CPCA California Primary Care Association Managing the Compliance Risk of Fraud, Abuse and the False Claims Act CPCA CFO Conference Larry Garcia Kenneth Julian April 30, 2010 Background The Patient Protection and Affordable Care Act ( Act ) recently adopted by Congress significantly expands coverage for Medicaid thereby increasing the patient base for FQHCs. The Act also makes a significant investment in FQHCs as a model of primary care delivery. Authorizes the establishment of a Community Health Center Fund ( Fund ) and appropriates: (i) $9.5 billion in 2011 for FQHCs; (ii) $1.5 billion from 2011 to 2015 for construction and renovation; and (iii) $1.5 billion for the National Health Service Corp. Authorizes an additional $34 billion from 2010 to 2015 for Section 330 grants. Establishes a prospective payment system for Medicare covered services furnished by FQHCs beginning 10/1/14. Expands the 340B Program ( Program ) to children s hospitals, critical access hospitals and RHCs effective 1/1/10. 1 1
Background, cont. However over the past few years, the federal government has placed an increased emphasis on detecting and prosecuting Medicare and Medicaid fraud as a means of managing total health care costs. Several laws impose constraints on business practices of FQHCs. Anti-Kickback and Fraud and Abuse Laws ( AKS ) False Claims Act and State Laws ( FCA ) Deficit Reduction Act of 2006 ( DRA ) Fraud Enforcement and Recovery Act of 2009 ( FERA ) RAC Audits Medicaid Integrity Program Audits National Health System Reforms 2 Key Questions: 1. What are the principal laws with which CFOs of FQHCs should be familiar? 2. How can FQHCs protect themselves and their officers and directors from exposure to significant legal liability and to potential criminal prosecution in the face of this increased scrutiny of their business practices? 3 2
Fraud Laws Anti-Kickback Statutes False Claims Act Deficit Reduction Act Fraud Enforcement and Recovery Act Patient Protection and Affordable Care Act 4 The Anti-Kickback Statute Federal AKS defined under 42 USC section 1320a-7b(b) to apply to: Whoever knowingly and willfully solicits or receives any remuneration (including any kickback, bribe, or rebate) directly or indirectly, overtly or covertly, in cash or kind i. (A) in return for referring an individual to a person for the furnishing or arranging for the furnishing of any item or service for which payment may be made.under a federal healthcare program, or ii. (B) in return for purchasing, leasing, ordering or arranging for or recommending purchasing, leasing or ordering any good, facility, service or item for which payment may be made..under a federal healthcare program Shall be guilty of a felony and shall be fined or imprisoned Case Law and the One Purpose Rule Federal Safe Harbors including the FQHC Safe Harbor 5 3
The False Claims Act FCA has roots in addressing Civil War procurement misconduct Elements of FCA Scienter. i.e. actual knowledge of falsity or reckless disregard of the truth Filing of a claim for payment from governmental funds Includes false statements in support of the claim Materiality Criminal False Claims 42 USC Section 1320a-7b prohibits knowingly and willfully making any false statement or representation of material fact in any claim or application for benefits under the Medicare or Medicaid Programs. 6 The False Claims Act, cont. Qui Tam Lawsuits Section 3730(d)(1)&(2) permits civil actions for false claims by a qui itam relator. If the government proceeds with an action, then the person bringing the action shall receive at least 15% but not more than 25% of the proceeds of the action or settlement of the claim If the government does not proceed with an action, the person bringing the action or settling the claim shall receive an amount determined to be reasonable but shall not be less than 25% but not more than 30% of the proceeds FCA can represent a significant exposure of an FQHC to liability where a former employee or advisor becomes a qui tam relator. 7 4
The Deficit Reduction Act 2006 Federal Deficit Reduction Act ( DRA ) raised the bar for compliance and created significant incentives for states to enact laws to address false or fraudulent claims in the Medicaid programs State law must create liability to state for false claims State law must create law to facilitate and reward qui tam suits State law must permit qui tam plaintiffs to file under seal with a 60 day review period by State Attorney General State law must create fines and penalties not less than federal law Employee Education. One of the most significant elements of the DRA is to require that providers receiving $5 million in annual revenues to implement an education program for its employees (i) to encourage compliance, and (ii) to inform employees on qui tam lawsuits 8 The Fraud Enforcement and Recovery Act In 2009, Congress adopted the Fraud Enforcement and Recovery Act ( FERA ) that amended the existing FCA to make significant changes. Clarifies that one does not need to meet prove as specific intent to demonstrate a violation of the law Adds to the definition of fraud the retention of any overpayment Congressional record suggests that the FCA can be violated by (i) demanding payment for services that do not conform to regulatory standards, (ii) requesting payment for services of lesser quality, (iii) submitting a claim that falsely certifies compliance, or (iv) submitting a claim by a person that has violated the law The adoption of FERA is likely to have an impact on the ability of the governmental prosecutors and private bounty hunters to recover money from health care providers including FQHCs. 9 5
