Compliance Program to Combat Fraud and Abuse

Transcription

1 Compliance Program to Combat Fraud and Abuse Medicare Providers: Mandatory Formal Compliance Program The Patient Protection and Affordable Care Act (PPACA), better known to us as Obama Care, mandated each provider have a formal, written compliance program. Section 6401 of the PPACA, contains language requiring all health care providers regardless of their size to implement formal health care compliance programs as a condition of their enrollment in Medicare, Medicaid and CHIP. Section 6401 imposes a duty on the Secretary of Health and Human Services (HHS) and Office of Inspector General (OIG) to establish the core elements for mandatory compliance program for health care providers and suppliers within each section of the health care industry. Moreover, under Section 6401, HHS/OIG has the discretion to designate the timeline under which providers and suppliers must implement their compliance programs. It has been over one year since PPACA was enacted. HHS/OIG has not yet formally published the Section 6401 core elements and implementing timelines for compliance programs applicable to small group physician practices. But, HHS/OIG has advised that it intends to use the seven elements described in Chapter 8 of the 2010 U.S. Federal Sentencing Guidelines Manual as the basis for establishing the core elements mandated by Section Why You Need a Medicare Compliance Program National attention to the rising costs of federal health care programs (e.g., Medicare and Medicaid) has led to increased scrutiny of billing practices by the federal government. Any practice submitting a claim for payment for providing health care services to a federal plan beneficiary is mandated to be compliant with all laws, regulations, guidelines, advisory opinions, and carrier notices regarding that plan. The Office of Inspector General (OIG) published the Compliance Program Guidance for Individual and Small Group Physician Practices in the Federal Register of October The OIG made it clear that individual and small group practice compliance programs are technically voluntary at this time, and acknowledged that no single compliance program can be written as a one size fits all. However, by implementing a compliance program, the practice demonstrates that a good faith effort has been made to comply with federal and state laws and regulations, and that claims submitted to federal health care programs are true and accurate to the best of their ability. As stated previously, part of the Patient Protection and Affordable Care Act (PPACA), it became mandatory that each provider has a written compliance program established in his or her 2011 ICCOM, LLC Edie Hofmann Page 1

2 Commercial health insurance plans are following the federal government with investigations, audits, and requests for return of payments made if determined unnecessary or improper. Many managed care and other health insurance plans also require, as part of their contracts, that the practice have a compliance program in place. Purpose of Having a Compliance Program A compliance program is intended to assist a provider s office to be in compliance with current federal and state regulations concerning documentation, billing, coding, and claims submission. An effective program will show that the practice is taking reasonable steps to avoid submission of incorrect or inappropriate claims, and that the practice is making a good faith effort to detect and correct any non-compliance issues. An active and effective compliance program should educate, facilitate, and ensure that the office is practicing and billing within federal and state guidelines. Medicare+ Choice (M+C) requires any health care practice that bills for M+C patients to have an active and effective compliance program. Additional Elements to Consider Private/Commercial Insurance Companies and Managed Care Organizations (MCOs) may: Perform claim submission reviews Have compliance guidelines which vary from contract to contract Require an effective compliance program as a participation requirement Use the same software to detect claim irregularities or documentation deficiencies Conduct post-payment audits to ask for recoupment of payments made that have been deemed unnecessary, withhold current claim payments due as recoupment, and sometimes terminate or threaten to terminate the physician s participation with the plan for noncompliance with plan guidelines or other related causes Federal Fraud Enforcement The OIG s Compliance Program Guide references and discusses many civil and criminal statutes related to health care fraud and abuse. These include: The Health Insurance Portability and Accountability Act (HIPAA) The Racketeer Influenced and Corrupt Organizations Act (RICO) o Includes the anti-kickback laws The False Claims Act (FCA) Stark I and 2011 ICCOM, LLC Edie Hofmann Page 2

