Medicare Audit and Appeals: Practical Advice on Preparing for and Responding to RAC, ZPIC, and MAC Audits February 2012 Presented by: B. Scott McBride, Esq. Baker & Hostetler LLP smcbride@bakerlaw.com and Anna M. Grizzle, Esq. Bass, Berry & Sims PLC agrizzle@bassberry.com Healthcare providers have recently faced significant scrutiny from claims audits conducted by government contractors, resulting in millions of dollars in recovered overpayments. In today s enforcement environment and with additional resources being devoted to targeting healthcare fraud, providers should expect to see this scrutiny increase in both the numbers and types of claims audits being conducted by contractors with the Centers for Medicare and Medicaid Services ( CMS ). This paper will provide an overview of three common types of claims audits conducted by Medicare contractors that physicians may expect to see and to provide practical advice to providers for preparing for and responding to these audits. I. Overview of Audit Initiatives A. Recovery Audit Contractors ( RACs ) Congress authorized the RAC demonstration in the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA) for the purpose of identifying past inaccurate payments under the Medicare fee-for-service program. 1 CMS selected three Claim RACs and two Medicare Secondary Payer (MSP) RACs for the demonstration. The RAC demonstration program began in California, Florida and New York in 2005 and expanded to include Arizona, Massachusetts and South Carolina in the summer of 2007. Over the course of the three-year demonstration, the RACs identified more than $1.03 billion in improper payments. 2 Program was made permanent under the Tax Relief and 1 Medicare Prescription Drug Improvement and Modernization Act of 2003, Pub. L. 108-173, 117 Stat. 2066 (2003). 2 Ctrs. for Medicare & Medicaid Servs., The Medicare Recovery Audit Contractor (RAC) Program: An Evaluation of the 3-Year Demonstration, (June 2008) available at http://www.cms.hhs.gov/rac/02_expansionstrategy.asp#topofpage. 1
Healthcare Act of 2006. 3 Under the Patient Protection and Affordable Care Act, the RAC program was expanded to Medicare Parts C and D and Medicaid. 4 1. RAC Jurisdictions The RACs and their assigned regions are as follows: Region A Diversified Collection Services, Inc.: Connecticut, Delaware, Washington, D.C., Massachusetts, Maryland, Maine, New Hampshire, New Jersey, New York, Pennsylvania, Rhode Island, and Vermont. Region B CGI Technologies and Solutions, Inc.: Kentucky, Illinois, Indiana, Minnesota, Ohio, and Wisconsin. Region C Connolly Consulting Associates, Inc.: Alabama, Arkansas, Colordao, Florida, Georgia, Louisiana, Mississippi, North Carolina, New Mexico, Oklahoma, South Carolina, Tennessee, Texas, Virginia, and West Virginia. Region D Health Data Insights, Inc.: Alaska, Arizona, California, Iowa, Idaho, Kansas, Missouri, Montana, North Dakota, Nebraska, Nevada, Oregon, South Dakota, Utah, Washington, Wyoming, Guam, American Samoa, and North Marianas. Unlike the other contractors discussed in this paper, the RACs are paid on a contingency fee basis. However, if an overpayment determination is overturned at any level of the appeal process, the RAC must return the contingency fee associated with the overturned determination. 2. RAC Responsibilities The RACs attempt to identify improper payments resulting from incorrect payment amounts, non-covered services, incorrectly coded services and duplicate services issues through the use of software programs that analyze claims data (automated review) and through medical chart reviews (complex review). The RACs are limited to a three-year look back period with a maximum look back date of October 1, 2007. a. Automated Review - An automated review would highlight clearly improper payments such as duplicate surgical procedures. The RAC could perform automated review only when the improper payment was obvious or a written Medicare policy, Medicare 3 Tax Relief and Healthcare Act of 2006, Pub. L. 109-432, 120 Stat. 2922 (2006). 4 Section 6411 of the Patient Protection and Affordable Care Act (Pub. L. 111-148) 2
