Medicare Program Integrity Primer: What the Government Can Do And How to Respond. AHLA Fraud & Compliance Forum October 2014

Transcription

1 Medicare Program Integrity Primer: What the Government Can Do And How to Respond AHLA Fraud & Compliance Forum October 2014 By Troy A. Barsky, Esq. Meredith N. Larson, Esq. Crowell & Moring I. Introduction A. This outline covers current Medicare Program Integrity Laws, Regulations, Policies and Guidance. This is not an exhaustive summary, but it provides important and current information related to Medicare Program Integrity. II. Program Integrity Strategy A. Enrollment 1. Provider Screening a. An unfinalized April 2013 proposed rule would expand[] the instances in which a felony conviction can serve as a basis for denial or revocation of a provider or supplier's enrollment; if certain criteria are met, enable[] us to deny enrollment if the enrolling provider, supplier, or owner thereof had an ownership relationship with a previously enrolled provider or supplier that had a Medicare debt; enable[] us to revoke Medicare billing privileges if we determine that the provider or supplier has a pattern or practice of submitting claims for services that fail to meet Medicare requirements; and limit[] the ability of ambulance suppliers to backbill for services performed prior to enrollment. b. The text of the rule, published at 78 Fed. Reg (Apr. 29, 2013), is available at c. Pre-enrollment screening 42 C.F.R CMS has established limited, moderate, and high categorical risk levels for enrolling providers and suppliers.

2 Different pre-enrollment screening requirements apply to each. (a) (b) (c) Moderate risk: ambulance services, community mental health centers, CORFs, hospice, independent clinical laboratories, independent diagnostic testing facilities, physical therapists, portable x-ray suppliers, and revalidating home health and DMEPOS suppliers High risk: new home health and DMEPOS suppliers, providers with program integrity concerns (i.e., history of payment suspension, Medicaid or other federal health care program exclusion, providers in an area that has been subject to a moratorium enrolling after the lifting of the moratorium) Limited risk: all others. 2. Enrollment Moratoria--42 C.F.R a. CMS may issue temporary moratoria on the enrollment of new Medicare providers and suppliers of a particular type if CMS determines that there is a significant potential for fraud, waste or abuse with respect to a particular provider or supplier type or particular geographic area or both. Each moratorium established will be for an initial period of six months that is subject to six-month extensions The establishment and extension of moratoria will be published in the Federal Register. b. Criteria for establishing an enrollment moratorium include: (iii) (iv) Highly disproportionate number of providers or suppliers in a category relative to the number of beneficiaries Rapid increase in enrollment applications within a category Moratorium by a State Medicaid or licensing agency CMS, HHS, or DOJ identifying a particular supplier or provider type or a particular geographic area as having a significant potential for fraud, waste, or abuse 2

3 c. Current moratoria: (iii) Home health agencies in Miami, Chicago, Ft. Lauderdale, Detroit, Dallas, and Houston Ambulance suppliers in Houston and Philadelphia See ess-releases/2014-press-releases-items/ html for more information. B. Information Sharing 1. Information sharing across programs a. CMS Program Integrity Command Center: In 2012, CMS established the Program Integrity Command Center, which brings experts from Medicare and Medicaid, as well as OIG and the FBI, as well as experts from a variety of areas to streamline the investigative process. See more information at and CMS/Components/CPI/Center-for-program-integrity.html. b. CMS Integrated Data Repository: Statistics-Data-and-Systems/Computer-Data-and-Systems/IDR/ The vision of the IDR includes providing greater information sharing, broader and easier access, enhanced data integration, increased security and privacy and strengthened query and analytic capability by building a unified data repository for reporting and analytics. An integral part of the CMS data warehouse strategy, the IDR ensures a consistent, reliable, secure, enterprise-wide view of data supporting CMS and its partners in more effective delivery of quality health care at lower cost to CMS' beneficiaries through state-of-the-art health informatics. c. IRS-SSA-CMS Data Match: Recovery/EmployerServices/IRS-SSA-CMS-Data-Match.html This program requires the IRS, Social Security, and CMS to work together to share information about beneficiaries. 3

4 (iii) The law requires the Internal Revenue Service (IRS), the Social Security Administration (SSA), and CMS to share information that each agency has about whether Medicare beneficiaries or their spouses are working. The process for sharing this information is called the IRS-SSA-CMS Data Match. The purpose of the Data Match is to identify situations where another payer may be primary to Medicare. Employers are required to report information regarding employees who may be Medicare-covered or married to a Medicare beneficiary. 2. Information sharing with law enforcement a. The HEAT Initiative: (iii) Established in 2009, the HEAT Initiative focuses on coordinating efforts to combat fraud in specific areas around the country. The Medicare Strike Force includes state, federal, and local investigators who use data analysis to fight fraud. The Strike Force often engages in coordinated simultaneous national takedowns of large fraud rings. See ml. Cities where the strike force is currently active include Baton Rouge, Brooklyn, Chicago, Dallas, Detroit, Houston, Los Angeles, Miami, and Tampa Bay. III. Who s Who at CMS? A. The Administrator of CMS is Marilyn Tavenner. Her background can be found here: B. Information about CMS Centers and Offices can be found here: Information/CMSLeadership/index.html C. Regional Offices 1. There are ten CMS regional offices that are organized into four consortia. 4

