What Are Coding Compliance Audits and Third-Party Reviews?
Conducting routine medical coding compliance audits help a healthcare provider identify, assess, and mitigate risks and achieve compliance with federal and state laws, policies, and official coding guidelines. Hospitals, health systems, medical practices, ambulance companies, skilled nursing homes, rehabilitation services providers, laboratories, and others involve medical documentation and coding in their daily operations. The accuracy of this complex information is critically important to their organizations, not only because code assignment should accurately reflect underlying patient treatment and procedures, but because it also affects billing accuracy.
Internal Coding Compliance Audits
Internal coding audits are part of proactive risk management in an effective compliance program to periodically check for assurance that medical codes from an official code set are assigned correctly in the medical record, including insurance billing. Such audits should be performed by qualified personnel, including certified coders with appropriate coding credentials. Operational units, such as a health information management department, may conduct such audits as part of quality assurance efforts. The compliance department also periodically performs coding audits as part of independent oversight, although they are performed more often when systemic issues are expected, in response to allegations, or when operational quality assurance efforts are insufficient or weak.
The frequency and scope of such coding audits will depend, among other things, on identified risks and resources. However, at a minimum, coding audits should occur quarterly and validate coding accuracy of assignment in the medical record and on a bill. These audits test that the medical codes assigned and documented in the medical record are based on the underlying medical documentation of patient treatment; medical management necessary; and services, items, and procedures performed at the date of service, service period, or episode of care.
OIG and Third-Party Coding Audit Reviews
Routine internal coding compliance audits can help a provider succinctly handle or potentially avoid a third-party review such as those from the recovery audit contractors (RACs), Targeted Probe and Educate (TPE), Office of Inspector General (OIG), Medicare administrative contractors (MACs), and unified program integrity contractors, to name a few—although most of these contractors go beyond coding reviews and include billing auditing and potential overpayments to federal healthcare program payers.
For example, RACs review claims on a post-payment basis. They detect and correct past improper payments so that Centers for Medicare & Medicaid Services (CMS) and carriers, fiscal intermediaries, and MACs can implement actions that will prevent future improper payments. TPE audits typically involve the review of 20–40 claims per provider/supplier, per item, or per service.[2] Unlike other Medicare audits, providers and suppliers may be subject to up to three rounds of record reviews. After each round, providers/suppliers are offered individualized education based on the results of their reviews. Providers/suppliers are also offered individualized education during a round to more efficiently fix simple problems. Unified program integrity contractors’ (UPICs) primary goal is to investigate instances of suspected fraud, waste, and abuse in Medicare or Medicaid claims. Their focus is investigating fraud and abuse, although they also identify improper payments and conduct overpayment extrapolations.
The OIG Office of Audit Services also conducts audits, either with its own audit resources or by overseeing audit work done by others. These audits are meant to help reduce waste, abuse, and mismanagement and promote economy and efficiency throughout the U.S. Department of Health & Human Services. For example, an ongoing Office of Audit Services auditing focus is a series of hospital compliance audits. Using computer matching, data mining, and other data analysis techniques, the OIG identifies hospital claims it deems at risk for noncompliance with Medicare billing requirements. Data mining of overused codes or unusual coding and billing patterns may trigger such audits, which is why it’s important for providers and suppliers to detect unusual or suspicious coding patterns and coding errors internally.[3] This may involve not only chart review, but also data analysis and compliance review of the National Correct Coding Initiative edits. In other words, knowing and auditing one’s own coding accuracy is critically important to avoiding government scrutiny.
Inpatient Coding and Audits
Coding compliance audits not only result in clean claims submission and establish best coding and documentation practices, but also improve clinical documentation and code capture, which has a direct impact on a provider’s case-mix index (CMI). Hospital or facility coding is divided between inpatient (IP) and outpatient (OP) coding. It is beyond the scope of this article to discuss professional coding, which is used to capture physician care.
IP hospital coding is based on the International Classification of Diseases, Tenth Revision, Clinical Modification (ICD-10-CM) for capturing diagnosis and the International Classification of Diseases, Tenth Revision, Procedure Coding System (ICD-10-PCS) for capturing procedures.[4][5] Both classification systems were adopted under the Health Insurance Portability and Accountability Act and are updated on October 1 of each year.