3 Whistle Blower or Qui Tam suits o The public is encouraged to report possible incidents of health care fraud via the fraud hotline (1-800-HHS-TIPS), whereby they may be rewarded with a percentage of any reimbursements recouped by the government. Key Elements for Developing a Compliance Program A small physician office s compliance program has the same components as any other health care practice s program. The number of physicians, other medical providers, number of employees, type of ancillary services offered (if any), and the type/scope of practice, determines the complexity of the implementation. The smaller the practice, the easier it is to create, implement, and establish a compliance program. Every program should incorporate these seven key elements: 1. Implementation of written practice guidelines and standards of conduct 2. Creation and Appointment of a Compliance Officer 3. Development of education and training programs for all office staff 4. Creation of accessible lines of communication for staff compliance updates and an open door policy for reporting potential violations 5. Performance of internal audits to monitor compliance of the practice 6. Enforcement of compliance standards through well-publicized staff expectations and disciplinary actions 7. Prompt corrective or disciplinary actions Business Records (Includes financial records, patient charts, and other documents generated by the practice) All policies and procedures should be reviewed for compliance, efficiency, and effectiveness, on an annual basis by the doctor and Compliance Officer Ensure that all health care documentation, billing, and claims submitted to all private and federal health insurance plans are accurate and comply with federal, state, and local laws and regulations governing these matters Maintain the confidentiality and integrity of records, including electronic information, with the appropriate storage and security methods No one may tamper with, alter, remove, or destroy the practice s business documents, except in accordance with established criminal and legal guidelines All records required either by federal or state law, or by the Compliance Officer, will be maintained in separate compliance records 2011 ICCOM, LLC Edie Hofmann Page 3

4 Business Relationships and Prohibited Referrals Make every effort to have compliant legal business arrangements with doctors, business associates, other types of providers, third party payers, vendors, and other parties Do not pay for or accept any type of payment for patient referrals Marketing You must be consistent with and within the limits of state laws regarding doctor/patient advertisements. Screening of Employees and Contractors Make every effort to determine, prior to employment, if an employee or contractor has been excluded or sanctioned by any federal health care program or has been convicted of a criminal offense. The OIG List of Excluded Individuals/Entities provides information on individuals excluded from federal health care programs. Government Audits/Inspections All employees will make every effort to cooperate. No employee should conceal, destroy, or alter any practice documents, make misleading statements, or fail to provide accurate information or records relating to a possible violation of law. The practice and its employees have a right to legal counsel during such circumstances. Implementation of Written Practice Guidelines Written standards and procedures are a central component of any compliance program. Written practice guidelines, policies, and procedures should include the practice s clear commitment to be in compliance with all federal insurance regulations and applicable federal laws. Development of effective internal office policies and procedures can result in: A reduced number of claim denials, thus an increase of insurance payments Prevention of improper conduct Reduced billing and coding errors Improved patient record documentation Establishment of an open door policy for employees to report potential problems Clear corrective actions and employee sanctions for 2011 ICCOM, LLC Edie Hofmann Page 4

5 Reduced chances of an insurance plan audit Identification of potential self-referral or kickback arrangements Increased efficiency of the practice Improved quality of patient care Designation of a Compliance Officer A compliance officer to oversee and monitor the practice s compliance program is legally required with many federal programs (e.g., HIPAA). The compliance officer must be a corporate officer or employee with sufficient authority and responsibility to influence other employees behaviors, change practice procedures if violations are found, and discipline employees for violations when necessary. More than one employee can be assigned responsibility for various areas of compliance; however, in a chiropractic office, the doctor, spouse, or office manager can handle all aspects of compliance. Billing Policies and Procedures The OIG has identified the following as billing and coding risk areas: Billing for items or services not rendered or provided as claimed Submitting claims for equipment, medical supplies, or services that are not covered, or not reasonable or medically necessary Double billing, resulting in duplicate payments Knowing misuse of provider identification numbers, resulting in improper billing Unbundling Failure to properly use coding modifiers Clustering Upcoding the level of service provided Local Medical Review Policy (LMRP) LMRP is a policy developed by local Medicare carriers and fiscal intermediaries. It specifies when, and under what circumstances, a service will be considered covered, reasonable, and necessary, and what documentation will support the need for the service. Training and Education Employees are required to attend specific training as part of their employee orientation and on a periodic basis thereafter. Training will include federal and state statutes, regulation 2011 ICCOM, LLC Edie Hofmann Page 5

