Monthly Archives: May 2019

Medicare TPE Audits: A Wolf in Sheep’s Clothing

Let’s talk targeted probe-and-educate (TPE) audits. See on RACMonitor as well.

TPE audits have turned out to be “wolf audits” in sheep’s clothing. The Centers for Medicare & Medicaid Services (CMS) asserted that the intent of TPE audits is to reduce provider burden and appeals by combining medical review with provider education.

But the “education” portion is getting overlooked. Instead, the Medicare Administrative Contractors (MACs) resort to referring healthcare providers to other agencies or contractors for “other possible action,” including audit by a Recovery Audit Contractor (RAC), which can include extrapolation or referral to the U.S. Department of Health and Human Services (HHS) Office of Inspector General (OIG) for investigation of fraud. A TPE audit involves up to three rounds of review, conducted by a MAC. Once Congress was instructed that RAC audits are not fair, and providers complained that RAC auditors did not help with education, CMS came up with TPE audits – which, supposedly, had more of an educational aspect, and a more fair approach. But in reality, the TPE audits have created an expensive, burdensome, cyclical pattern that, again, can result in RAC audits. The implementation of TPE audits has been just as draconian and subjective as RAC audits. The penalties can be actually worse than those resulting from RAC audits, including termination from the Medicare program. In this article, I want to discuss the appeal process and why it is important to appeal at the first level of audit.

Chapter Three, Section 3.2.5 of the Medicare Program Integrity Manual (MPIM) outlines the requirements for the TPE process, which leaves much of the details within the discretion of the MAC conducting the review. The MACs are afforded too much discretion. Often, they make erroneous decisions, but providers are not pushing back. A recent one-time notification transmittal provides additional instructions to MACs on the TPE process: CMS Transmittal 2239 (Jan. 24, 2019).

Providers are selected for TPE audit based on data analysis, with CMS instructing MACs to target providers with high denial rates or claim activity that the contractor deems unusual, in comparison to peers. These audits are generally performed as a prepayment review of claims for a specific item or service, though relevant CMS instructions also allow for post-payment TPE audits.

A TPE round typically involves a review of a probe sample of between 20 and 40 claims. Providers first receive notice that they have been targeted by their MAC, followed by additional documentation requests (ADRs) for the specific claims included in the audit.

TPE Audits

The MACs have sole discretion as to which providers to target, whether claims meet coverage requirements, what error rate is considered compliant, and when a provider should be removed from TPE. Health care providers can be exposed to future audits and penalties based merely on the MAC’s resolve, and before the provider has received due process through their right to challenge claim denials in an independent appeals process. In this way, the MACs’ misinterpretation of the rules and misapplication of coverage requirements can lead to further audits or disciplinary actions, based on an erroneous determination that is later overturned. Similarly, while the educational activities are supposedly meant to assist providers in achieving compliance, in reality, this “education” can force providers to appear to acknowledge error findings with which they may disagree – and which may ultimately be determined to be wrong. Often times, the MACs – for “educational purposes” – require the provider to sign documentation that admits alleged wrongdoing, and the provider signs these documents without legal counsel, and without the understanding that these documents can adversely affect any appeal or future audits.

The MACs have the power, based on CMS directive, to revoke billing privileges based on a determination that “the provider or supplier has a pattern or practice of submitting claims that fail to meet Medicare requirements.” 42 C.F.R. § 424.535(a)(8)(ii). This language shows that TPE audit findings can be used as a basis for a finding of abuse of billing privileges, warranting removal from participation in the Medicare program. CMS guidance also gives the MACs authority to refer providers for potential fraud investigation, based on TPE review findings. It is therefore vital that providers submit documentation in a timely fashion and build a clear record to support their claims and compliance with Medicare requirements.

TPE audits promise further education and training for an unsuccessful audit (unsuccessful according to the MAC, which may constitute a flawed opinion), but most of the training is broad in nature and offered remotely – either over the phone, via web conference, or through the mail, with documentation shared on Google Docs. Only on atypical occasions is there an on-site visit.

Why appeal? It’s expensive, tedious, time-consuming, and emotionally draining. Not only that, but many providers are complaining that the MACs inform them that the TPE audit results are not appealable (TPE audits ARE appealable).