Inpatient claims are paid a set reimbursement amount based on the selection of diagnosis-related group (DRG) under the inpatient prospective payment system rule. DRG assignment and reimbursements are dependent upon and affected by the selection of principal diagnosis, secondary diagnosis(es), surgical procedure(s), present on admission (POA) indicators, discharge disposition (DD), and admit type sources.[6] While hospitals use Medicare severity DRG (MS-DRG) codes for IP billing, there are other types of codes used for IP services. Inpatient rehabilitation facilities (IRF) use case-mix group codes for billing and skilled nursing facilities use Health Insurance Prospective Payment System codes for billing, for which “clinical assessment data is the basic input.”[7]
RAC, MAC, and third-party payer auditing agencies use Uniform Hospital Discharge Data Set (UHDDS) definitions to review and validate primary diagnosis (PDX) and secondary diagnosis code selection.[8] Presence of secondary diagnosis codes that are either a complication or comorbidity (CC) or a major complication or comorbidity (MCC) indicate patient care that required additional hospital resources such as increased nursing care, monitoring, and extended length of stay (LOS) than an average patient care would routinely require, therefore resulting in additional reimbursement to the healthcare provider.[9]
The enforcement community, including MACs and the OIG, are continuously updating their auditing targets in response to violations and risk areas that they have identified through the Comprehensive Error Rate Testing (CERT) report. The CERT report identifies coding and medical necessity concerns at the national level. For more information on CERT audits, see the “Government Audits” article in the “Revenue Cycle” section of this chapter.
In Table 1. Inpatient Coding and Medical Necessity Auditing Targets are some of the most pressing IP areas of concerns that are at a higher risk for overpayment and improper billing in 2022. These targets are identified by government auditing agencies such as CERT, OIG, and CMS-RAC, and more information can be found at their respective websites.
Table 1. Inpatient Coding and Medical Necessity Auditing Targets
Inpatient 2022 | ||||
---|---|---|---|---|
Target |
DRG or ICD-10 |
Indication |
Coding or Medical Necessity Review |
Reasoning |
Spinal fusion |
DRG: 459, 460 453, 454, 455 471, 472, 473 |
CERT medical necessity error: DRG 459–460: 48.6%; DRG 453–455: 0%; DRG 471–473: 90.5% |
Both |
|
CERT coding error: DRG 459–460: 10.8%; DRG 453–455: 21.7%; DRG 471–473: 0% | ||||
Heart failure |
DRG: 291, 292, 293 |
CERT medical necessity error: 62.4% |
Both |
OIG target—medical necessity: Short stay claims with single MCC |
CERT coding error: 37.6% | ||||
Chest pain |
DRG: 313 |
CERT medical necessity error: 100% |
Both |
Inpatient admission for this low-weighted DRG (LWDRG) is generally not appropriate |
Malnutrition |
ICD10CM: E40–E43 |
OIG target and PEPPER target |
Both |
OIG audit found hospitals overbilled Medicare $1 billion by submitting incorrectly coded claims that lack medical necessity and documentation |
COVID-19 and sepsis |
DRG: 179, 178, 177 |
New OIG target New sequencing guideline on sepsis and COVID-19 |
Both |
Official coding guidelines for a COVID-19 infection that progresses to sepsis; see Section I.C.1.d. Sepsis, Severe Sepsis, and Septic Shock. See also ICD-CM/PCS Coding Clinic, First Quarter ICD-10 2021, page 33, effective with discharges starting January 1, 2021 |
Extensive operating room (OR) procedure unrelated to principal diagnosis |
DRG: 981, 982, 983 |
CERT medical necessity error: 34.3% |
Both |
Complex review of claims where principal diagnosis is unrelated to an extensive OR procedure |
CERT coding error: 52.7% | ||||
Simple pneumonia & pleurisy |
DRG: 193, 194, 195 |
CERT medical necessity error: 55.8% |
Both |
RAC and PEPPER target due to sequencing error |
CERT coding error: 19.1% | ||||
Impella Ventricular Assist Device |
DRG: 003 ICD10PCS: 02HA0QZ– 02HA4RZ, 02PA0QZ– 02PA4RZ, 02WA0QZ –02WAXRZ, 5A02116, 5A0211D, 5A02216, 5A0221D |
High-weighted DRG New coding guideline |
Both |
A ventricular assist device (VAD) is surgically attached to one or both intact ventricles and is used to assist or augment the ability of a damaged or weakened native heart to pump blood. Improvement in the performance of the native heart may allow the device to be removed. The documentation will be reviewed to determine if a left ventricular assist device (LVAD) was placed for a Medicare-covered indication |
Kidney & urinary tract infections |
DRG: 689, 690 |
CERT medical necessity error: 81.4% |
Both |
Claims lacking medical necessity |
CERT coding error: 18.6% |
In the following sections, detailed explanations are provided on how to properly address coding audits (e.g., malnutrition) and medical necessity audits (e.g., total knee replacement). These processes and guidance can be used to identify and improve any coding or medical necessity audits.
