Fraud and Abuse and Program Integrity Provisions. in the Health Care Reform Law

Transcription

1 Fraud and Abuse and Program Integrity Provisions in the Health Care Reform Law Background The Patient Protection and Affordable Care Act of 2010, as amended by the Health Care and Education Reconciliation Act of 2010 (collectively, the PPACA ), contains numerous provisions related to health care fraud and abuse and program integrity. Most of the changes went into effect on March 23, 2010, the date on which the PPACA was signed into law. The fraud and abuse provisions will have a significant impact on the compliance programs of health care providers. Further regulations and guidance will be forthcoming on many provisions. Below is a summary of key provisions affecting aging services providers. Please consult your legal counsel for additional guidance on your specific compliance plan and how the new provisions in the PPACA will affect your organization. Overpayments Key Provisions and Their Implications for AAHSA Members One of the biggest changes in the PPACA as it relates to healthcare providers is the new provision regarding overpayments (Section 6402; 42 U.S.C. 1301, et. seq.). Under the PPACA, any provider, supplier, Medicaid managed care organization, Medicare Advantage Plan or Medicare Part D Sponsor must report and return any overpayment. The PPACA also establishes a deadline for reporting and returning overpayments. That deadline is the later of the date which is 60 days after the date on which the overpayment was identified or the date a corresponding cost report is due. The payment must be returned to the applicable government contractor, intermediary, or carrier. The PPACA also provides that failure to return an overpayment within the timeframe is considered an obligation under the False Claims Act ( FCA ) and could lead to liability for additional penalties if a FCA violation is found to exist. The PPACA does not define the term identified, and there are numerous duplicative and confusing statutory definitions in the PPACA and the FCA that will need to be addressed through regulations or guidance. Nonetheless, it is the government s position that providers have a clear obligation to return any known overpayment, and any failure to report or return

2 the overpayment, or any delay in making the required report and refund, could lead to FCA liability. In addition to the PPACA s provision addressing the duty to report and refund overpayments, the PPACA (Section 6402; 42 U.S.C. 1320a-7a(a)) contains other provisions strengthening enforcement authority against providers and suppliers that fail to make refunds when they have been overpaid. Section 6402 also authorizes the Office of Inspector General ( OIG ) of the Department of Health and Human Services ( HHS ) to impose civil monetary penalties ( CMPs ) when a provider, supplier or plan that is required to report and return overpayments, know[s] of the overpayment and does not report and return the overpayment. (See below). Implications for providers Providers should ensure compliance with this new requirement by implementing an audit and refund process to avoid the retention of overpayments. The procedures should contain time frames for investigating, analyzing and quantifying overpayments so that providers do not miss the 60 day deadline. Until guidance is available on when an overpayment is considered to be identified, providers should make sure that they proceed reasonably and promptly in resolving any potential overpayments to avoid any possibility of FCA liability. Provider Screening and Enrollment Requirements under Medicare/Medicaid Under Section 6401 of the PPACA, there are many new initiatives for providers as part of the Medicare and Medicaid programs. The new mandates include provider screening, enhanced disclosures on applications, greater oversight of new providers and the establishment of mandatory compliance programs with core elements determined by HHS. Some of the key initiatives outlined in Section 6401 of the PPACA include: Compliance Programs - The Secretary of HHS (in consultation with the OIG) is directed to establish core elements of a compliance plan for providers to implement as a condition of enrollment in either Medicare or Medicaid. The implementation date will be determined by the Secretary of HHS. Providers should read the OIG 2000 Nursing Facility Compliance Program Guidance and the OIG 2008 Supplemental Compliance Program Guidance for Nursing Facilities for background as the new regulations and requirements may be based on the guidance contained in these documents. Enhanced Screening - This section directs enhanced screening, such as licensure checks and/or criminal background checks of providers, for enrollment and re-