6 requirements, policies of private payers, and the practice s compliance commitment. This may be accomplished through a variety of means, including videotapes, in-person training, newsletters, postings on bulletin boards, and office meetings. Topics suggested by the OIG for training are: Coding requirements Claim development and submission processes Signing a form for a doctor without the doctor s authorization Proper documentation essentials Government and private payer reimbursement principles (periodic review of EOBs) General prohibitions on paying or receiving remuneration to induce referrals Proper translation of narrative diagnoses Billing for services ordered, performed and reported Provider-approved amendments to regular forms Reporting conduct Legal sanctions for submitting deliberately false or improper bills The OIG Compliance Program does not give specific training time directions. Each practice can determine what is appropriate for its staff. Annual training and updating is recommended for those involved with billing and coding. All attendance logs and any materials distributed will be documented for compliance records. Enforcing Compliance Standards Violations of any of the practice s standard policies and procedures, including the compliance program and employee handbook policies, should be reported immediately. Violations detected, but not reported or corrected, can seriously endanger the mission, reputation, and legal status of any practice. Access to the Compliance Officer An open line of communication between the Compliance Officer and all employees is essential to the success of the practice s compliance efforts, so it is a vital part of the compliance program. Distribute confidentiality statements and non-retaliation policies to all employees to encourage communication and the reporting of incidents of potential misconduct If an employee encounters a situation that does not feel right and is worried it may possibly be improper, have the employee discuss the matter with the compliance officer or call an anonymous 2011 ICCOM, LLC Edie Hofmann Page 6

7 Reporting Compliance Concerns Any practice employee who has concerns regarding any office practice or policy, or who sees what they believe is an act of misconduct by another individual acting on behalf of the practice, should report the concern/violation to his or her immediate supervisor. If the employee is uncomfortable reporting to the immediate supervisor, the report may be taken to a higher level supervisor or to the practice compliance officer. If the supervisor s/compliance officer s response to the report is unsatisfactory, the employee may report the suspected wrongdoing to the next higher authority, and so on. The practice should have various ways for employees to report (anonymously, if desired) suspected policy/procedure violations, as well as to offer suggestions for improvement. An employee should not face retribution for reporting what is reasonably believed to be an act of wrongdoing. Reports are accepted by the Compliance Officer during normal practice hours. An employee whose report contains an admission of personal wrongdoing cannot be guaranteed protection against disciplinary actions. An employee may also be disciplined if the practice determines that he/she intentionally fabricated the report of wrongdoing, in whole or in part. Investigations The practice will make every effort to keep reports confidential if required to do so by the employee. Complete confidentiality cannot be guaranteed if the practice deems it necessary to investigate or take action regarding the report. Depending on the nature of the violation, the compliance officer will conduct an internal investigation. All relevant documents will be reviewed and, if applicable, employee interviews will be conducted. Records of the investigation will contain: Documentation of the alleged violation A description of the investigation process Copies of any interview notes Key documents Results of the investigation (disciplinary actions taken) Documentation of the corrective action implementation If an investigation determines that a material violation of applicable law has occurred, the result will be the implementation of a corrective action plan, a report to the government, and/or the submission of any overpayments, if 2011 ICCOM, LLC Edie Hofmann Page 7

8 Corrective Actions If the Compliance Officer or any member of the compliance team finds credible evidence of misconduct/wrongdoing from any source, and after an inquiry has reason to believe the misconduct may violate criminal, civil, or administrative law (consult a health care attorney immediately), the Compliance Officer may report the matter to the appropriate government authority as directed by the attorney. A report must be made within a reasonable period per the regulatory guidelines. Selfdisclosure should not be done without advice of legal counsel. Take appropriate corrective action, including proper disciplinary action, as well as prompt identification and restitution of any overpayment to the affected payer. Failure to repay overpayments in a reasonable period of time is interpreted as an intentional attempt to conceal the overpayment from the government, and establishes a basis for a criminal violation with respect to the practice and any individuals involved. Discipline Policy and Actions Significant sanctions will be imposed on an employee for intentional or reckless noncompliance. Consequences of noncompliance must be consistently applied and enforced. All employees, including providers, are subject to the same disciplinary actions for commission of similar offenses. Violations may result in the following disciplinary actions: 1. Verbal warning 2. Written warning 3. Written reprimand 4. Probation 5. Demotion 6. Temporary suspension 7. Termination 8. Restitute of damages 9. Possible referral for criminal investigation Auditing and Monitoring The OIG has identified three areas where practices may be vulnerable and at potential risk of noncompliance: 1. Documenting patient records, including identification of reasonable and necessary 2011 ICCOM, LLC Edie Hofmann Page 8