Malnutrition Coding Audits
In recent years, the OIG has visited the diagnosis of malnutrition twice, in 2017 and in 2020. In 2017, an OIG review identified that healthcare providers were increasingly coding a specific type of MCC malnutrition known as Kwashiorkor that is rarely found in the United States but generally affects populations in famine-stricken regions.[10] That review resulted in healthcare providers returning millions of dollars to the Medicare trust funds.[11]
More recently, OIG review has shifted attention toward nutritional marasmus (an MCC that codes to E41) and unspecified severe protein-calorie malnutrition (an MCC that codes to E43), alleging that CMS was billed more than a billion dollars for incorrect malnutrition code assignment. Like Kwashiorkor, nutritional marasmus is rarely seen in the United States but is commonly seen in developing, famine-stricken nations. As far as the severe protein-calorie malnutrition code assignment is concerned, if a healthcare provider coded E43 but didn’t provide documentation to support its code assignment based on UHDDS’s definition of secondary code assignment, then the provider should get ready to start returning hundreds or thousands of dollars back to the Medicare trust funds.
To ensure compliance with Medicare payment rule and to meet medical necessity, providers must ensure that registered dietician’s nutrition assessment (such as body mass index, past surgical history, muscle wasting), nutrition intervention (such as enteral or parenteral nutrition, shakes, meal plan), and nutrition goals (such as weight gain interventions, food intake plan) are documented in the medical record.[12] These plans need to be validated by the attending provider who needs to document the diagnosis throughout the medical record, especially in the discharge summary.
The UHDDS’s core elements for reporting malnutrition as a secondary diagnosis are met through documenting clinical evaluation (nutrition assessment), therapeutic treatment (nutrition intervention), and increased nursing care and/or monitoring (nutrition goals and plans). Medicare has no issues reimbursing additional payment to healthcare providers who provide and document extensive patient care in the medical record. However, if providers are lax about capturing all aspects of patient care, then Medicare has no issues rejecting or recouping payment. For now, it looks like the malnutrition review is more of a coding-related review with some medical necessity review aspects involved. Providers need to ensure malnutrition is evaluated and monitored throughout the patient care and consistently documented, from history and physical (H&P) to discharge summary (DS).
Medical Necessity Audits
Medicare, Medicaid, and commercial insurers use medical necessity as a key factor for paying claims for medical services. Section 1862(a)(1)(A) of the Social Security Act directs that Medicare will not cover services that “are not reasonable and necessary for the diagnosis or treatment of illness or injury or to improve the functioning of a malformed body member.”[13] That means the provider’s or supplier’s documentation must “support the medical need for the service rendered. . . . The documentation may include clinical evaluations, physician evaluations, consultations, progress notes, physician’s office records, hospital records, nursing home records, home health agency records, records from other healthcare professionals and test reports. It is maintained by the physician and/or provider.”[14]
Medical necessity audits often fail when medical documentation is simply insufficient or incomplete, or not present at all in the record to substantiate the claim. Payers may define this further; in the words of one MAC, medical necessity means treatments must be:
-
Safe and effective;
-
Not experimental or investigational; and
-
Appropriate, including the duration and frequency in terms of whether the service or item is:
-
Furnished in accordance with accepted standards of medical practice for the diagnosis or treatment of the beneficiary’s condition or to improve the function of a malformed body member;
-
Furnished in a setting appropriate to the beneficiary’s medical needs and condition;
-
Ordered and furnished by qualified personnel; and
-
One that meets, but does not exceed, the beneficiary’s medical need.[15]
-
For any service reported to Medicare, it is expected that the medical documentation clearly demonstrates that the service meets all of the above criteria. All documentation must be maintained in the patient’s medical record and be available to the contractor upon request.
Total knee replacement (TKR) audits are heavily based on medical necessity and documentation review. Effective January 2018, TKRs were removed from Medicare’s IP–only procedures list, allowing healthcare entities to perform TKRs on the IP as well as on the OP side.[16]
Recently, healthcare entities have noticed increased scrutiny and claims denial for TKRs, especially if performed on the IP side. A majority of IP claim denials are not related to coding and instead are due to a lack of medical necessity surrounding the two-midnight rule. Per CMS, a provider’s decision to admit a patient to perform TKR on IP basis is complex but must involve review and documentation of multiple medical risk factors, such as a patient’s history, comorbidities, and/or risk of complications. IP TKR claims must support the two-midnight rule by physician clearly documenting patient needing two or more midnights of hospital care because of patient’s risk of developing intra-operative or postsurgical complications due to medical history. IP TKR claims without significant complication or risk documentation, or claims lacking medical necessity as per local coverage determination (LCD) L36575, providers will have a difficult time challenging or overturning any claims denial or appeal. Per LCD L36575, a TKR surgery is considered medically necessary if it meets the following criteria:
-
Performed due to advanced joint disease demonstrated through radiological imaging such as a magnetic resonance imaging (MRI) and/or computed tomography (CT);
-
Documentation of pain impacting activities of daily living (ADL); and
-
Failure to respond to conservative therapy such as anti-inflammatory medications or supervised physical therapy.[17]
This is not an all-inclusive list, and L36575 should be reviewed for a complete list of criteria LCDs.
