types of RAC Reviews Automated Review RACs conduct data analysis and identify improper payments without medical records Used when certain that the service is incorrectly coded or not covered; duplicate payments, pricing mistakes or other claims related overpayment Demand Letter sent to provider Discussion Period Complex Review Used in cases of probability of overpayment, and human review of medical records are needed to make that determination. Medical Necessity Reviews A Detailed Review Results Letter sent, including collection, contact & appeal info Provider has 45 days to provide medical records and additional documentation To receive contingency fee, RACS must complete review and provide written determination to provider within 60 days of record receipt

12 Oversight of RACs Attempts to minimize Provider burden, ensure accuracy & maximize transparency: Limit number of medical record requests Accept imaged records (not via ) Look Back Period is 3 years from when the claim was paid, 10/1/07 max RAC Staff must include: A Physician Contractor Medical Director, nurses, therapists and certified coders CMS New Issue Review Board: Issues must be approved regionally by CMS & posted to RAC website prior to widespread RAC review RAC Validation Contractor provides annual accuracy scores for RACs If a RAC loses appeal, they must return their contingency fee

13 Medicare Administrative Contractors (MACs) 15 Contractors responsible for processing Part A & B claims. First Coast Service Options (FSCO) is the MAC for Region 9: FL, P.R. & U.S.V.I. Mission: Provide quality Medicare Administrative Services including: Claims Processing Customer Service, Education & Outreach Activities Provider Enrollment, Audit & Reimbursement MACs and RACs share the same audit responsibility, but once a MAC audits a service, a RAC cannot, and vice versa. Unlike RACs, MACs conduct both prepayment and post payment audits Federal Regulations allow MACs to reopen a claim: Within 1 year from the date of the (re)determination or first level of appeal for any reason Within 4 years for good cause (new & material evidence, or an error was made in the initial decision) At any time if evidence of fraud

14 ZPICs: Zone Program Integrity Contractors and Audits CMS replacing Program Safety Contractors (PSCs) with ZPICs in 7 new zones to fight Medicare fraud and abuse, and to allow for greater recoveries. CMS expects quick response to fraud and administrative actions in high fraud regions. ZPIC s activities to identify, prevent or correct potential fraud may include: Proactively pursuing different sources and techniques for analyzing data Performing investigations Payment denials, recoupment of overpayments, referral to DOJ, OIG etc CMS is tracking: Number of cases resulting from proactive analysis (data mining) & from external sources (complaints) Amounts of overpayments recovered Administrative actions initiated (number of payment suspensions, exclusions, civil monetary penalties, and auto denials)

15 Zone Integrity Program Contractors (ZPIC) Unlike RAC, no contingency fee, instead lucrative contracts Zone 5 alone paid $107,957,737 Unlike RAC, ZPICs are not required to have physician review. ZPICs have access to CMS National Claims History data, data mining for errors from 56 Medicaid programs that have been consolidated into one national Medicaid database

16 ZPICs SafeGuard Services, LLC operational in FL on 2/1/09 Consolidated prior work by Program SafeGuard Contractors (PSCs) and Medicare Drug Integrity Contractors (MEDICs) Close relationships with CMS, HHG OIG, U.S. Attorneys Offices, the FBI and other Medicare contractors Proactive in addressing fraud: Leader in data mining (primary source: CMS National Claims History System) ZPICs can audit all Medicare claims for a particular provider ZPIC Audits are not random, rather occurs upon evidence of a billing problem. A single overpayment may include numerous claims, and the ZPIC may extrapolate dollar amounts based on a sample of the provider s claims.

17 Aggressive Action by ZPICs in FL Since Jan 2010, Onsite audits conducted in South FL at 62 Comprehensive Outpatient Rehabilitation Facilities CORFS resulted in recommendations that 51 be revoked for non compliance (82% of the CORFS in the area) 38 Community Mental Health Centers CMHCS with 30 requested revocations (79% of the CMHCS in that area.) All CMHCS with revocation recommendations were placed on prepay review.

18 Medicaid Integrity Contractors (MICs) Deficit Reduction Act of 2005 created the Medicaid Integrity Program Florida is in Region III/IV, our MIC is Thomas Reuters Unlike Medicaid RACs, MICs are not paid on contingency fees MIC has no record limits MIC Look Back period and Appeals Process are State specific 3 Types of MICs: Review, Audit and Education Review MICs use advanced data mining and analysis techniques to identify provider targets for the Audit MICs to pursue MIC may conduct audits on site, but usually utilize desk audits According to some CMS estimates, MIC expected to recover more than RAC

19 Some Risks Targeted by MICs Provider eligibility Billing for services not provided Reimbursements for unapproved drugs Duplicate billing Providing services not medically necessary Providing services that may compromise the quality of care Excessive payments and upcoding for higher reimbursement of billed procedures Billing for services provided by unlicensed or untrained personnel Payments for unapproved transportation services Medicaid eligibility in multiple states Contingency fee payments to consultants and service providers Excessive Medicaid administrative costs Providing false certifications in the claims process