9 2. Coding and billing 3. Potential for improper self-referral, kickbacks, or inducements by providers, third party vendors, consultants, or patients The practice should conduct an initial baseline audit of patient record documentation and the coding and billing process to identify areas for improvement. Conduct subsequent audits annually, or more often if indicated. The baseline audit should reveal: The practice s top ten denials for services provided, and why Any data entry errors Confirmation that all notes and orders are written and signed by the provider That all documentation reflects reasonable and necessary medical services Patient Chart Review The CMS (Centers for Medicare and Medicaid Services) and OIG have identified the leading cause of improper payments as: Poor documentation in general Documentation that does not support the submitted billing codes Indeterminate provider of services Conduct a patient chart review annually, or more frequently if necessary. Select records that include patients enrolled in any federal health program. Review at least five records from each federal payer that the practice received reimbursement from, or five to ten records per doctor. Upon review of the chart, confirm the following: Correct patient identification information Complete and legible notes Notation of all treatment and procedures Patient education and instructions Incident-to services and ancillary services Medical supplies used or recommended Past and present diagnoses and test/x-ray results are easily accessible Complete information on forms or flow sheets (e.g., examination forms) Appropriate health risk factors identified CPT and ICD-9-CM codes reported on health insurance claim forms are supported by documentation in the patient record Any necessary non-covered service and patient acceptance forms (e.g., Medicare ABNs) are 2011 ICCOM, LLC Edie Hofmann Page 9

10 Be alert for those common documentation pitfalls: Incomplete notes of each encounter. (forms, or flow sheets) Illegible notes Missing or illegible signatures Alterations or changes made to the original record without documentation Use of non-standard abbreviations (without key) Biased or non-professional remarks Disorganized or misfiled patient records Repetitive, non-individualized notes especially with EMR (electronic medical records.) Misuse of rubber-stamped or electronic signatures Billing and Coding Review Regular audits of the coding and billing process should be performed on an annual basis to ensure compliance. At a minimum, these audits should include an in-depth analysis of: Laws governing kickback arrangements The provider self-referral prohibition CPT/E&M coding and billing ICD-9 coding Claim development and submission Reimbursement Marketing Reporting Record Keeping Recovery Audit Contractors (RAC) The RAC Program s purpose is to reduce improper Medicare payments and implement actions to prevent future improper payments. Section 306 of the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA) requires CMS to complete a three-year demonstration program to determine whether RAC use is a cost-effective means of identifying and correcting Medicare overpayments and underpayments in the Medicare Fee-For-Service Program. In March 2005, this demonstration program started in California, Florida, and New York the largest states in terms of Medicare utilization. In 2007, the demonstration program was expanded to Massachusetts, South Carolina, and 2011 ICCOM, LLC Edie Hofmann Page 10

11 In March 2008, the RAC demonstration program ended with more than $1.03 billion recovered from improper payments. Approximately 96 percent of the improper payments were overpayments collected from providers, and the remaining four percent were underpayments paid to providers. The majority of the overpayments (85 percent) were collected from inpatient hospital providers; 6 percent were collected from Inpatient Rehabilitation Facilities (IRFs); and 4 percent were collected from outpatient hospital providers. As of 2010, the Secretary of HHS (US Department of Health and Human Services) expanded the RAC program to all 50 states. Notes: Audits are performed my Medicare RAC contractors to reduce Medicare improper payments by detecting and correcting overpayments and underpayments, and the implementation of actions that will prevent future improper payments RACs apply statues, regulations, CMS national coverage, payment and billing policies, as well as LCDs (Local Coverage Determinations) that have been approved by Medicare claim processing contracts RACs will not review a claim that has been previously reviewed by another entity If a denial or adjustment is indicated by the review, providers will receive overpayment/underpayment notification letters Providers can appeal denials (including no-documentation denials) by following the normal appeal processes and submitting documentation supporting their claim Review for Potential Improper Inducements, Kickbacks, or Self-Referrals Remuneration for services, medical supplies, or other financial incentives may impact medical decision making, cause over-utilization of services or supplies, and result in increased costs to federal health insurance programs. The OIG recommends this aspect of the practice be included in the compliance audit. The identified potential risk areas for review are: Financial arrangements with outside entities Joint ventures with entities supplying goods or services to the physician or patients Consulting contracts or medical directorships Office and equipment leases or rentals with which the physician refers Offering or accepting any gift with more than a nominal value ($10 per incident, $50.00 per year aggregate) from those who are in a position to benefit from the physician s referrals Patient Referrals Take into account the patient s best interest when choosing providers for referrals and for services utilized by reference laboratories: Recommend the most appropriate provider for the patient s problem Do not make any prohibited 2011 ICCOM, LLC Edie Hofmann Page 11

12 Comply with any disclosures of financial interests if necessary Do not participate in referrals or labs that would violate anti-kickback laws When a referral is necessary, recommend a provider while giving consideration to both the patient s health insurance coverage and the patient s choice 2011 ICCOM, LLC Edie Hofmann Page 12