3 enrollment in Medicare and Medicaid. The Secretary of HHS will issue regulations with respect to the enhanced screening procedures within 180 days of the PPACA enactment. Providers may be charged a fee for screening. For current providers, screening will be required effective March 2012 and for new providers in March Enhanced Oversight of New Providers - This section mandates the establishment of procedures to provide for a period of enhanced oversight (greater than 30 days and up to 1 year) for new providers on such issues as prepayment review and payment caps. Provider Disclosures - Effective March 2011, a provider of medical or other items or services, or a supplier who submits an application for enrollment or revalidation of enrollment must disclose any current or former affiliation (directly or indirectly) with another provider or supplier that has (1) uncollected debt; (2) been or is subject to a payment suspension under a Federal health care program; (3) been excluded from participation in a Federal health care program; or (4) had its billing privileges denied or revoked. HHS can also deny the enrollment if the affiliation poses an undue risk of fraud, abuse or waste. Adjustment of Payments for Past-Due Obligations - HHS may adjust payments to a provider to satisfy any past-due obligation of the provider (must have the same tax identification number). Disclosure of Terminated Providers to States - CMS shall establish a process for disclosing to each state agency responsible for administering a State Medicaid Plan the name, national provider identifier and other identifying information of a provider that is terminated from participation within 30 days of the termination. The provider disclosure requirements force providers to maintain a listing of all former affiliations with other providers or suppliers in order to determine which of these affiliates has any of the four disclosure obligations. The level of detail required to be disclosed is likely something that the provider doesn t currently maintain within its files. An affiliation is not defined nor is the look-back period for how far back a provider should look to identify these former affiliations. Furthermore, the language directs the provider to obtain information about (1) uncollected debt (which also isn t defined) that the affiliate has; (2) whether or not the affiliate has been or is currently subject to a payment suspension under a Federal health care

4 program; (3) whether or not the affiliate has been excluded from a Federal health care program (presumably even if this exclusion occurred since the provider s termination of relationship with the affiliate); or (4) whether or not the affiliate has had its billing privileges denied or revoked. The list of other providers and suppliers that the organization has had a past relationship with could be very broad and extensive. The provision relating to adjustment of payments for past due obligations won t impact all providers; however, some organizations have multiple facilities with distinct provider numbers that are all a part of the same legal structure and tax identification number. Payments owed by one of these facilities will now become an obligation of all of the other facilities within the same tax identification number until such obligation is satisfied. Amendments to Anti-Kickback Statute Section 6402(f) of the PPACA amends the federal anti-kickback statute ( AKS ) (42 U.S.C b), to provide that (1) claims resulting from violations of the anti-kickback statute also constitute false or fraudulent claims for purposes of the FCA (31 U.S.C et seq.); and (2) a person need not have actual knowledge of the AKS or specific intent to commit a violation of it. The latter amendment addresses a 9 th Circuit Court of Appeals decision in 1995, in which the court held that knowledge and specific intent on the part of the defendant were required to be proved by the government in AKS cases. Each amendment increases the exposure of providers to liability under the AKS, which carries criminal sanctions, and the FCA, which carries significant civil penalties. Anti-Kickback Civil Monetary Penalty Remuneration Definition Section 6402(d)(2)(B) provides, with respect to the beneficiary inducement provisions of the AKS, that remuneration does not include, and thus CMPs will not be assessed with respect to: Any remuneration which promotes access to care and poses a low risk of harm to patients and Federal health care programs. An offer or transfer of items or services for free or less than fair market value ( FMV ) if:

5 o The items of services consist of coupons, rebates, or other rewards from a retailer; o The items or services are offered or transferred on equal terms available to the general public, regardless of health insurance status; and o The offer or transfer of the items or services is not tied to the provision of other items or services, which are reimbursed, in whole or in part, by Medicare or a state health care program. An offer or transfer of items or services for free or less than FMV if: o The items or services are not offered as part of any advertisement or solicitation; o The items or services are not tied to the provision of other services reimbursed under Medicare or a state health care program; o There is a reasonable connection between the items or services and the medical care of the individual being offered such items or services; and o The provider of such items or services provides them after determining in good faith that the individual is in financial need; These provisions would appear to expand the range of permissible arrangements under the AKS. Providers should seek legal counsel prior to launching any programs that fall within the parameters of these provisions to ensure compliance. False Claims Act Qui Tam Public Disclosure Bar The Qui Tam statute, also known as the Whistleblower Act, does more than protect employees and consultants who report evidence of false Medicare or Medicaid claims and cost reports to the government; it rewards those who, based upon their knowledge, sue their employer or other provider on the government's behalf, giving them a cut of whatever recovery is granted. The government can join in such suits, but it can stay out and just take the lion's share of the proceeds. Prior to the PPACA, the Qui Tam law did not reward, or even allow private suits, based upon information that the Qui Tam "relator" (the whistleblower) obtained from a source

