Complete Healthcare Compliance Manual

CMS and OIG Audits

Healthcare entities or individual providers enrolled in Medicare and Medicaid programs may be subject to audits and investigations by the Centers for Medicare and Medicaid Services (CMS) and Office of the Inspector General (OIG). Under the False Claims Act (FCA), civil and criminal liabilities in the form of fines, imprisonment, or both can be imposed for submitting false, fraudulent, or fictitious claims to the federal government.

Healthcare fraud, waste, and abuse is a persistent costly problem for both the federal government and commercial payer. CMS works with state and federal law enforcement agencies such as the OIG to detect and deter fraudulent activity by conducting audits and investigations on Medicare and Medicaid claims. OIG either conduct audits using its internal audit resources or oversees audits done by other agencies. CMS partners with a range of contractors such as CERT, RAC, or unified program integrity contractors to help prevent, detect, and investigate potential fraud.

CERT Audits

Under the Payment Integrity Information Act of 2019 (PIIA),^[4] the CERT program computes national, by contractor, by service, and by provider type improper payment rate on Medicare FFS claims submitted to Part A and B MACs and durable medical equipment MACs (DMACs). Through stratified random sampling, some 50,000 claims are selected for complex medical review to determine whether the claims were paid appropriately under Medicare’s coverage, coding, and billing rules.^[5] If documentation is missing or lacking, medical reviewers reach out to the provider to request additional or supporting documentation. These complex medical reviews are performed by nurses, medical doctors, and certified coders, who perform a thorough review of each claim.

Improper payment rate is calculated by the statistical contractors upon completion of complex record review. It is pertinent to note that the improper payment rate identifies overpayment as well as underpayment, meaning if a claim is deemed underpaid, it will be counted as an error. The improper payment rate is not an indication of fraud but rather an estimate of payment that didn’t meet Medicare’s coverage, coding, and billing policy and rules. The CERT program publishes its Medicare FFS program improper payment rate in HHS’s Agency Financial Report (AFR), which comes out in November of each year.^[6]

TPE Audits

In 2014–2015, MACs began reviewing hospital inpatient and home health status cases and providing education to providers on CMS chosen topic. The medical review included all providers who billed Medicare for that chosen topic under a process known as “Probe and Educate.” The Probe and Educate program was a success for CMS, resulting in significant reduction in billing and denial errors. In 2017, CMS expanded to include all types of Medicare claims, and modified the Probe and Educate program to allow MACs to (i) identify the topic for probe based on CERT or other data analysis procedures, and (ii) target providers that are at higher risk of submitting noncomplaint claims or improper errors—hence the name “Targeted Probe and Educate.”^[7] The TPE program’s goal is to help providers understand their errors and how to correct them through one-on-one education. CMS has determined that the targeted probes, education, and reviews have resulted in improved claim accuracies and reduced claim denials and appeals, ultimately reducing burden off MACs’ and providers’ shoulders.

Either prepayment or post-payment review, the TPE program begins with MAC selecting a topic identified through the CERT report and/or other data analysis techniques. If a provider is chosen for review, MAC will send out a notification letter stating the intent to carry out the probe on the chosen topic and the reason why the provider was selected for review. For prepayment reviews, providers will receive a Notice of Review letter, while for post-payment reviews, providers will receive an Additional Documentation Request (ADR) letter. An entire TPE program is based on three rounds of probe, review, and educate; each round consists of 20 to 40 claims and supporting medical documentation, allowing MACs to establish whether a provider represents a certain risk behavior or not. At the conclusion of the first review, if a provider is deemed compliant, then the provider is not moved to the second review and is not reviewed on that chosen topic for at least one year. If, however, some claims are denied or deemed noncompliant, the provider is invited for a one-on-one education session.^[8] There is, at least, a 45-day gap before the second round of 20–40 claims reviews is performed, allowing the provider to make necessary changes and improve on its processes. If the provider is deemed compliant after the second round of reviews, it is not moved to the third round of reviews and not reviewed on the same topic for at least one year. If, however, the provider fails the second round, it is moved to the third and final round of reviews. A provider that is unable to show improvements after the third round of review is referred to CMS for further actions, which may include 100% prepayment review, referral to a recovery auditor, or extrapolation of overpayment.

MAC Audits

CMS relies on private health insurers—MACs—to process Medicare Part A & B claims and durable medical equipment (DME) claims and handle coverage or payment appeals. Each MAC spans over a defined geographic area known as a jurisdiction, where each jurisdiction includes multistate. There are 12 MACs responsible for processing Part A & B claims, four MACs processing the DME claims, and four MACs processing home health and hospice claims. Part A & B MACs process institutional providers, physicians, practitioners, and suppliers. DME MACs process durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) (see Table 1: MAC—Medicare Part A & B, Table 2: MAC—Durable Medical Equipment, and Table 3: MAC—Home Health and Hospice).^[9]

RAC Audits

RACs are the most notoriously known government auditing agency out there that almost all healthcare facilities have dealt with. No audit or compliance meeting is complete without mentioning RAC targets and RAC activities. Starting out as a pilot program in 2005, Congress permanently expanded and implemented the RAC program nationally to review Medicare Part A & B claims. In 2010, under the Affordable Care Act (ACA), the RAC program was further expanded to also include Medicare Part C (Medicare Advantage) & D (prescription drug) programs.^[11] CMS has awarded Medicare RAC contracts to four contractors (see Table 4: Recovery Audit Contractors).