article or Medicare-sanctioned coding guideline existed and precisely described the coverage conditions. b. Complex Review - On the other hand, in a complex review, a claim may not be clearly erroneous but rather identified as likely containing errors. In that case, the RAC could request medical records from the provider on further review. The RACs are bound by Medicare policies, regulations, national coverage determinations, local coverage determinations and manual instructions when conducting these complex claim reviews. B. Zone Program Integrity Contractors ( ZPICs ) In 2008, CMS began the process of consolidating the scope of all Program Safeguard Contractor (PSC) and Medicare Prescription Drug Integrity Contractor (MEDIC) contracts into ZPIC contracts. The ZPIC contracts include work for all claim types including Part A, Home Health, Hospice, Part B, Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS), Managed Care (Part C), Part D Medicare Prescription Drug, and Medicare and Medicaid Data Matching. Part A cost report audit and reimbursement will also added under the scope of a ZPIC contractor. 1. Zones a. Zone 1 SafeGuard Services, LLC: California, Nevada, American Samoa, Guam, Hawaii, and the Mariana Islands b. Zone 2 NCI, Inc. (previously AdvanceMed): Alaska, Washington, Oregon, Montana, Idaho, Wyoming, Utah, Arizona, North Dakota, South Dakota, Nebraska, Kansas, Iowa and Missouri c. Zone 3 Cahaba Safeguard Administrators, LLC: Minnesota, Wisconsin, Illinois, Indiana, Michigan, Ohio, and Kentucky. d. Zone 4 Health Integrity, LLC: Colorado, New Mexico, Oklahoma, and Texas e. Zone 5 NCI, Inc. (previously AdvanceMed): Alabama, Arkansas, Georgia, Louisiana, Mississippi, North Carolina, South Carolina, Tennessee, Virginia and West Virginia f. Zone 6 Cahaba Safeguard Administrators, LLC: Pennsylvania, New York, Maryland, Washington D.C., Delaware, Maine, Massachusetts, New Jersey, Connecticut, Rhode Island, New Hampshire, and Vermont 3
g. Zone 7 SafeGuard Services, LLC: Florida, Puerto Rico and Virgin Islands. 2. ZPIC Responsibilities ZPICs are expected to perform program integrity functions for Medicare A-D, DME, home health, hospice and the Medi-Medi program. To accomplish this expectation, ZPIC are expected to perform the following tasks: a. Performing data analysis and data mining; b. Conducting medical reviews in support of benefit integrity; c. Supporting law enforcement and answering complaints; d. Investigating fraud and abuse; e. Recommending overpayment recovery through administrative action; and f. Referring cases to law enforcement. 3. ZPIC Audits ZPIC audits can involve a prepay or postpay review of claims and are typically unannounced or with limited notice. ZPIC audits are never random and can arise from proactive data analysis or complaints. In addition to reviewing records, ZPICs also can conduct interviews of providers or beneficiaries. C. Medicare Administrative Contractors ( MACs ) The Medicare Prescription Drug, Improvement and Modernization Act of 2003 5 imposed Medicare fee-for-service contracting reform and directed CMS to replace the Medicare fiscal intermediaries and carriers with Medicare Administrative Contractors ( MACs ). 1. Jurisdictions CMS established fifteen jurisdictions to administer Medicare Parts A and B, which are shown on the following map: 5 Medicare Prescription Drug, Improvement and Modernization Act of 2003 (MMA), Pub. Law 108-173, Subtitle B, Section 911 (42 USC 1395kk-1) 4
CMS also recently announced that it will be consolidating the current 15 A/B MAC jurisdictions to 10 A/B MAC jurisdictions. 6 2. Responsibilities The MACs have assumed the functions previously handled by the fiscal intermediaries and carriers. These responsibilities include: a. Provider enrollment; b. Processing claims; c. Auditing providers; and d. Authority to make Local Coverage Determinations. 3. MAC Audits As noted above, one of the MACs responsibilities is to conduct provider audits. These audits can involve both post-payment and prepayment 6 For additional information on the consolidated jurisdictions, see https://www.cms.gov/medicarecontractingreform/05_partaandpartbmacjurisdictions.asp. 5
reviews. For example, one MAC has recently conducted postpayment audits based upon the results of data analysis identifying physicians whose claims are outliers compared to his or her peers. Physicians with high error rates in these postpayment audits may be subject to prepayment reviews by the MAC or referral to a ZPIC for further review. D. Use of Statistical Sampling for Overpayment Estimation Contractors can use statistical sampling to calculate the overpayment demand following an audit. The use of statistical sampling for overpayment estimation is limited by statute. 1. 42 U.S.C. 1395ddd(f)(3): A Medicare contractor may not use extrapolation to determine overpayment amounts.... unless... [t]here is a sustained or high level of payment error; or [d]ocumented educational intervention has failed to correct the payment error. 2. Sustained or high level of payment error can be determined by: a. Error rate determinations by MR unit, PSC, ZPIC b. Probe samples c. Data analysis d. Provider/supplier history e. Information from law enforcement investigations f. Allegations of wrongdoing by current or former employees of provider or supplier g. Audits or evaluations conducted by the OIG h. Additional Factors to Consider (1) Number of claims in universe; (2) Dollar values associated with claims; (3) Available resources; and (4) Cost effectiveness of expected sampling results. 6