5 a. Consortium for Financial Management & Fee for Service Operations: Information/Consortia/CFMFFSO.html b. Consortium for Medicaid and Children s Health Operations: Information/Consortia/CMCHO.html c. Consortium for Medicare Health Plan Operations: Information/Consortia/CMHPO.html d. Consortium for Quality Improvement Survey & Certification Operations: Information/Consortia/CQISCO.html IV. Program Integrity Contractors A. Medicare Administrative Contractors (MACs) 1. These contractors handle enrollment and claims processing for all fee-forservice Medicare Part A and B providers and suppliers. All of the responsibilities formerly held by fiscal intermediaries (FIs) and carriers have been transferred to the MACs. This change began in 2003 and ended in Information about the contracts is available at 42 U.S.C. 1395kk-1 and at 42 C.F.R et seq. 2. MACs also recoup overpayments, whether identified by the provider for a self-disclosure, by a RAC, or through other means. 3. There are 12 A/B MACs. Four of the 12 process all home health and hospice claims. There are also four MACs that handle all durable medical equipment claims and enrollment and the competitive bidding process for DME suppliers. 4. Information about MACs is available from CMS here: Administrative-Contractors/MedicareAdministrativeContractors.html 5. CMS is seeking to continue to consolidate MAC jurisdictions. Information about consolidations is available here: Administrative-Contractors/MACImplementationSchedule.html B. Zone Program Integrity Contractors (ZPICs) 1. The primary goal of ZPICs is to investigate instances of suspected fraud, waste, and abuse. ZPICs develop investigations early, and in a timely 5

6 manner, take immediate action to ensure that Medicare Trust Fund monies are not inappropriately paid. They also identify any improper payments that are to be recouped by the MAC. MLN Matters No. SE1204, Network-MLN/MLNMattersArticles/downloads/SE1204.pdf. 2. See a full description of contractor functions at 42 C.F.R The Medicare Program Integrity Manual, Ch. 4, discusses the role of the ZPICs 3. ZPICs conduct medical review, perform data analysis, and work with the MAC on suspensions, prepayment review, and auto-denial edits. 4. Their authority includes Parts A&B, DME, home health, hospice, and Medicare-Medicaid data match ( Medi-Medi ) 5. ZPICs may request records, conduct interviews, and perform site visits C. Recovery Audit Contractors 1. The Recovery Audit Program s mission is to identify and correct Medicare improper payments through the efficient detection and collection of overpayments made on claims of health care services provided to Medicare beneficiaries, and the identification of underpayments to providers so that the CMS can implement actions that will prevent future improper payments in all 50 states. See Statistics-Data-and-Systems/Monitoring-Programs/Medicare-FFS- Compliance-Programs/Recovery-Audit-Program/ 2. Section 6411(b) of the ACA required that CMS contract with RACs to monitor Parts C and D as well as FFS Medicare. See Programs/recovery-audit-program-parts-c-and-d/ 3. RACs operate on a three-year look back period. They are paid on a contingent-fee basis, meaning their profitability depends on locating over (or under) payments. D. Medicare Part C/D Program Integrity Contractors 1. National Benefit Integrity Medicare Drug Integrity Contractors (MEDIC) monitors fraud and abuse in the Medicare Advantage and Prescription Drug Program (Medicare Parts C and D). See 2. The Outreach and Education MEDIC provides training on Part C and D fraud and abuse issues. See 6

7 V. CMS Administrative Actions A. Medicare Payment Suspensions 42 C.F.R A payment suspension may occur: a. If CMS or the Medicare contractor possesses reliable information that an overpayment exists or that the payments to be made may not be correct, although additional information may be needed for a determination. b. Reliable information includes: Unusual billing patterns identified through audits, FCA cases, or data mining Statements of patients or employees c. If CMS or the Medicare contractor has consulted with the OIG, and, as appropriate, the Department of Justice, and determined that a credible allegation of fraud exists against a provider or supplier, unless there is good cause not to suspend payments. d. Good cause may include the following reasons: (iii) (iv) Suspension would compromise the investigation Beneficiaries would suffer access problems Other remedies would be more effective Not in the best interests of the program 2. Suspension Procedures 42 C.F.R a. In most situations, CMS must provide notice that payments are being suspended. Notice is not required when: (iii) The provider has failed to furnish information requested to determine the amounts due to the provider or supplier Providing notice would harm the Medicare Trust Fund (such as by decreasing the likelihood that overpayments will be recovered) Where there are credible allegations of fraud and certain other conditions are met. 7