TPE reviews and TPE audit overpayment determinations may be appealed through the Medicare appeals process. The first stage of appeal will be to request a redetermination of the overpayment by the MAC. If the redetermination decision is unfavorable, Medicare providers and suppliers may request an independent review by filing a request for reconsideration with the applicable Qualified Independent Contractor (QIC). If the reconsideration decision is unfavorable, Medicare providers and suppliers are granted the opportunity to present their case in a hearing before an administrative law judge (ALJ). While providers or suppliers who disagree with an ALJ decision may appeal to the Medicare Appeals Council and then seek judicial review in federal district court, it is crucial to obtain experienced healthcare counsel to overturn the overpayment determination during the first three levels of review.

Appealing unfavorable TPE audits results sends a message. Right now, the MACs hold the metaphoric conch shell. The Medicare appeals process allows the provider or supplier to overturn the TPE audit overpayment, and reduces the likelihood of future TPE reviews, other Medicare audits, and disciplinary actions such as suspension of Medicare payments, revocation of Medicare billing privileges, or exclusion from the Medicare program. In instances when a TPE audit identifies potential civil or criminal fraud, it is essential that the Medicare provider or supplier engage experienced healthcare counsel to appeal the Medicare overpayment as the first step in defending its billing practices, and thus mitigating the likelihood of fraud allegations (e.g., False Claims Act actions).

CMS and the MACs maintain that TPEs are in the providers’ best interest because education is included. In actuality, TPEs are wolves in sheep’s clothing, masking true repercussions in a cloak of “education.” The Medicare appeal process is a provider’s best weapon.

HIPAA Penalties on the Rise and New HIPAA Penalties Reduced

HIPAA mandates the privacy of private health care records. HIPAA is a serious issue, both financially and in the risk-management aspect, for health care providers. Providers need to delegate annual funds to the defense of regulatory audits proactively – before the actual adverse action occurs. Because it’s not an “if;” it’s a “when,” when you accept Medicare/caid. In the Medicare/caid world, HIPAA violations can catastrophically render a company dead for an infraction. In the current days of technical, daily advances and allegations of cybersecurity breaches, health care providers must be cognizant of cyber criminals, their intent, their modus operandi, and what personal/company information is valuable to such criminals. The HIPAA statutes are vague and lack detailed explanations as to penalties.

In 2018, the Office for Civil Rights (OCR) issued a record-breaking $28 million in fines for HIPAA violations. The number of health care providers currently under investigation by HHS, in 2019, will be another record-breaking number.

As more and more data is maintained on computer systems, the more and more accessible the information becomes to potential scammers. In 2017, the number of cyber attacks increased exponentially to 5,207. There is actually an itemization as to how many of the attacks were germane to health care; health care breaches accounted for 8.5% of all breaches. 2.3 billion health care records have been exposed. This isn’t new. In 2015, the most healthcare records ever were breached. 113 million healthcare records were exposed that year. Now, in 2019, we may witness an all-time-high.

2019-05-01 -- IMG 2009-2018-healthcare-data-breaches-1

Human error is the number 1 reason for HIPAA violations. Employees gossiping and disclosing private health care information among each other is another culprit, along with social media and lack of training.

The largest individual HIPAA settlement was reached in October 2018, when OCR fined health insurer Anthem $16 million.

The oxymoron is that the government (Medicare/caid) and private payors are pushing for collaborative health care and the sharing of health care records amongst varying providers. Yet the possible HIPAA breaches increase with collaboration.

In April 2019, HHS randomly selected 9 HIPAA-covered entities—a mix of health plans and clearinghouses—for Compliance Reviews. The CMS Division of National Standards, on behalf of HHS, has launched a volunteer Provider Pilot Program to test the compliance review process.

The Trump administration has interpreted HIPAA penalties differently than the Obama administration did. Now HHS will apply a different cumulative annual CMP limit for the four penalties tiers in the Health Information Technology for Economic and Clinical Health (HITECH) Act.

There are four tiers of HIPAA violation severity outlined in the HITECH Act, based on the violator’s level of culpability:

Screen Shot 2019-05-02 at 11.41.11 AM

Under the Obama administration, the annual limit for each tier was $1.5 million.

HIPAA penalties are appealable and with the disparate amount of penalties, it is well worth the time and expense to appeal.