II. Preparing for an Audit Providers should take steps to prepare for Medicare contractor audits. The following are several suggestions to consider A. Establish an interdisciplinary committee Providers may want to establish an internal team to address, review, and respond to record request and payment appeals. The team may need to include personnel from across the institutions, such as Business Office, Medical Records, Compliance, nurses, physicians, and legal counsel. After the team is established, the roles and responsibilities for each team members should be defined. B. Designate an employee as the audit point of contact To ensure that audits are addressed in a timely and consistent manner, providers should designate an employee, such as the compliance officer or administrator, to serve as the point of contact for all audits. This point of contact can coordinate the audit, assist in setting up interviews if requested by the contractor, and contacting the provider s legal counsel as needed. After this point of contact is designated, personnel should be instructed to immediately direct all audit requests to this designated individual. C. Implement an audit intake and tracking process A failure to timely respond to an audit request may result in a denial of the claims being audited. With the increase in audit activity, it is important for providers to have a tracking mechanism to ensure that all audit deadlines are met. For small organizations, the tracking process may be as simple as a spreadsheet. Larger organizations may want to consider developing software or contracting with a vendor to obtain a program designed to manage the intake and tracking of audit requests. D. Develop Audit Policies and Procedures These audit policies and procedures should include the names of contractors so that audit requests can be recognized, the location of records, and the responsibilities of personnel for responding to audits. E. Stay Up to Date on Contractors and Audit Targets F. Conduct Internal Audits to Identify Potential Vulnerabilities and Correct Any Problems With the number of contractors performing proactive data analysis of claims information, providers should expect that one of the contractors will detect any systemic billing problems that the provider may have. Thus, providers should be conducting their own audits to identify any potential billing problems so that the 7
problems can be corrected and any overpayments repaid to avoid becoming an audit target. III. Responding to an Audit When responding to a contractor audit, providers should consider the following: A. Provide Complete Documentation Providers should ensure that complete documentation is provided to the contractor to support the billed services under review. If there is time, providers may want to perform their own internal review of the claims to determine if there are any documentation deficiencies that can be satisfied by gathering additional documentation. The document collection cannot be left solely to clinical personnel who may not be aware of documentation necessary to support claims from a billing perspective. For this reason, the interdisciplinary team, which should include billing personnel, should also be involved in the document production. If records are located offsite or could be located at multiple sites, providers should ensure that documents are gathered from each location that may have relevant information. Providers with both electronic and paper records also should ensure that both types of records are provided. B. Meet All Contractor Deadlines If providers are concerned that it may not have sufficient time to gather all documentation within the established deadline, providers can ask the contractor for additional time to submit records. If additional time is granted, providers should document the extension in writing. If an extension is not possible, providers can request to produce documents on a rolling basis as they are gathered. C. Do Not Sign Statements Certifying Completeness of Records Until It Is Confirmed That All Documents Have Been Provided D. Retain a Copy of All Documents Provided to the Contractor Providers should retain or request a copy of all documents provided to the contractor. After the collection is complete, it is recommended that the provider or legal counsel send a letter to the contractor memorializing the documents collected and persons interviewed during the audit if any issue ever arises regarding how the audit was conducted. 8