8 b. Regardless of whether notice is required, the provider must be given the opportunity to rebut the suspension. If notice is given, the provider must respond by a certain date or the suspension is effectuated. If a rebuttal statement is received, the procedures set forth at 42 C.F.R apply. A determination must be made and transmitted within 15 days of receiving the statement. The determination is not appealable. A provider who is not given notice must be given the opportunity to submit a statement as to why the suspension should be removed. 3. Duration of Suspension 42 C.F.R a. Generally, suspensions are limited to 180 days. If the suspension is based on suspicion of an overpayment, CMS takes timely action to determine whether an overpayment exists. Once it has done so, the suspension is lifted (subject to any needed adjustments, recoupments, or offsets). If the suspension is based on credible allegations of fraud, the suspension is not subject to the 180-day time limit and may not be rescinded until the investigation is resolved, even if the overpayment due is determined. b. One 180-day extension may be granted if the investigation cannot be completed in the initial time frame. B. Medical Review see Medicare Program Integrity Manual, Chs. 1, 3, 4, and 7 1. About Medical Review a. May be either prepayment or postpayment b. May be automated, routine, or complex (See Ch. 7) A medical review is considered automated when a payment decision is made at the system level, using available electronic information, with no human intervention Routine Review uses human intervention, but only to the extent that the reviewer reviews a claim or any attachment submitted by the provider. It does not require clinical 8

9 judgment in review of medical records. Routine medical reviews target all claims that meet an established preexisting set of billing and coverage criteria created to assess a vulnerability identified in the medical review area (iii) Complex medical review requires a licensed medical professional to use clinical review judgment to evaluate medical records. This includes requests for, collection and evaluation of medical records or any other documentation c. Notice is required. When the review is provider-specific, the provider must be notified in writing. When the review applies to a specific service, the contractor must put notice of the review on its website. See Ch. 3, Prepayment Review a. The goal of prepayment review, which is usually conducted by the MACs, is to reduce payment error by preventing the initial payment of claims that do not comply with Medicare s with coverage, coding, payment, and billing policies. Ch. 1, b. Prepayment review results in an initial determination on the claim either a denial, a payment at the requested level, or a payment that is different that the requested level. An initial determination may be appealed. See 42 C.F.R. part 405, Subpart H (Medicare Part B) or Subpart R (Part A). c. Prepayment review can be either provider-specific (targeting a specific provider that has been identified as a risk) or service specific (targeting a specific type of service) Probe reviews can be used to determine whether a vulnerability identified through data analysis actually exists. See Ch. 7. Ch. 3, 3.2 of the Program Integrity Manual sets forth several different types of issues that MACs may use in determining whether review is appropriate. 3. Postpayment Review 42 C.F.R. part 405, Subpart I a. These reviews apply to claims that have already been paid. They often involve requests for additional documentation. 9

10 b. The original determination is reopened and redetermined (see 42 C.F.R ) Reopenings may be conducted: (a) within one year of the initial determination on a claim; (b) within four years for good cause (see 42 C.F.R ) (c) at any time for fraud or a similar fault. The revised determination may be appealed. C. Revocation, Enrollment Denial, and Deactivation of Billing Numbers 42 C.F.R , 535, There are twelve reasons why a provider s billing number may be revoked, including: a. Noncompliance with enrollment requirements b. Conduct leading to exclusion or debarment from federal programs c. Felony conviction within the 10 years preceding enrollment or revalidation of enrollment d. False or misleading information is provided on the enrollment application e. On-site review establishes that the provider or supplier is no longer operational or is not meeting Medicare requirements f. Grounds related to screening requirements (i.e., application fee is not paid or able to be deposited) g. The provider or supplier sells or allows another to use its billing number. h. Abuse of billing privileges, including billing for services provided to deceased beneficiaries or where the billing provider was not present i. The provider or supplier did not comply with reporting requirements. j. The provider fails to retain or to allow access to certain documentation required to be retained 10

11 k. A home health agency cannot demonstrate that it possesses sufficient reserve funds l. The provider or supplier has had its Medicaid billing privileges terminated in any state. 2. Providers who have had their billing numbers revoked cannot bill Medicare and the provider agreement is terminated. Revocations last for a minimum of one year, but not more than three years. Providers may reenroll through the standard enrollment process and must be surveyed prior to reenrollment. 3. A provider or supplier may be denied Medicare enrollment for many of the same reasons that enrollment may be revoked. Other reasons include: a. An owner has an existing Medicare overpayment b. An owner has been placed under a payment suspension c. The application is for an area under a moratorium 4. Billing privileges may be deactivated if: a. The provider does not submit claims for 12 consecutive months. b. The provider does not report a change to the information supplied on the enrollment application c. Requested documentation to support an enrollment is not provided 5. A deactivation has no effect on the provider s participation agreement. To reactivate billing privileges, a new application must be submitted or the information on file must be recertified. VI. OIG Administrative Actions A. Program Exclusion 42 U.S.C. 1320a-7 1. Mandatory Exclusion 42 CFR part 1001, Subpart B a. Crimes related to Medicare or Medicaid (any) b. Crimes related to patient abuse or neglect c. Felony related to health care fraud (fraud, theft, embezzlement, breach of fiduciary responsibility, or other financial misconduct) d. Felony related to controlled substances 11