6 that was "public." Qui Tam actions based on information disclosed in (1) a criminal, civil or administrative proceedings; (2) a congressional, administrative, or Government Accountability Office reports, hearing, audits, or investigations; or (3) the news media, were dismissed on jurisdictional grounds by the court hearing the case. This public disclosure bar was extended by court decision also to include state proceedings and was absolute: If the case was based on knowledge that was public due to some prior news reports, hearings, investigations, etc., the court had to dismiss the case, even if it looked as if the defendant had made false claims. Section 10104(j) of the PPACA, however, takes the public knowledge issue out of the jurisdictional field and makes it just another defense, so that it can be tried along with the rest of the evidence. This potentially is a disadvantage for providers who are defending cases against their former (or even current, job-protected) employees. Specifically, Section 10104(j) amends the FCA to provide that the public disclosure bar does not require dismissal of a private citizen Qui Tam suit if the government opposes dismissal. As a result, under the new law, the government can unilaterally protect a Qui Tam plaintiff from dismissal of his case, just by opposing it, but remain a nearly passive party, waiting on the plaintiff to pursue the recovery. The effect will be to increase the number of cases that are based on public information but are protected from dismissal because the government prefers that they proceed. The reported Qui Tam cases are replete with disputes concerning whether information was "public" and what the Qui Tam relator actually brought new to the enforcement table. That issue arises in motions to dismiss, as described above, but also in fights between the government and relators over how much reward the "new" information actually merits. The new law addresses, and tries to clarify the meaning of, non-rewarded "public" information. First, and significantly, information that was "public" by being raised in some state court or administrative agency is no longer "public" for purposes of federal Qui Tam claims. So cases based on information developed in or by state tribunals is now a viable base for private claims. Not only are private state-level litigants more empowered by this, state attorneys general are as well, since they can be Qui Tam plaintiffs, too. One possible application of this new opportunity would present itself where, after pursuing a Medicaid payment case in a state agency, the government files in federal court to recover and share in the Federal Financial Participation involved in the claim, and the parallel Medicare overpayment, if present. The FCA contains an exception to the public disclosure bar where the individual pursuing the action is the original source of the information which is the subject of the action. Before enactment of the PPACA, the individual pursuing the qui tam action would be the original source if he or she had direct and independent knowledge of the allegations. Under the PPACA, however, the original source exception is amended by eliminating the direct knowledge

7 requirement, thereby focusing less on where the relator obtained the non-public information and more on whether it is actually non-public, new, and helpful. How do providers position themselves to address these changes? Certainly, greater internal security against unauthorized and ill-intentioned access to private billing and payment information is not the answer: The changes make litigation easier and more costly to providers, but only after the information has been taken. Since a Qui Tam suit is simply a private FCA case, all efforts that increase billing compliance automatically reduce Qui Tam risk. The ability of a Qui Tam relator to use information developed in a state enforcement proceeding to generate a federal suit suggests that where a provider is considering reporting overpayment issues to both state and federal agencies (for example, under the stronger mandatory refund provisions, above), sooner rather than later is an advantage, as is including federal disclosure, to intermediary, carrier, etc., in the plan. Except for widening that single point of access for would-be relators, however, the statute primarily makes life easier for relators once the case is filed. Also, it can be argued that a state licensure action against a Medicaid-only provider could form the basis for a Qui Tam action because the state report isn t considered a federal report under the PPACA revisions to the FCA. Medicaid State Plans Additional Requirements There are additional requirements for Medicaid State Plans under the PPACA. These requirements are found in the PPACA, Sections 6501 through 6505 and include the following: Providers are automatically terminated from Medicaid if an individual or entity is terminated by Medicare or another state Medicaid program (Section 6501; 42 U.S.C. 1396a(a)(39)). State Medicaid agencies must exclude any individual or entity that owns, controls or manages an entity that has failed to repay delinquent overpayments; is suspended, excluded or terminated from participation in any Medicaid program; or is affiliated with an individual or entity that has been suspended, excluded or terminated from Medicaid (Section 6502; 42 U.S.C. 1396a(a)).