IV. Appealing Unfavorable Results A. Medicare Appeals Process Providers who receive an unfavorable audit result from a Medicare contractor have appeal rights provided by regulation. These appeal rights consist of a fivelevel appeals process. 1. Redetermination This first level of appeal is the redetermination stage. At this stage, a provider must submit a redetermination request in writing to the Medicare contractor who processed the claim within 120 calendar days from the receipt of notice of the initial determination. 7 However, providers will have 30 days to submit an appeal for redetermination before Medicare contractors may begin recouping an overpayment. The redetermination request should explain its reasons for disagreeing with the contractor s determination and should include evidence to assist the provider in making the determination. 8 The Medicare contractor generally has 60 calendar days from receipt of the health care provider's request for redetermination to respond. If new evidence is presented during the redetermination level this timeframe may be extended. 2. Reconsideration If the redetermination is unfavorable to the provider, the next level of appeal is the reconsideration stage. The provider must submit its request for reconsideration in writing within 180 calendar days from notice of the redetermination. 9 If the provider requests reconsideration within 60 days, recoupment again is delayed while the second level of the appeal process is underway. Reconsideration "consists of an independent, on-the-record review of an initial determination, including the redetermination and all issues related to payment of the claim" and is adjudicated by Qualified Independent Contractors ("QIC"). 10 7 42 C.F.R. 405.942. The Redetermination Request Form can be accessed at the following link: https://www.cms.gov/cmsforms/downloads/cms20027.pdf 8 42 C.F.R. 405.946. 9 42 C.F.R. 405.962. The Reconsideration Request Form can be accessed at the following link: https://www.cms.gov/cmsforms/downloads/cms20033.pdf. 10 42 C.F.R. 405.968. 9
A significant requirement at the reconsideration stage is the requirement of complete and early presentation of evidence. 11 Failure to submit evidence at the reconsideration stage, including documentation requested in the notice of redetermination, could preclude subsequent consideration of that evidence. 12 Providers must be aware that they could be prevented in later stages of appeal from introducing additional evidence to support their claim, absent a showing of good cause, if not introduced at the reconsideration stage. 13 A QIC generally is required to issue its decision in writing within 60 calendar days of receiving the request for reconsideration, but the timeframe may be extended in certain circumstances. If the QIC is unable to deliver the opinion within the timeframe given, the health care provider has a choice as to wait for the decision to be rendered or escalate the appeal to the third level of the appeals process. 3. Administrative Law Judge ( ALJ ) Hearing Should the provider be dissatisfied with the outcome of the reconsideration, it may file a written request within 60 days of the reconsideration to appeal to an administrative law judge ("ALJ") hearing. 14 Depending on the available technology, the hearing may be conducted by videoconference or by telephone. The provider may request an in-person ALJ hearing, but these requests are granted only upon finding of good cause, generally when there are complex or challenging issues presented. A party may submit new evidence not presented during the early stages of appeal only on a showing of good cause, which determination is committed to the discretion of the ALJ. If the QIC denies the provider's appeal for reconsideration, recoupment may begin immediately after the QIC issues its decision, even if the provider appeals to an ALJ (the third level of the appeal process). The ALJ must issue a decision on the appeal within 90 calendar days of receipt of the hearing request including explanation of any unfavorable findings, unless the timeframe for a decision is extended. The health care provider may choose to involve medical experts to substantiate the provider's position at this level. 11 42 C.F.R. 405.966. 12 Id. 13 Id. 14 42 C.F.R. 405.1002. 10
