Looks Like Alphabet Soup, But the Letters Spell RISK for Your Practice!

Ensuring compliance to continually changing government regulations is a challenge, but one that must be met in order to avoid the risk of financial penalties and sanctions against your practice.

Today, many healthcare providers are suffering from Medicare take-backs and the consequences of whistleblower reporting. Like you, most of these medical professionals believed they were doing all that needed to be done in order to be compliant!

Many recent court cases highlight the importance of having a Compliance Program with auditing protocols that can prevent financial penalties, as well as the emotional turmoil caused by allegations and findings. (See article at right.)

Remember, being pro-active by identifying your compliance risk can save you and your practice from "being in the soup!"

Also in this edition of MediStar Meducation Alert:

Does Your Practice Have a Compliance Plan in Place?

A recent Case

Making Sense of Alphabet Soup

Don't Forget About OSHA!

Important DEADLINES

How to Navigate an Internal Investigation

Does Your Practice Have a Compliance Plan in Place?

By Pam Nole, Director of Consulting Services, MediStar

On February 1, 2010, President Obama presented the proposed fiscal year (FY) 2011 Budget to Congress. According to the press release issued by HHS, "This Budget includes $561 million in discretionary resources, an increase of $250 million, to strengthen Medicare and Medicaid program integrity activities, with a particular emphasis on fighting healthcare fraud in the field, increasing Medicaid audits, and strengthening program oversight while reducing costs." This budget also includes a set of new program integrity proposals that will enhance provider scrutiny, increase claims oversight, improve Medicare data analysis capabilities, and reduce over utilization of Medicaid prescription drugs. This investment will potentially save $9.9 billion over ten years. HHS is turning up the Health Care Fraud Prevention and Enforcement Action Team, known as the HEAT.

You can best ensure compliance within your practice by developing and maintaining a Compliance Program, which, according to the Office of the Inspector General (OIG), should contain seven components:

1. Conducting internal monitoring and auditing

2. Implementing compliance and practice standards

3. Designating a compliance officer or contact

4. Conducting appropriate training and education

5. Responding appropriately to detecting offenses and developing corrective action

6. Developing open lines of communication

7. Enforcing disciplinary standards through well-publicized standards

Being well prepared will allow you to be pro-active in identifying over-payments and/or coding errors before it is too late and extremely costly. "Remember that the American Recovery and Reinvestment Act (ARRA) not only expanded HIPAA to include business associates of Covered Entities. It includes new notification requirements for security breaches and increases penalties for HIPAA violations. It also protects whistleblowers reporting mismanagement of funds, safety and health violations, or legal violations by entities receiving federal money." (Reference, The American Institute of Healthcare Compliance)

If you need assistance in developing a Compliance Program for your practice, consider engaging a compliance specialist as a consultant.

A Recent Case

Allegations against a Connecticut physician involved claims submitted to federal health care programs for infusion therapy services that were not rendered. These claims resulted in Medicare paying the physician $66,591 between April 2006 and November 2008.

The False Claims Act provides for treble damages and penalties of $5,500 to $11,000 per false claim submitted. However, if the person or entity acts promptly to disclose and fully cooperates with the investigation, the government can recover up to double damages.

In this case, the physician voluntarily disclosed the conduct and cooperated, agreeing to pay 1.5 times damages, for a total amount of $99,886.86.

Making Sense of Alphabet Soup

HEAT — Health Care Fraud Prevention & Enforcement Action Team

Attorney General Eric Holder and Health & Human Services (HHS) Secretary Kathleen Sebelius have announced the creation of a new interagency effort, the Health Care Fraud Prevention & Enforcement Action Team (HEAT) to combat Medicare fraud. The HEAT team will include senior officials from the Department of Justice (DOJ) and HHS who will build upon and strengthen existing programs to combat fraud, while also investing new resources and technology to prevent fraud, waste, and abuse before it happens.