8 Any agent, clearinghouse or other alternate payee that submits claims on behalf of a health care provider must register with the state and Secretary of HHS (Section 6503; 42 U.S.C. 1396a(a)). Prohibits Medicaid payments to any financial institution or entity located outside the United States (Section 6505; 42 U.S.C 1396b(a)). These provisions are effective January 1, 2011, but may be delayed if state legislation is required in order to comply with these provisions of the PPACA. Providers engaged in acquiring or managing other facilities will need to be especially careful during the due diligence process to ensure that the facility/provider does not have any delinquent overpayments owed under a Federal health care program. CMS Civil Monetary Penalties The PPACA expands the availability of CMPs by CMS to be used against providers under certain scenarios (Sections 6402 and 6408). The following activities were identified for the assessment of additional CMPs: Knowingly retaining an overpayment and not reporting and returning such overpayment. Failing to grant timely access to the OIG for audits, investigations, or other statutory function (penalty up to $15,000 per day). Knowingly making, using, or causing to be made or used a false record or statement material to a false or fraudulent claim for payment under a Federal health care program (penalty up to $50,000 for each claim). Knowingly making a false statement or misrepresentation on any Federal health care program application, bid or contract (penalty up to $50,000 for each claim). Ordering or prescribing a service during a period in which the person was excluded from a Federal health care program (penalty up to $50,000 for each order or prescription).

9 With the increased penalties available, providers should be careful when submitting claims for payment and institute a procedure for handling possible overpayments. Expanded Recovery Audit Contractor ( RAC ) Activities The PPACA includes a provision that expands the current recovery audit contractor (RAC) program to Medicaid and Medicare Parts C and D. These changes become effective no later than December 31, The RACs started as a demonstration project in 2003 in a few states and became permanent in 2010 nation-wide. It was an initial effort by CMS to determine whether RACs would be a costeffective way to ensure correct payment to providers and suppliers billing Medicare Part A and Part B. What makes RACs different from other reviewing activities is that the RACs receive a contingency fee (from 9% to 12.5%) based on the amount of the improper payments they correct for both overpayments and underpayments, although the vast majority of corrected claims have been based on overpayments. The other difference is that RACs only review postpaid claims, unlike other Medicare contractors that review claims before they are paid. RACs are expected to follow all regulations and manuals just like any other reviewing contractor already in place. To date, physicians and hospitals have been the primary target of RAC activities but the potential for expansion to other settings remains a concern. AAHSA has, and will continue to, pay close attention to potential problems that may arise with the private contractors auditing practices. AAHSA is particularly concerned about the aggressiveness of the auditing process as a result of the bonus incentives received by RACs, and the complicated appeals process faced by providers when a claim has been wrongly denied. With the extension of RACs to Medicaid and Medicare Parts C and D, this reinforces how important it is for members to be sure they are billing properly and have corporate compliance programs in effect (not just on paper). Implications for providers Assuming that the efforts of RACs eventually will include post-payment reviews of nursing home claims, providers need to be especially vigilant about understanding and exercising their appeal rights. The timeframe for appeals is very specific. Failure to follow the appeal procedures could automatically result in a final determination that an overpayment was made to the provider, thereby triggering a repayment obligation. In light of the previous section s discussion about overpayments, the repayment obligation stemming from a RAC audit

10 determination that a claim was overpaid, could trigger additional enforcement actions by the OIG or FCA liability. Time Limit to Submit Medicare Claims The PPACA significantly reduces the time to submit Medicare claims for payment (Section 6404; 42 U.S.C. 1395f(a)(1); 42 U.S.C. 1395u(b)(3)(B); 42 U.S.C. 1395n(a)). The period of time to submit Medicare claims is now one year from the date of service. The prior limit was three calendar years following the year in which services were furnished. The one-year limit applies to services furnished on or after January 1, For services furnished before January 1, 2010, a request for payment must be submitted by December 31, Providers must be mindful of the new change to make sure they submit any new Medicare claims within one year of service. Also, providers should audit their Medicare billings and make sure any older claims are submitted for payment by the end of Suspension of Payments Pending Investigation Section 6402(h) provides that Medicare and Medicaid payments to a provider may be suspended pending investigation of a credible allegation of fraud against the provider, unless HHS determines that there is good cause not to suspend such payments. The provision further directs the Secretary of HHS to consult with the OIG in determining whether there is a credible allegation of fraud against the provider. Regulations will be needed to further define and frame the operative language. Until regulations are drafted to further define this section, the determination of a credible allegation of fraud shall be based upon a consultation between the Secretary of HHS and the OIG. Provider compliance programs need to be carefully reviewed to ensure prompt actions are taken in response to any potential overpayment situations. Health Care Fraud Offense