4. Medicare Appeals Council The fourth level of appeal is the Medicare Appeals Council. A request for a Medicare Appeals Council review must be written and filed within 60 days after the ALJ decision. 15 While there is not a hearing at this level of appeal, the parties will be given an opportunity to file briefs or other written statements. The provider, CMS or the council itself may initiate the appeal at this level. The request must be decided within 90 days of the ALJ decision subject to possible extensions. 5. Federal District Court The fifth level of appeal is judicial review in federal court. A provider has 60 days from receipt of the council decision to file a request for judicial review with the relevant federal district court. 16 B. Practical Tips for Appeals Because of the significant overpayment demands that may result from the contractor audits, providers should be prepared to appeal. 1. Know the Appeal Timelines and Requirements for Each Level As noted above, each appeal level has different timelines and requirements. It is important for providers to understand these differences to ensure that they do not waive any rights. Providers may wish to establish a tracking system for appeal deadlines so that deadlines are not missed. 2. Understand the Reasons for Denial at Each Level of Appeal Providers should carefully review each appeal decision to understand the denial reasons and ensure that these reasons are fully addressed at subsequent levels of appeal. 3. Prepare for Contractor Participation at the ALJ Hearing CMS or contractor representatives may participate in the ALJ hearing. As a participant, the contractors may file position papers or provide testimony on factual or policy issues but cannot call witnesses or be cross-examined at the hearing. 17 15 42 C.F.R. 405.1102. 16 42 C.F.R. 405.1130. 17 42 C.F.R. 405.1010. 11
4. Review EVERY Claim for Possible Appeal When deciding whether to appeal a claims audit result, a provider should critically analyze every claim to determine if the contractor erred in denying or downcoding a claim. This review should consist of both a procedural and substantive review. a. Procedural C. Potential Legal Challenges A provider should determine if the contractor followed the rules established by applicable regulation or Medicare manual in conducting the audit. Additionally, a provider should also determine if the audit contractor applied the appropriate standards in effect at the time of the claim. b. Substantive A substantive analysis of the claims would include such things as reviewing for medical necessity, appropriate coding, appropriate utilization of services. Many providers find that the use of experts, such as a certified coder or physician, is helpful in analyzing the substantive aspects of denied claims. Providers should determine if any of the following legal arguments can be used to challenge the contractor s claims denials: 1. Provider Without Fault (SSA Section 1870) 2. Waiver of Liability (SSA Section 1879(a)) 3. Treating Physician s Rule 4. Reopening Regulations 5. Constitutional Challenges D. Appeal Considerations for Audits Involving Sampling and Extrapolation 1. As noted above, there is no administrative or judicial review of the determination that extrapolation is appropriate under 42 U.S.C. 1395ddd(f)(3). However, this determination must be made prior to the use of extrapolation to calculate the overpayment. A failure of the contractor to document this determination may serve as a basis for appealing the use of extrapolation. 12
2. The failure of a contractor to follow one or more of the Medicare Benefit Integrity Manual does not necessarily affect the validity of the sampling and extrapolation. Providers can challenge the validity of the sampling methodology based on the actual statistical validity of the sample as drawn and conducted. 3. Questions to ask when exploring whether to challenge the validity of the sampling methodology include: a. Is the sample representative? b. Does the sample base represent the sampling frame? c. Do the errors in the sample base represent the errors in the sampling frame? d. Does the sampling frame properly represent the target population to which the sample is being projected? e. Is the sample statistically significant? f. Is the sample size reliable? g. Is the sample within the required precision and confidence levels? 4. In answering these questions, many providers find that engaging a statistician is necessary to determine if a challenge to the statistical sampling and extrapolation is possible. E. Preparing the Appeal Documents A well-organized position paper or brief provides the best opportunity for a provider to explain its reasons for appealing denied claims. The position paper should include references to supporting medical records and other documentation, which can be attached as exhibits to the paper. 13