The Patient Protection and Affordable Care Act The Act includes provisions that raise the bar of compliance for health care providers: Applies the False Claims Act to payments made by, through, or in connection with, the Exchange if payments include federal funds Narrows the application of public disclosure bar to permit an individual who has independent knowledge that materially adds to the publicly disclosed allegations, can serve as an original source Amends the AKS statute intent standard to provide that a person may violate the AKS statute without actual knowledge of, or with the specific intent to violate statute The Act also provides significant new investments into Medicare and Medicaid fraud enforcement Over $350 million to Medicaid fraud enforcement A third of which will be spent in 2011 10 Noncompliance Penalties As a result of this increased scrutiny, healthcare providers face increased risk of sanctions for noncompliance including: Criminal prosecutions Fines-FCA multiples (e.g. 3X) not covered by insurance Payment of prosecutor s attorneys fees Per Claim Penalties, and Potential exclusion of entities and persons from participating in the federally funded programs Most significant risks come from the existence of a system business practice: (i) that is exposed through a government investigation or qui tam lawsuit, and (ii) the aggregate amount of which is sufficient to put the financial viability of the FQHC at risk. 11 6
Key Questions: How can FQHCs protect themselves and their officers and directors from exposure (i) to significant legal liability and (ii) to potential criminal prosecution in the face of this increased scrutiny of their business practices? 12 Lessons From Recent Events Key lessons from recent compliance experience involving investigations of FQHCs: FQHCs are big game for regulators Doing God s Work will not protect you The most dangerous threat to the FQHC are people that worked for you Governmental enforcement agencies do NOT understand the complexity of the regulatory environment under which FQHCs must operate Conducting a self-investigation and making a self-disclosure can secure an improved bargaining position and help to mitigate the application of penalties and the requirement to undertake compliance obligations 13 7
Lessons From Recent Events, cont. Key lessons (cont.): Dismissed, disciplined or disappointed employees pose risk Investigators looking to make their case and not necessarily to find the truth There is no substitute for prudent A/R management Do not hire inexperienced people in high risk areas Growth is dangerous and can eat cash out of your balance sheet Governmental enforcement agencies do NOT understand the complexity of the regulatory environment under which FQHCs must operate Get legal advice rather than debate legality of billing practices among the staff 14 Recommended Actions FQHCs can and should protect themselves and their officers and directors from exposure to legal liability and potential criminal prosecution by taking the following actions: 1. Hire a qualified Chief Compliance Officer to implement a robust Corporate Compliance Program 2. Institute a proactive compliance review audits and adopt a Code of Conduct for each of its employees 3. Carefully educate your employees concerning their duties and responsibilities concerning corporate compliance and have employees periodically sign a Code of Conduct in order to identify compliance issues before they become big ticket items 4. Where appropriate, perform a self investigation and use the OIG Self Disclosure Protocol to limit exposure to legal liability 15 8
Compliance Programs 16 Selecting a Chief Compliance Officer Selection of Chief Compliance Officer is one of the most significant actions that can be taken to put into place a compliance program. To be successful, the selection should have the following: Input and support of the board of directors Have a dual reporting relationship to both the Executive Director and the board of directors Sufficient authority and resources to enable the Chief Compliance Officer to carry his/her compliance responsibilities Implementing a robust compliance program requires the right people, do the right thing with the right resources. An effective compliance program can (i) reduce the exposure of the organization to liability for fraud, (ii) decrease the cost of healthcare delivery, (iii) build credibility with regulators and (iv) improve business operations for the organization. 17 9