RAC — Recovery Audit Contractor

The RAC demonstration program has proven to be successful in returning dollars to the Medicare Trust Funds and identifying monies that need to be returned to providers. It has provided Centers for Medicare & Medicaid Services (CMS) with a new mechanism for detecting improper payments made in the past and has also given CMS a valuable new tool for preventing future payments. Section 302 of the Tax Relief & Health Care Act of 2006 makes the RAC Program permanent and requires the Secretary to expand the program to all 50 states by no later than 2010.

ZPIC — Zone Program Integrity Contractors

The primary goal of the Program Safeguard Contractor (PSC) and the Zone Program Integrity Contractors (ZPIC) Benefit Integrity (BI) unit is to identify cases of suspected fraud, develop them thoroughly and in a timely manner, and take immediate action to ensure that Medicare Trust Fund monies are not inappropriately paid out and that any mistaken payments are recouped. Suspension and denial of payments and the recoupment of overpayments are an example of the actions that may be taken. All cases of potential fraud are referred to the Office of Inspector General (OIG), Office of Investigations Field Office (OIFO) for consideration and initiation of criminal or civil prosecution, civil monetary penalty, or administrative sanction actions. CMS follows four parallel strategies in meeting this goal: 1) preventing fraud through effective enrollment and through education of providers and beneficiaries, 2) early detection through, for example, medical review and data analysis, 3) close coordination with partners, including PSCs, ZPICs, ACs, MACs, and law enforcement agencies, and 4) fair and firm enforcement policies.

Don't Forget About OSHA!

Your practice is responsible for ensuring the health and safety of your employees and all those who enter your facility. If you have 10 employees or more, you are required to have an Emergency Action Plan. Is yours in place? Does each member of your staff receive emergency response training at the start of employment and then annually thereafter? Are evacuation routes posted? While it may not be required to hold drills, it may be a good idea to test your plan with an actual evacuation on a nice day.

Important DEADLINES

The HIPPA HITECH Breach rule became effective on February 17, 2010, and the Red Flag Rules go into effect on June 1, 2010. To learn more about the Red Flag Rules, click here.

How to Navigate an Internal Investigation:
Ten Questions to Guide Your Course

By Holly Louie, CHBME

Knowing whether or when to launch an internal investigation into compliance issues can be intimidating and confusing. Is it necessary? Who should conduct the investigation? How do you attack the problem in the most efficient, least disruptive, and most cost effective way? How do you know you’ve done a thorough job of identifying all the variables that created the problem?

The following ten-step approach asks basic questions and provides tips that should help guide you in making the right decisions. The key factors are based on the volume of the problem, the duration (pattern), the dollars involved, the scope, intent, and the level of risk to your practice.

1. When is an investigation called for?

To determine the answer, ask yourself these questions:

  • Is the allegation credible?
  • Is this a simple error or misconduct? To understand the magnitude of the problem, determine your best estimate of the variables specified in the allegation.
  • Is the problem a system wide failure or isolated to one area? What is the level of risk? Are there overpayments involved? Is this a repeat problem? Do you or the client currently have a Corporate Integrity Agreement (CIA)? Are there significant obstacles to the investigation beyond your control? For example, must you collaborate with other entities?

If you determine the allegation is credible and the problem is due to misconduct, a system-wide failure, or recurrent problem or a pattern, or if it involves high dollars and/or long duration, then your answer is yes. Any or all of these elements call for an investigation. In addition, any entity or individual with a CIA must adhere to the conditions and thus an investigation is probably mandated.

2. Should the investigation be conducted in-house or with outside resources?

If your answer to any of the questions could undermine the credibility of your investigation, or your practice’s viability is contingent on the outcome, independent experts with demonstrated expertise are indicated.

  • Does the investigation require detailed, specialized knowledge?
  • Do you have a conflict of interest?
  • Can you be completely objective?
  • Is there legal or financial risk to the organization?
  • Do you need attorney-client privilege?