12 2. Permissive Exclusions: 42 CFR part 1001, Subpart C a. Misdemeanor related to health care fraud (other than Medicare or Medicaid fraud) b. Misdemeanor relating to controlled substance c. Any conviction related to fraud d. Any conviction related to obstruction of an investigation e. License revocation or suspension f. Exclusion under another federal or state health care program g. Substandard care h. Fraud, kickbacks, or other prohibited activities (no criminal conviction required) i. Entities controlled by a sanctioned individual or a family or household member of an excluded person to whom ownership of the entity has been transferred j. Failure to disclose required information, grant immediate access to a facility, or take required corrective action k. Default on health care education loan l. Individuals controlling a sanctioned entity m. Making false statements or misrepresenting material facts B. Civil Monetary Penalties: 42 U.S.C. 1320a-7a; 42 C.F.R. part CMPs may be issued to penalize conduct that is not criminal, but which violates program rules. Examples of conduct that may be penalized includes (but is not limited to): a. Submission of false claims, (claims for care not provided, care provided by an unlicensed person, care that is not medically necessary) b. Submission of claims in violation of a provider agreement or other rules relating to provider assignment and billing c. Providing information that is false or misleading that may impact the decision to discharge a patient from a hospital 12

13 d. Submission of claims by an excluded person or by an entity owned or controlled by an excluded person e. Violations of the anti-kickback statute f. Violations of the Stark law g. Violations of EMTALA h. Failure to return a known overpayment i. Making payments to induce a physician to reduce or limit services provided (known as gainsharing ) j. Provides inducements to beneficiaries ( offers to or transfers remuneration to any individual eligible for benefits under [Medicare or Medicaid] that such person knows or should know is likely to influence such individual to order or receive from a particular provider, practitioner, or supplier any item or service for which payment may be made, in whole or in part, under subchapter XVIII of this chapter, or a State health care program ) 2. Engaging in penalizable conduct may lead to fines, but can also lead to exclusions and other sanctions. C. New OIG Proposed Rules Fed. Reg (May 9, 2014) New exclusion authorities (reflecting statutory changes) Fed. Reg (May 12, 2014) New CMPs (reflecting statutory changes) Fed. Reg (Oct. 3, 2014) New anti-kickback safe harbors and CMP exceptions VII. Appeal Rights A. Enrollment and Revocation Determinations: 42 C.F.R part

14 1. There is a single appeal for both the revocation of a provider number and termination of provider agreement a. A request for reconsideration must be filed within 60 days (42 C.F.R ). After reconsideration, a revised determination will be issued. b. A provider can appeal a revised determination to an administrative law judge. 42 C.F.R Such a request must be submitted within 60 days of the issuance of the revised determination. 42 C.F.R c. An ALJ determination can be appealed to the Departmental Appeals Board within 60 days. 42 C.F.R d. Judicial review of DAB decisions is also available. 42 C.F.R Deactivations can be appealed by filing a rebuttal stating why deactivation should not occur. B. Payment Appeals 1. There are five levels of review CMS redetermination, Qualified Independent Contractor review, ALJ hearing, the Medicare Appeals Council, and judicial review. a. CMS redetermination: 120 days after initial determination, see 42 C.F.R et seq. b. QIC reconsideration: 180 days after redetermination, see see 42 C.F.R et seq. c. ALJ hearing: 60 days after reconsideration, see see 42 C.F.R et seq. Note: the amount in controversy must exceed an annually-updated threshold. See see 42 C.F.R d. MAC: 60 days after ALJ determination, see see 42 C.F.R et seq. Under certain circumstances an appeal to the MAC may lie even if the ALJ has not issued a decision. e. Judicial review: 60 days after the MAC review. Must meet amount in controversy requirements. C. Appealing OIG CMPs and Exclusions 42 CFR part

15 1. ALJ Hearing written request must be filed with the Departmental Appeals Board within 60 days of the notice of the sanction. See 42 C.F.R a. The ALJ has limited authority to overturn the OIG. See 42 C.F.R An appeal to the DAB may be filed within 30 days of the date of service of the initial ALJ decision. See 42 C.F.R Petitions for judicial review must be filed within 60 days of the DAB decision. 15