Category Archives: Health Care Providers and Services

More Covered Health Care Services and More Policing under the Biden Administration!

Happy 55th Medicare! Pres. Biden’s health care policies differ starkly from former Pres. Trump’s. I will discuss some of the key differences. The newest $1.9 trillion COVID bill passed February 27th. President Biden is sending a clear message for health care providers: His agenda includes expanding government-run, health insurance and increase oversight on it. In 2021, Medicare is celebrating its 55th year of providing health insurance. The program was first signed into law in 1965 and began offering coverage in 1966. That first year, 19 million Americans enrolled in Medicare for their health care coverage. As of 2019, more than 61 million Americans were enrolled in the program.

Along with multiple Executive Orders, Pres. Biden is clearly broadening the Affordable Care Act (“ACA”), Medicaid and Medicare programs. Indicating an emphasis on oversight, President Biden chose former California Attorney General Xavier Becerra to lead HHS. Becerra was a prosecutor and plans to bring his prosecutorial efforts to the nation’s health care. President Biden used executive action to reopen enrollment in ACA marketplaces, a step in his broader agenda to bolster the Act with a new optional government health plan.

For example, one of my personal, favorite issues that Pres. Biden will address is parity for Medicare coverage for medically necessary, oral health care. In fact, Medicare coverage extends to the treatment of all microbial infections except for those originating from the teeth or periodontium. There is simply no medical justification for this exclusion, especially in light of the broad agreement among health care providers that such care is integral to the medical management of numerous diseases and medical conditions.

The Biden administration has taken steps to roll back a controversial Trump-era rule that requires Medicaid beneficiaries to work in order to receive coverage. Two weeks ago, CMS sent letters to several states that received approval for a Section 1115 waiver – for Medicaid. CMS said it was beginning a process to determine whether to withdraw the approval. States that received a letter include Arizona, Arkansas, Georgia, Indiana, Nebraska, Ohio, South Carolina, Utah, and Wisconsin. The work requirement waivers that HHS approved at the end of the previous administration’s term may not survive the new presidency.

Post Payment Reviews—Recovery Audit Contractor (“RAC”) audits will increase during the Biden administration. The RAC program was created by the Medicare Prescription Drug, Improvement, and Modernization Act of 2003. As we all know, the RACs are responsible for identifying Medicare overpayments and underpayments and for highlighting common billing errors, trends, and other Medicare payment issues. In addition to collecting overpayments, the data generated from RAC audits allows CMS to make changes to prevent improper payments in the future. The RACs are paid on a contingency fee basis and, therefore, only receive payment when recovery is made. This creates overzealous auditors and, many times, inaccurate findings. In 2010, the Obama administration directed federal agencies to increase the use of auditing programs such as the RACs to help protect the integrity of the Medicare program. The RAC program is relatively low cost and high value for CMS. It is likely that the health care industry will see growth in this area under the Biden administration. To that end, the expansion of audits will not only be RAC auditors, but will include increased oversight by MACs, CERTs, UPICs, etc.

Telehealth audits will be a focus for Pres. Biden. With increased use of telehealth due to COVID, comes increased telehealth fraud, allegedly. On September 30, 2020, the inter-agency National Health Care Take Down Initiative announced that it charged hundreds of defendants ostensibly responsible for—among other things—$4.5 billion in false and fraudulent claims relating to telehealth advertisements and services. Unfortunately for telehealth, bad actors are prevalent and will spur on more and more oversight.

Both government-initiated litigation and qui tam suits appear set for continued growth in 2021. Health care fraud and abuse dominated 2020 federal False Claims Act (“FCA”) recoveries, with almost 85 percent of FCA proceeds derived from HHS. The increase of health care enforcement payouts reflects how important government paid health insurance is in America. Becerra’s incoming team is, in any case, expected to generally ramp up law enforcement activities—both to punish health care fraud and abuse and as an exercise of HHS’s policy-making authorities.