20 Medicaid RACs vs. Medicaid Integrity Contractors (MICs) Differences Medicaid RACs Medicaid Integrity Contractors (MICs) Compensation Contingency Fee Cost Plus Audited Claim Types RAC auditors may review automated claims data or request medical records from the provider and conduct medical reviews. Typically desk audits. Look back period n/a Five years prior to the start date of the audit. Record Limits n/a No limits Appeals Each state Medicaid agency will determine its own appeal process. The appeal process is based on state guidelines. Contractors Contractor(s) selected individually by states. CMS selects contractors. There are 5 Medicaid Integrity Contractor jurisdictions each covering 2 CMS regions. There are 3 primary types of MICs: 1) Review MICs 2) Audit MICs a) Desk Audits b) Field Audits 3) Education MICs Time frame to respond to audit request Overpayment Recovery n/a Overpayments recovered by the state or contractor. Provider must submit documentation within 30 days. Identified overpayments are reported and sent to state to pursue collection.

21 Florida Medicaid Fraud Control Unit The Florida Medicaid Fraud Control Unit (MFCU) investigates and prosecutes fraud involving providers that intentionally defraud the state s Medicaid program. MFCU s receive both federal (75%) and state (25%) funding. The Unit operates as a Strike Force using a team of investigators and auditors, directed by an attorney Most common: Billing for services never performed Over billing Billing for tests, services, products that are medically unnecessary Examples: Phantom billing, where the medical provider bills for services not rendered Up coding, where a medical provider bills for providing a costly medical service when only a less expensive procedure was performed. The Florida Attorney General s Office Medicaid Fraud Control Unit has recovered more than $490 million since 2007.

22 Medicaid Fraud Control Units MFCU Florida, Year End 2011 Outcomes: Investigations: 704 (14,819 U.S.) Indicted/Charged: 90 (1,408 U.S.) Convictions: 85 (1,230 U.S.) Civil Settlements/ Judgments: 44 (906 U.S.) Recoveries: $67,312,145 ($1.7B U.S.) Resources: Total Medicaid Expenditures: $18,764,932,974 ($423B U.S.) Total MFCU Grant Expenditures: $15,231,803 ($208m U.S.) Staff: 144 (1,833 U.S.) Source:

23 HEAT Health Care Fraud Prevention and Enforcement Action Team (HEAT) Created by DOJ and HHS in May 2009, making the fight against Medicare fraud a Cabinet level priority Build Medicare Fraud Strike Forces in partnership with the DOJ, CMS, and HHS OIG to prevent waste, fraud and abuse in the Medicare and Medicaid programs. The auditing body considered the more aggressive investigator of DME and Home Health

24 How can you prepare? Review improper payments found by RACs and identified in OIG and CERT reports: Demonstration Findings Individual RAC websites for Permanent Findings for OIG Reports for Comprehensive Error Rate Testing (CERT) reports Review CMS Approved Audit Issues: Listed by Type of Review and Provider Web directions: Healthcare, Who We Serve, CMS RAC Program, Approved Issues Know if you are submitting claims with improper payments: Utilize Internal Defense Audits and Self Assessments to check for compliance Keep track of Denied Claims and Identify Patterns of errors Take Corrective Actions to ensure future compliance Painstakingly tie CMS Payment Criteria to Medical Records Documentation Invaluable in the appeals process Prepare to respond to RAC Additional Documentation Request Letters: Provide RAC with specific contact person and address Check on status, did they receive your records? Use Discussion Period to discuss improper payment determination with RAC

25

26 Demand Letter: Now what? Actively manage the claims audit process Assign accountability, enforce deadlines, monitor pending claims Consider automation Use the Discussion Period: Communicate with the RAC, provide information that may cause revisions Use it as a learning opportunity: How did they make their determination? If you agree with RAC findings Pay by check, Apply for extended payment plan, or Allow for recoupment of future payments (occurs after Day 41, and interest accrues) Appeal when necessary. File within 120 days of receipt of Demand Letter. Questions? RAC@cms.hhs.gov Website:

27

28 Florida Enforcement Actions May 3, 2012; Attorney General Bondi Announces the Arrest of Palm Beach County Resident for $28,000 in Medicaid Fraud April 4, 2012; Florida Attorney General Florida Recovers More Than $54 Million From WellCare in Medicaid Fraud Settlement in addition to an $80 million deferred prosecution agreement that the Florida Attorney General's Office and the federal government entered into with WellCare in May February 12, 2012: Attorney General Bondi s Office Arrests Home Health Aide for Defrauding Medicaid out of More Than $35,000 July 11, 2011: Law Judge Upholds HHS OIG's Exclusion of Owner of Orlando, Florida, Diagnostic Imaging Services Company Florida s Medicaid program is the fourth largest in the nation, serving approximately 3.1 million Floridians.