3. Should you engage a knowledgeable healthcare attorney?

Spend time thinking this question through from an end result, rather than from an upfront cost perspective. Do you want or need the investigation to be protected? Handling an investigation without legal counsel can cause possible complications, such as additional risk and/or flawed findings due to a lack of expertise in the correct and accurate documentation of the investigation. Give due consideration to the benefits of counsel, not just the cost.

4. What should you document?

The answer is everything. Document every step of the investigation: who, what, when, where, and why. Once you’ve determined there is a credible issue and started an investigation, you have to complete the process by addressing the following operational questions:

  • Who found the problem and how?
  • What are the details of your investigation?
  • Who was interviewed and how were they selected?
  • What actions did you take and why? Did you educate? Did you write new or revised policies and procedures? What auditing and monitoring did you institute? What corrective actions did you take?

5. Who should conduct the investigation?

The answer to this will vary depending on your organization, expertise, attorney involvement, and who is involved in the allegation. Possible answers include a knowledgeable compliance officer or owner, designated employees under the compliance officer’s direction, and independent persons under an attorney’s direction. Typically, independent persons are used in cases where criminal activity is suspected or where high-level company involvement is suspected; internal investigations are not recommended for these scenarios.

6. How should you proceed once the decision to investigate has been made?

Stop the bleeding!!! As soon as you know there is a credible problem, stop the claims or processes that create additional risk. Then follow these steps:

  • Develop a detailed plan of action and stick to it
  • Protect all relevant information
  • Spell out duties, responsibilities, deliverables, and timelines
  • Control the information, details, and processes
  • Make determinations regarding the need for self-disclosure and reassess the involvement of legal counsel. What are the dollars involved? Is a simple repayment adequate resolution?

7. What documentation is relevant?

Once you begin an investigation, you have plunged into the World of Documents. You need to gather them all and step away from the shredder. Define the population. Do you need a statistically valid sample? Will this be a self-disclosure to the government? If so, you probably need counsel and an accounting expert familiar with government sampling requirements. Consider all of the documentation relevant to the problem. This includes paper documents, electronic files, e-mail, archived data, employee "cheat sheets," relevant education, policies, procedures, auditing and monitoring findings, etc. Stop the normal course of business-document destruction. Document any records that were destroyed before the start of the investigation and provide the schedule that shows this destruction was part of your normal course of business.

8. How should you conduct yourself during an ongoing investigation?

First, assume everything will be seen by someone else at some time. Maintain professionalism and avoid subjective statements. Don’t try to play games. In the words of Mayflower Madame Sydney Biddle Barrows, "Never say anything on the phone that you wouldn’t want your mother to hear at the trial."

9. How should the investigation be reported?

The report may be oral or written, depending upon how the investigation was conducted and by whom. Reports should include an objective analysis of the findings, recommendations, corrective-action details and timelines, responsibility assignments, and future plans related to the issue, i.e., auditing, monitoring, and repayment schedule.

10. Whom should you tell about the investigation?

This will vary depending on the findings, but basically only those who have a need to know should be given the details. Was there criminal activity? Was this an innocent mistake? Most investigations are the result of system failures, innocent mistakes, or lack of education, not criminal enterprises. However, even in the case of an innocent mistake, you have liability. When an investigation is necessary, do it immediately and thoroughly. In the meantime, build effective prevention and detection measures and operational safeguards to protect your practice.


If you received this newsletter directly from MediStar, you are currently subscribed and will automatically receive future issues. If you wish to forward this newsletter to a colleague, please feel free to do so. If you received this email from a colleague and wish to subscribe, click here.

To be removed from our distribution list, click here.

MediStar · 12 Cambridge Drive · Trumbull, CT 06611
Phone: (203) 372-1900 · Fax: (203) 372-2600 · info@medistarbilling.com

© 2009 Medi-Claim Services, Inc. All rights reserved.