With more than $1 billion of FCA payouts in 2020 derived from federal Anti-Kickback Statute (“AKS”) settlements alone, HHS’s heavy reliance on the FCA because it is a strong statute with “big teeth,” i.e., penalties are harsh. For these same reasons, prosecutors and qui tam relators will likely continue to focus their efforts on AKS enforcement in the Biden administration, despite the recent regulatory carveouts from the AKS and an emerging legal challenge from drug manufacturers.

The individual mandate is back in. The last administration got rid of the individual mandate when former Pres. Trump signed the GOP tax bill into law in 2017. Pres. Biden will bring back the penalty for not being covered under health insurance under his plan. Since the individual mandate currently is not federal law, a Biden campaign official said that he would use a combination of Executive Orders to undo the changes.

In an effort to lower the skyrocketing costs of prescription drugs, Pres. Biden’s plan would repeal existing law that currently bans Medicare from negotiating lower prices with drug manufacturers. He would also limit price increases for all brand, biotech and generic drugs and launch prices for drugs that do not have competition.

Consumers would also be able to buy cheaper priced prescription drugs from other countries, which could help mobilize competition. And Biden would terminate their advertising tax break in an effort to also help lower costs.

In all, the Biden administration is expected to expand health care, medical, oral, and telehealth, while simultaneously policing health care providers for aberrant billing practices. My advice for providers: Be cognizant of your billing practices. You have an opportunity with this administration to increase revenue from government-paid services but do so compliantly.

Premature Recoupment of Medicare Reimbursements Defies Due Process!

Who knows that – regardless your innocence –the government can and will recoup your funds preemptively at the third level of Medicare appeals. This flies in the face of the elements of due process. However, courts have ruled that the redetermination and the reconsideration levels afford the providers enough due process, which entails notice and an opportunity to be heard. I am here to tell you – that is horse manure. The first two levels of a Medicare appeal are hoops to jump through in order to get to an independent tribunal – the administrative law judge (“ALJ”). The odds of winning at the 1st or 2nd level Medicare appeal is next to zilch, although often you can get the alleged amount reduced. The first level is before the same entity that found you owe the money. Auditors are normally not keen on overturning themselves. The second level is little better. The first time that you present to an independent tribunal is at the third level.

Between 2009 and 2014, the number of ALJ appeals increased more than 1,200 percent. And the government recoups all alleged overpayments before you ever get before an ALJ.

In a recent case, Sahara Health Care, Inc. v. Azar, 975 F.3d 523 (5th Cir. 2020), a home health care provider brought an action against Secretary of Department of Health and Human Services (“HHS”) and Administrator for the Centers for Medicare and Medicaid Services (“CMS”), asserting that its statutory and due process rights were violated and that defendants acted ultra vires by recouping approximately $2.4 million in Medicare overpayments without providing a timely ALJ hearing. HHS moved to dismiss, and the provider moved to amend, for a temporary restraining order (“TRO”) and preliminary injunction, and for an expedited hearing.

The case was thrown out, concluding that adequate process had been provided and that defendants had not exceeded statutory authority, and denied provider’s motion for injunctive relief and to amend. The provider appealed and lost again.

What’s the law?

Congress prohibited HHS from recouping payments during the first two stages of administrative review. 42 U.S.C. § 1395ff(f)(2)(A).

If repayment of an overpayment would constitute an “extreme hardship, as determined by the Secretary,” the agency “shall enter into a plan with the provider” for repayment “over a period of at least 60 months but … not longer than 5 years.” 42 U.S.C. § 1395ddd(f)(1)(A). That hardship safety valve has some exceptions that work against insolvent providers. If “the Secretary has reason to believe that the provider of services or supplier may file for bankruptcy or otherwise cease to do business or discontinue participation” in the Medicare program, then the extended repayment plan is off the table. 42 U.S.C. § 1395ddd(f)(1)(C)(i). A provider that ultimately succeeds in overturning an overpayment determination receives the wrongfully recouped payments with interest. 42 U.S.C. § 1395ddd(f)(2)(B). The government’s interest rate is high. If you do have to pay back the alleged overpayment prematurely, the silver lining is that you may receive extra money for your troubles.