29 Health Information Technology for Economic and Clinical Health Act (HITECH Act) Signed into law on February 17, 2009 as part of the American Recovery and Reinvestment Act of 2009 Sets forth a federal standard for security breach notifications relating to the unauthorized dissemination of protected health information (PHI). Requires covered entities (as defined by HIPAA) to notify individuals if there has been a breach of their unsecured protected health information (UPHI). As a result of this legislation, the Congressional Budget Office estimates that approximately 90 percent of doctors and 70 percent of hospitals will be using comprehensive electronic health records within the next decade.

30 Defense and Fines and Penalties Reimbursement For Billing Errors, HIPAA, EMTALA and STARK proceedings by: Governmental Agencies Qui Tam Plaintiff Contractors Working On Behalf Of The Government Commercial Payors EMTALA (Emergency Medical Treatment and Active Labor Act) STARK (Physician Self Referral) HIPAA (Patient Privacy)

31 Key Features Broad Definition of Insured: Medical Group Employee Independent Contractors (added by endorsement) Allows for Voluntary Self Disclosure Payment for Approved Shadow Audits Full Prior Acts Available No Hammer Clause Free choice of counsel

32 Key Features Stand Alone HIPAA Coverage Available Sub Limit For Medical Board Proceeding Defense Cost Reimbursement Available in all states

33 Limits Up to $10,000,000 / $10,000,000 on the combined product Based on Number of Providers / Size of Organization Typical limit is $1,000,000 Deductibles Range $1,000 $25, % Co Insurance Waived For Use of Approved Panel Counsel

34 Coverage Trigger Written allegation of improper billing, STARK, HIPAA privacy, EMTALA violation

35 Network Security and Privacy for Healthcare Entities

36 Demand for Cyber/Privacy is Increasing Growing Problem Identity Theft was the number one complaint lodged in 2008 The FTC estimates that over 9,000,000 identities were stolen in 2008 Fastest growing white collar crime in America 8,900,000 records were exposed in healthcare related breaches in 2009 Increased frequency of large scale breaches in the news has increased awareness Healthnet (1.7 Mil records) Eisenhower Medical Center (500,000 records) New York City Health and Hospitals (1.7 Mil records)

37 Increased Regulatory Scrutiny High Tech Act National Breach Notice Law for medical records Business Associates now have direct obligation to provide a notice of breach to covered entities Increased penalties for violations of HIPAA A HITECH mandated HIPAA Compliance Audit program is in the works with a pilot coming later this year

38 What does Electronic MD coverage include? Network Security & Privacy Insurance Coverage for third party claims alleging a financial loss as a result of a network security or privacy breach. Includes coverage for both Electronic and Printed information, virus attacks, denial of service, and failure to prevent transmission of malicious code. Also extends coverage for defense costs and fines/penalties for violations of privacy regulations including but not limited to HIPAA, Red Flag Rules, and the new Hi Tech Act. Multimedia Insurance Coverage for both Electronic and Printed media. Includes claims alleging copyright/trademark infringement, libel/slander, advertising, false advertising, plagiarism, and personal injury. Unintentional Breach of Media Contract claims are covered. Privacy Breach Responses Costs, Customer Notification Expenses and Customer Support and Credit Monitoring Expenses Includes all reasonable Legal, Public Relations, IT Forensics, Call Center, Advertising, Identity Theft Education, Credit Monitoring and Postage expenses incurred by the insured for a privacy breach response. Crisis Management included in the definition of claim which provides a broader coverage. Network Asset Protection Coverage for all reasonable and necessary sums required to recover and/or replace data that is compromised, damaged, lost, erased or corrupted. Includes Business Interruption and extra expense coverage for Income Loss as a result of the insured s computer system interruption and/or failure. Coverage triggered by Accidental, Unintentional and Intentional damage/loss/interruptions. Includes coverage for Cyber Terrorism and IT Forensics. Cyber Extortion Will pay extortion expenses and extortion monies as a direct result of a credible cyber extortion threat.

39 What sets Electronic MD apart? Insured has complete choice of vendor for breach response. We have prenegotiated deals with experienced vendors, but the insured can make their own choice. Large breach response limits are available Full prior acts are available, even if the insured is a first time buyer 1 st Party Network Asset Protection is much broader than any other product on the market. The coverage can be triggered by accidental data loss, employee negligence, power surges, etc. Broad coverage for data that is stored with a third party Will cover patient notification even if it isn t legally required

40 Target Classes Solo Physicians Physician Groups Billing Entities Allied Health Facilities Mental Health Facilities Nursing Homes Hospitals