Outpatient Coding and Audits
Outpatient coding is based on ICD-10-CM for capturing diagnosis; Current Procedural Terminology (CPT) and Healthcare Common Procedure Coding System (HCPCS) for capturing diagnostic, medical, and surgical services; and modifiers to capture supplemental information.[18] Like IP coding, coders coding OP records must adhere to the ICD-10-CM classification instructions and conventions, official coding guidelines, and for additional guidance and clarification, follow Coding Clinic for ICD-10-CM, Coding Clinic for HCPCS, and CPT Assistant for CPT advice. Under the Outpatient Prospective Payment System (OPPS), healthcare providers are paid for OP services through ambulatory payment classification (APC) system. Unlike the IP DRG payment system where a single DRG determines the payment for an entire IP service, an OP claim may have multiple APCs assigned based on CPT selection and could get paid separately for each APC. APCs group together services with similar clinical intensity, resource utilization, and cost. To ensure correct APC assignment, coders need to be educated and trained on new and updated code changes. OP coders cannot pick up “suspected,” “probable,” or “questionable” diagnoses, but they can and should code a diagnosis to the highest level of certainty.[19]
Medical Necessity Coding Audit Review
Coders should not code “signs and symptoms” if a more definitive diagnosis has been provided by the provider to ensure medical necessity is captured. Time and time again, healthcare providers see their OP claims denied because of lack of medical necessity. Let’s take cataract surgery as an example. RAC has been denying cataract surgical claims by stating medical necessity not met per LCD L37027.[20]
The LCD contains a list of all CPT/HCPCS codes and ICD-10-CM codes that support medical necessity for cataract surgery claims to Medicare. Once you click on L37027, scroll to the “Associated Documents” section to get to “A57196 - Billing and Coding: Cataract Surgery in Adults.” If a claim is submitted without any of the listed ICD-10-CM codes, then the chances of a provider being reimbursed become very slim. So, is it difficult to show medical necessity on a claim? The answer is simply, “no.”
By educating coders and physicians on LCD L37027 and documentation requirements, it is very possible to support medical necessity and compliance with Medicare. A provider may document “patient with type II diabetes” in a cataract-suffering patient, but a coder who lacks understanding of coding guideline “13. Etiology/manifestation convention (‘code first,’ ‘use additional code,’ and ‘in diseases classified elsewhere’ notes)” may not pick the casual relationship between diabetes and cataract and not code E11.36 - Type 2 diabetes mellitus with diabetic cataract.[21] Instead, the coder may code diabetes as E11.9 - Type 2 diabetes mellitus without complication and H26.9 - Unspecified cataract. Neither E11.9 nor H26.9 are part of ICD-10 codes housed under the L37027 LCD. This basic lack of coding guideline knowledge and understanding causes a cataract claim to be submitted with codes that don’t support medical necessity and in return, heighten a provider’s chance of claim denial.
On a more basic level, medical necessity could simply fail if there is no valid physician (signed and dated) order that is required for a procedure or service. Good record-keeping and explaining reasons for the care go a long way toward correct coding and eventually appropriate billing.
In Table 2. Outpatient Coding and Medical Necessity Targets, some of the most commonly denied OP targets by government auditing agencies are captured. RAC has been aggressively pursuing the review of cataract, pacemaker/AICD, and TKR claims and denying payment.