The years-long back log, however, may dwindle. The agency has received a funding increase, and currently expects to clear the backlog by 2022. In fact, the Secretary is under a Mandamus Order requiring such a timetable. 

A caveat regarding this grim news. This was in the Fifth Circuit. Other Courts disagree. The Fourth Circuit has held that providers do have property interests in Medicare reimbursements owed for services rendered, which is the correct holding. Of course, you have a property interest in your own money. An allegation of wrongdoing does not erase that property interest. The Fourth Circuit agrees with me.

HIPAA and Football

By Ashley Thomson, Partner at Practus, LLP. A Virtual Law Firm.

On rare occasions a Court can issue an opinion that is so logical and on-point you want to stand up and cheer.  Maybe you’re only cheering if you’re a HIPAA-nerd, like me. My name is Ashley and I work with Knicole. I was the assistant GC for Truman Medical Center for 17 years. As AGC at Truman, I was inundated with so many various issues.

Here’s what got me standing up in my home office as if Patrick Mahomes just threw a pass to Tyreek Hill and the KC Chiefs scored the winning touchdown in the Super Bowl—the 5th Circuit Court of Appeals held that a lost or stolen unencrypted device containing protected health information (“PHI”)[1] does not automatically result in a violation of the HIPAA Disclosure Rule or Encryption Rule. If you want to do your own touchdown dance check out Univ. of Texas M.D. Anderson Cancer Ctr. v. United States Dep’t of Health & Human Servs., No. 19-60226, 2021 WL 127819, at *5 (5th Cir. Jan. 14, 2021).

Unless you’ve spent the last 20 years living under a rock, you are generally aware that HIPAA is a law that protects your health information from public disclosure.  Most people don’t spell it correctly and even less people know what the acronym means.[2]  In 2009, HIPAA was supplemented with the HITECH Act.[3] Together, these laws govern how health care providers handle your medical information and what to do if there is a breach of the information.  HIPAA and HITECH’s implementing regulations (the “Regulations”) require all covered entities[4] “implement a mechanism to encrypt” all PHI that is stored electronically.  45 C.F.R. Section 164.312(a)(2)(iv).  Second, the Regulations prohibit unpermitted disclosure of PHI. 45 C.F.R. Sec. 164.502(a). These two regulations are referred to as the Encryption Rule and the Disclosure Rule respectively. These requirements are enforced by the Department of Health and Human Services (“HHS”) in conjunction with the Office for Civil Rights (“OCR”).

Whew, that was a quick history lesson.  Now, back to the story.

In 2012 and 2013 MD Anderson Cancer Center (“MD Anderson”) had three (3) events happen involving unencrypted devices containing PHI.  First, a laptop was stolen.  Second, a thumb drive was lost during someone’s commute home. Third, a visiting researcher misplaced a thumb drive. Pursuant to the regulations, MD Anderson reported these events to HHS.  

HHS concluded that MD Anderson violated the Regulations and imposed a fine over $4,000,000 (let me spell that out for you. . . FOUR MILLION DOLLARS). 

You may be wondering, what in the world did they violate that would result in such an outrageous fine?  So did MD Anderson!

MD Anderson threw its proverbial, red challenge flag and pursued its appeal rights and ended up, finally, in Federal Court where they succeeded on establishing that the mere loss of unencrypted PHI does not violate the Disclosure Rule and that the Encryption Rule does not require that a covered entity sit down and force each and every person to encrypt their devices.