Proactive Compliance Actions There are several activities and techniques that can be employed to address compliance risk so that you can stay ahead of the regulators: Develop model plans and auditing techniques to assess the high risk business practices of FQHCs Conduct targeted audits and assessment of its high risk business practices Adopt policies and procedures to implement the compliance program Develop and implement a Code of Conduct for all officers, directors, employees and independent contractors Establish a system to monitor and enforce the Code Respond to allegations of non-compliance in a timely manner 18 Proactive Compliance Actions, cont. Auditing and Monitoring Plans and Techniques. FQHCs should focus on business practices that are most likely to problematic from a compliance point of view such as: i. Ensure providers and staff are familiar with appropriate billing and coding requirements for FQHCs ii. Establish processes to be certain that proper licensing and enrollment requirements have been met before payment requests are submitted iii. Perform a review to be certain that accurate cost report certifications and Medi-Cal reconciliation reports are filed iv. Screen for excluded individuals and entities before hiring and on an ongoing basis v. Protect against improper gifts and influences by suppliers on providers and staff vi. Be familiar with HIPAA and security breach notification requirements 19 10
Compliance Actions Educational Programs Training and Education Programs. FQHCs should develop education and training programs, to educate new and existing employees on compliance requirements for the organization. 1. Compliance programs are now mandatory even for providers with less than $5 million in annual revenues 2. Policies and procedures must be established to provide compliance training and information about (i) false claims laws, (ii) remedies and penalties for non-compliance, (iii) whistle blower protections, and (iv) the FQHC s compliance policies 3. Training should be used as a vehicle for early identification of compliance issues so that interventions can be put into place before the FQHC faces a bet-thecompany compliance issue 20 Self Investigations and the Use of the Self Disclosure Protocol Compliance Programs. The use of the Protocol is not a common compliance activity but can be an effective tool in an overall compliance program. The Protocols should be weighed and considered for any non-compliance incident or practice that involves the following: 1. The repeated or re-occurring practice in which an overpayment by the government has taken place. 2. For any act of fraud in a billing or coding practice. 3. Where substantial sums have been overpaid and it is necessary to negotiate a repayment arrangement to permit the FQHC to pay back the amounts over time. 4. Where directors, officers, employees or physician i contractors t have been involved with the practice or incident and disciplinary actions were required by the FQHC. 5. Where the compliance audits of the FQHC indicate that an act of non-compliance has taken place. 6. Where it is prudent to involve the government in an internal investigation and self assessment of high risk activities. 21 11
Self Investigations and the Use of the Self Disclosure Protocol, cont. The Protocol may be used for the following purposes: To refer a matter of non-compliance to the OIG before an investigation is initiated by the government To open up a dialog with the OIG in a manner that the health care provider can perform the investigation of non-compliance and report its findings to the OIG To help mitigate fines, penalties and the adverse effects of non-compliance upon clinic operations Use of the Protocol does not guarantee that the OIG will not investigate the non-compliance or that the remedies imposed with be mitigated. However, it does represent an opportunity to demonstrate that the clinic can and will investigate its high risk practices and make appropriate disclosures to the OIG as part of its ongoing business activities. 22 Self Investigations and the Use of the Self Disclosure Protocol, cont. An internal investigation leading to a self disclosure should include the following elements: Formal management memo or board resolution indicating an investigation will take place Engagement of Compliance professionals to support Communications within organization regarding investigation Review of key documents Interview of personnel Self Assessment of behaviors, actions and risk Investigative Report and findings Corrective Action Plan Decision on Voluntary Disclosure 23 12
Self Investigations and the Use of the Self Disclosure Protocol, cont. Examples of how Protocol has/can be used by Clinics: To investigate evidence that a prior administrative team may have systematically submitted Medi-Cal claims without adequate support in the medical record to support payments. To inform the fiscal intermediary that the FQHC failed to secure a required provider number for a new location and has received payments under an inappropriate provider number. To take control of an investigation that has been initiated by a governmental agency and for which the FQHC has been served a subpoena duces tecum. To investigate a confidential complaint of kick-back payments to a provider that the FQHC obtains on its hot-line. To investigate statements of impropriety made by a terminated employee at his/her exit interview. 24 13