11 The PPACA amends the criminal health care fraud statute to reduce the intent required to establish a health care fraud offense violation (Section 10606; 18 U.S.C. 1347). The knowing and willful standard does not require proof of actual knowledge of health care fraud or specific intent to violate the statute. There is a similar amendment to the AKS. With the decreased standard of proof for the criminal health care fraud statute, providers need to be aware of the increased risk of potential criminal prosecutions for health care fraud claims. Other Provisions of Note National Provider Identifier Effective January 1, 2011, all Medicare and Medicaid providers must included their national provider identifier on all program applications and claims (Section 6402; 42 U.S.C et seq.). Data Sharing The PPACA provides numerous provisions for the OIG and the Department of Justice to share data to combat healthcare fraud and abuse (Sections 6402, 6403, and 6504). Some of the relevant data sharing practices included in the PPACA are the following: o Creates a national health care fraud and abuse data collection program for reporting adverse actions (Section 6403). o Terminates the Healthcare Integrity and Protection Data Bank and transfers all data collected to the National Practitioner Data Bank (Section 6403). This is to take place one year from date of enactment (March 23, 2011) or the effective date of new regulations related to this provision. The Department of Veteran Affairs will have access to the National Practitioner Data Bank. o Prohibits federal matching payments to states for medical assistance to those individuals that do not report timely data to the Medicaid Management Information Systems ( MMIS ) (Section 6402). o Mandates states submit expanded data elements under MMIS, as determined by the Secretary of HHS that is necessary for program integrity, oversight and administration (Section 6504).

12 o Mandates that the Integrated Data Repository of CMS include claims and payment data from the Medicare, Medicaid, Veterans Affairs, and the Indian Health Service so that such data can be matched with HHS data to identify potential fraud, waste and abuse (Section. 6402). The OIG and Attorney General will have access to the claims and payments database. OIG Authority to Obtain Information from Providers and Suppliers Section 6402(b) authorizes the OIG to obtain information from any individual (including a beneficiary; provided that all applicable privacy protections are followed) or provider or supplier, for purposes of protecting the integrity of the Medicare and Medicaid programs. This authority extends to information and supporting documentation, including a prescribing physician s medical records for an individual, necessary to validate Medicare and Medicaid payments. Expanded HHS-OIG Subpoena Authority Section 6402(e) of the PPACA extends the authority of HHS to subpoena testimony in the context of program exclusion investigations. It also authorizes the Secretary of HHS to delegate such subpoena authority to the OIG. Obstruction of Program Audits Section 6408(c), which became effective with respect to acts committed on or after January 1, 2010, authorizes permissive exclusion for anyone that obstructs an investigation or program audit. Previously, such permissive exclusion applied only in the context of criminal investigations. U.S. Sentencing Guidelines Under Section 10606(a) of the PPACA, the U.S. Sentencing Commission (the Commission ) is directed to amend the Federal Sentencing Guidelines ( FSGs ) applicable to persons convicted of Federal health care offenses involving government health care programs, to provide that the aggregate dollar amount of fraudulent bills submitted to the government health care program constitutes prima facie evidence of the intended loss by the defendant. The Commission is also directed to amend the FSG to increase penalties as follows: o A 2-level increase in the offense level for any conviction involving a loss of $1,000,000 and $6,999,

13 o A 3-level increase in the offense level for any conviction involving $7,000,000 and $19,999, o A 4-level increase in the offense level for any conviction involving $20,000,000 or more. Funding To enact all the provisions regarding fraud and abuse in the PPACA, Congress authorized increased funding for enforcement agencies. The PPACA authorizes $10 million in increased funding for the Health Care Fraud and Abuse Control agency for each year through 2020 and also provides for an additional $250 million through 2017, with $95 million beginning in The increased funding signals the commitment of Congress to fight healthcare fraud and abuse. What Members Need to Do Now to Prepare Providers need to educate all of their stakeholders on the many implications of the PPACA as well as to undertake a review of their existing compliance programs, policies and procedures to ensure they are updated to reflect all new requirements, obligations and risk areas. An organization s definition of a stakeholder warranting further education needs to be carefully considered in light of the many implications for the board of directors, management, staff and other providers and suppliers who are affiliated with the organization. AAHSA wishes to thank the AAHSA Legal Committee for their contribution toward this document, with special thanks to Brian Kaser, Esq., of Brian Kaser, PLC, Lansing, MI, Lori McLaughlin, Esq., General Counsel of Holy Cross Village, Schererville, IN, and Maureen Weaver, Esq., of Wiggin and Dana LLP, New Haven, CT.