Let’s look first at the Disclosure Rule. As a general rule, HIPAA prohibits the disclosure of PHI without permission from the patient.[5]  45 C.F.R. Sec. 164.502(a). HIPAA defines disclosure as “the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information.” 45 C.F.R. Sec. 164.103. Prior to reaching the 5th Circuit, MD Anderson had been told the mere fact that the unencrypted laptop and thumb drives were lost or stolen resulted in the conclusion the PHI had been improperly disclosed to someone outside of the covered entity.  Thank goodness, the Court stepped in with the reasonable statement that many of us in the health care field have been saying for years. . . just because a device is lost or stolen doesn’t mean the PHI was improperly disclosed.[6]  “It defies reason to say an entity affirmatively acts to disclose information when someone steals it.” Univ. of Texas M.D. Anderson Cancer Ctr.,2021 WL 127819, at *5.

HHS claimed that it would be difficult for them to enforce the Disclosure Rule if it had to show that the PHI was disclosed to someone outside of the covered entity.  Well, go complain to the referees  HHS “that’s precisely the sort of policy argument that HHS could vet in a rulemaking proceeding. It’s not an acceptable basis for urging us to transmogrify the regulation HHS wrote into a broader one.” Id. And with that, the Court unceremoniously stated the obvious and provided some reason in the rather unreasonable world of HIPAA enforcement.

Next up? The Encryption Rule where HHS argued that MD Anderson’s desire to do more to encrypt their devices was an admission of non-compliance with the regulations.  Not so fast, said the Court.  The rule requires that a covered entity have a mechanism for the encryption PHI not that it implements an iron clad, hacker proof, 100% guaranteed encryption system.  MD Anderson had an encryption mechanism which is enough to satisfy the regulation, even if HHS now “wishes it had written a different” regulation.  Id.at *4.  

I feel like this is the SUPERBOWL of HIPAA decisions. You may not be as excited about this opinion as I was.  That’s ok. . . I’m a HIPAA and privacy nerd and I’m ok with that.  

Let’s hope I have many touchdowns to stand up and celebrate on Sunday!  Go Chiefs!    

The legal fine print: As exciting as this opinion is, please  remember that devices should be encrypted and PHI should be protected to the maximum extent possible.  While this is a great decision, it doesn’t remove the obligation to comply with the Regulations. 


[1] PHI contains 18 different identifiers.  42 C.F.R. § 164.514(a)(2)(i).

[2] It’s the Health Insurance Portability and Accountability Act of 1996. 

[3] HITECH stands for the Health Information Technology for Economic and Clinical Health Act of 2009. 

[4] Later, we can delve into what qualifies as a covered entity. Let’s just all agree that MD Anderson is a covered entity.

[5] This is a very simple overstatement, but it works for the purposes of this article.

[6] Let’s face it, most of these devices are lost or stolen and (1) never found or (2) thrown out as the thieves take what they really wanted . . . cold hard cash or credit cards.  An old janky laptop or a random thumb drive is not at the top of the most wanted list for kleptomaniacs.

RAC Report: PET Scans, Helicopter Transportation, and Hospice, Oh My!

The RACs are on attack! The “COVID Pause Button” on RAC audits has been lifted. The COVID Pause Button has been lifted since August 2020. But never have I ever seen CMS spew out so many new RAC topics in one month of a new year. Happy 2021.

Recovery audit contractors (“RACs”) will soon be auditing positron emission tomography (PET) scans for initial treatment strategy in oncologic conditions for compliance with medical necessity and documentation requirements.

Positron emission tomography (“PET”) scans detect early signs of cancer, heart disease and brain disorders. An injectable radioactive tracer detects diseased cells. A combination PET-CT scan produces 3D images for a more accurate diagnosis.

According to CMS’ RAC audit topics, “(PET) for Initial Treatment Strategy in Oncologic Conditions: Medical Necessity and Documentation Requirements,” will be reviewed as of January 5, 2021. The PET scan audits will be for outpatient hospital and professional service reviews. CMS added additional 2021 audit targets to the approved list:

  1. Air Ambulance: Medical Necessity and Documentation Requirements,[1]. This complex review will be examining rotatory wing (helicopter) aircraft claims to determine if air ambulance transport was reasonable and medically necessary as well as whether or not documentation requirements have been met.
  2. Hospice Continuous Home Care: Medical Necessity and Documentation Requirements,[2] and
  3. Ambulance Transport Subject to SNF Consolidated Billing.[3]

Upcoming HHS secretary Xavier Becerra plans to get his new tenure underway quickly.