Table 2. Outpatient Coding and Medical Necessity Targets
Outpatient 2022 | ||||
---|---|---|---|---|
Target |
Indication |
CPT/HCPCS |
Coding or Medical Necessity Review |
Reasoning |
Ventricular assist device |
CMS-approved topic for 2022 RAC review |
CPT: 33975 –33983, 33990– 33993 |
Both |
A ventricular assist device (VAD) is surgically attached to one or both intact ventricles and is used to assist or augment the ability of a damaged or weakened native heart to pump blood. Improvement in the performance of the native heart may allow the device to be removed. The documentation will be reviewed to determine whether a left ventricular assist device (LVAD) was placed for a Medicare-covered indication. |
PT/OT |
Noridian TPE error rate 97530: 38% |
CPT: 97110, 97530 |
Both |
Top denial reasons:
|
Post-pay review 97110: 45.48% | ||||
Therapeutic, prophylactic, and diagnostic injections and infusions |
RAC target |
CPT: 96360, 96361 |
Both |
Necessity for administration of hydration should be supported within medical documentation. Routine administration of IV fluids, pre/postoperatively while the patient is NPO, for example, without documentation, supporting signs, and/or symptoms including those of dehydration or fluid loss is not supported as medically necessary.[23] |
Cataract removal |
RAC target |
CPT: 66830, 66840, 66850, 66852, 66920, 66930, 66940, 66982, 66983, 66984 (CERT target) |
Both |
Documentation will be reviewed to determine whether cataract surgery meets Medicare coverage criteria, meets applicable coding guidelines, and/or is medically reasonable and necessary. |
Spinal cord stimulation |
CMS-approved topic for RAC review |
CPT: 63685, 63650, 63655 |
Both |
Spinal cord neurostimulators (SCS) may be covered as therapies for the relief of chronic intractable pain, and medical records will be reviewed to determine whether the implantation of SCS meets Medicare coverage criteria and documentation requirements. |
AICD/Pacemaker |
RAC target |
CPT: 33240, 33241, 33243, 33244, 33249, 33216, 33217 |
Both |
Documentation will be reviewed to determine whether implantable automatic defibrillators meet Medicare coverage criteria, meet applicable coding guidelines, and/or are medically reasonable and necessary. |
Deep brain stimulation |
CMS-approved topic for RAC review |
CPT: 61885, 61886, 95970, 95971, 95972, 95973 |
Both |
Medicare will consider whether the initial placement of deep brain stimulation is reasonable and necessary for the treatment of Parkinson’s disease and essential tremor, under certain conditions. |
Polysomnography |
CMS-approved topic for RAC review |
CPT: 95810, 95811 |
Both |
This review will determine whether polysomnography is reasonable and necessary for the patient’s condition based on the documentation in the medical record. When the documentation does not meet the criteria for the service rendered, or the documentation does not establish the medical necessity for the services, such services will be denied. |
Leadless pacemakers |
RAC target |
CPT: 0387T- 0391T, 33274, 33275, 33207, 33208, 33213, 33214, 33999 |
Both |
The documentation will be reviewed to determine whether the use of a leadless pacemaker meets Medicare coverage guidelines and applicable coding guidelines. |
Intensity-modulated radiation therapy (IMRT) |
Expensive procedure |
CPT: 77301 |
Both |
Payment amounts for the services identified by CPT codes 77014, 77280, 77285, 77290, 77295, 77305 through 77321, 77331, and 77370 are included in the ambulatory payment classification (APC) payment for CPT 77301 (intensity modulated radiotherapy plan, including dose volume histograms for target and critical structure partial tolerance specifications). These codes should not be reported in addition to CPT 77301 when provided prior to, or as part of, the development of the IMRT plan. |
Pulmonary rehab |
RAC target |
HCPCS: G0424 |
Both |
Pulmonary rehabilitation is a physician-supervised program for chronic obstructive pulmonary disease (COPD) and certain other chronic respiratory diseases designed to optimize physical and social performance and autonomy. Medical documentation will be reviewed to determine whether pulmonary rehabilitation is medically reasonable and necessary and meets federal guidelines and Medicare coverage criteria. |
Magnetic Resonance Imaging (MRI) |
CMS-approved topic for RAC review |
CPT: 70540, 70544, 70547, 70551, 70557, 71550, 72141, 72146, 72148, 72195, 73218, 73221, 73718, 73721, 74181 |
Both |
When a more extensive MRI is performed on the same site as a less extensive MRI, the less extensive MRI is bundled into the more extensive MRI. |
CERT improper payment rate: 11.1% | ||||
Arthroscopy limited shoulder debridement |
CMS-approved topic for RAC review |
CPT: 29822, 29805, 29806, 29807, 29819, 29820, 29821, 29823, 29824, 29825, 29827, 29828 |
Coding |
Shoulder arthroscopy procedures include a limited debridement that is not separately payable when another shoulder arthroscopy procedure is billed and paid on the same shoulder for the same day for the same beneficiary at the same encounter. |
Total knee arthroplasty |
CMS-approved topic for RAC review |
CPT: 27445, 27447, 27486, 27487 |
Coding, medical necessity, and documentation review |
The documentation will be reviewed to determine whether a TKA is medically necessary according to the guidelines outlined in the LCDs and local coverage articles (LCAs). |