In False Claims Act (“FCA”) news, Medicare audits of P-Stim have ramped up across the country. A Spinal Clinic in Texas agreed to pay $330,898 to settle FCA allegations for allegedly billing Medicare improperly for electro-acupuncture device neurostimulators. CMS claims that “Medicare does not reimburse for acupuncture or for acupuncture devices such as P-Stim, nor does Medicare reimburse for P-Stim as a neurostimulator or as implantation of neurostimulator electrodes.”

Finally, is your staff getting medical records to consumers requesting their records quickly enough? Right to access to health records is yet another potential risk for all providers, especially hospitals due to their size. A hospital system agreed to pay $200,000 to settle potential violations of the HIPAA Privacy Rule’s right of access standard. This is HHS Office for Civil Rights’ 14th settlement under its Right of Access Initiative. The first person alleged that she requested medical records in December 2017 and did not receive them until May 2018. In the second complaint, the person asked for an electronic copy of his records in September 2019, and they were not sent until February 2020.

Beware of slow document production as slow document production can lead to penalties. And be on the lookout for the next RAC Report.

Remember, never accept the results of a Medicare or Medicaid audit. It is always too high. Believe me, after 21 years of my legal practice, I have yet to agree with the findings if a Tentative notice of Overpayment by any governmental contracted auditor, whether it is PCG, NGS, the MACs, MCOs, or Program Integrity – in any of our 50 States. That is quite a statement about the general, quality of work of auditors. Remember Teambuilders? How did $12 million become $896.35? See blog.

1  CMS, “0200-Air Ambulance: Medical Necessity and Documentation Requirements,” proposed RAC topic, January 5, 2021, http://go.cms.gov/35Jx1co.
2 CMS, “0201-Hospice Continuous Home Care: Medical Necessity and Documentation Requirements,” proposed RAC topic, January 5, 2021, http://go.cms.gov/3oRUyiY.
3 CMS, “0202- Ambulance Transport Subject to SNF Consolidated Billing,” proposed RAC topic, January 5, 2021, http://go.cms.gov/2LOMEbw.

Medicaid Suspension Lifted Because No Evidence of Intent!

Happy 2021! I bring great news and good tidings. I’m fairly sure that everyone reading is educated in what a preliminary injunction is and how important it can be for a health care provider falsely accused of credible allegations of fraud to lift the mandatory suspension of reimbursements. Finally, over the holidays, a Judge found that an indication of intent is required for an accusation of credible allegations of fraud, unlike past cases in which a mere accusation results in suspensions. 42 CFR §455.23 mandates that a health care provider’s reimbursements be suspended based on “credible allegations of fraud.” Which is a low bar. My client, an oral surgeon, had a disgruntled employee complaint and a baseless PCG audit of $6k. A double threat.

For those who are not in the know: An injunction is an extraordinary legal tool that allows the judge to suspend whatever bad action the government or one of its auditors do.

You have to prove:

  1. Likelihood of success on the merits
  2. Irreparable harm
  3. Balance of equities
  4. Public Interest.

I would guestimate that only 10-20% of requests for TROs and PIs are granted. Last week, we won for the oral surgeon. Everyone can learn from his success. This is how we won. Let me set the stage. We have an oral surgeon who underwent an infamous PCG audit resulting in an alleged $6k overpayment. PCG concurrently sends his data to program integrity, and one month later and without any notice, his reimbursements are suspended based on a “credible allegation of fraud.” Concurrently, he had a disgruntled employee threatening him.

Remember that the bar to demonstrate “credible allegation of fraud” is amazingly low. It is an “indicia of reliability.” An inaccurate PCG audit and a disgruntled employee, in this case, were the catalyst for the oral surgeon’s Medicaid reimbursements. His practice comprised of 80% Medicaid, so the suspension would cause irreparable harm to the practice.

We filed a TRO, PI, and Motion to Stay. The day before Christmas, we had trial.

The Judge ruled that the Department cannot just blindly rely on an anonymous accusation. There has to be some sort of investigation. It is not OK to accept accusations at face value without any sort of independent fact-checking. The Judge created an additional burden for the Department in cases of accusations of fraud that is not present in the regulation. But it is logical and reasonable to expect the Department to explore the accusations. The Judge emphasized that fraud requires intent. He also pointed out that fraud is not defined in the regulations. He emphasized that billing errors are not intentional acts.

The Judge held that, “[i]n light of the large number of Medicaid beneficiaries treated by the Petitioner’s practice, the rarity of the physician’s skills, and the apparent demand for those services, the relatively small amount of money now or formally in controversy, the lack of evidence of actual fraud and the contrary indications, the high probability that good cause exists for not suspending Petitioner’s Medicaid payments, and the near certainty of irreparable harm to the Petitioner if the relief is not granted, a TRO should be granted.”

Even better, the Judge ordered that the surgeon did not have to put up a bond, which is normally required by law. By the stroke of the Judge’s pen, the surgeon could go back to work performing medically necessary services to Medicaid recipients, which, by the way is rare for an oral surgeon to accept Medicaid. This is a success for health care providers. Accusations of fraud should require independent corroboration and evidence of intent.

Goodbye, 2020: New Resolutions for Health Care Providers

By Ashley Thomson. (Knicole Emanuel‘s law partner. See below for a bio).

As 2020 ends and we look forward to starting a new chapter in 2021, we offer you this little nugget of advice—a resolution that sounds deceptively easy—read your mail.  Yes, friends you heard it here first. . . the best thing you can do to protect yourself, your business, your patients, and your loved ones is to read the dang mail.  Email, text messages, real mail, carrier pigeon or messages in a bottle.  READ THEM!  

2020 brought us a lot of curve balls and unexpected events but some of those events could have been avoided had mail been opened and read.

CMS and its third party contractors hold a lot of power in the healthcare world and can cause your practice to come crashing down by hitting send or putting a forever stamp on a letter.  A regular practice of reading your mail can avoid that CMS avalanche of doom. [1]

You may be reading this and thinking, you’ve got to be crazy I always read my mail.  Or perhaps you are thinking, this is the easiest new year’s resolution yet—all I have to do is read the mail.

Don’t be too hasty with your self-confidence. This is a hard practice to establish and an even harder one to maintain.

First, you have to actually read the mail.  All of the mail.  Even the mail you think will contain bad news.  Constitutional due process requires only notice NOT successful notice. If successful notice were required, “then people could evade knowledge, and avoid responsibility for their conduct, by burning notices on receipt—or just leaving them unopened.” See Ho v. Donovan, 569 F.3d 677, 680 (7th Cir. 2009). “Conscious avoidance of information is a form of knowledge.” Id.

Second, you need a policy or procedure regarding the opening and reading of mail.  One client we worked with did not have a system for logging mail once it was received in the office.  Mail was lost.  Deadlines were missed.  Payments from the largest payer were suspended. The cost – too much to print.

It’s like that old Mastercard ad, yes, I’m talking to those of you out there who were around in the late 90s.[2] 

The cost of establishing a policy for logging in mail. . . zero.   

The cost of reading mail. . . zero.

The cost of neglecting your mail, missing deadlines, and losing your practice. . . priceless.

So, as this year ends and you contemplate ways to improve your practice in 2021, please, please, please take our advice and READ YOUR MAIL.


[1]It’s not just CMS that has holds the mailbox power.  Just ask the City of North Charleston, SC.  A motorist’s emailed complaint to the city over injuries sustained in an accident was not forwarded to the insurance carrier resulting in a multi-million dollar default judgement against the city.  See Campbell v. City of North Charleston, 431 S.C. 454,459 (SC Ct. App. 2020) (holding that “the failure to forward an email did not amount to good cause shown for failure to timely file an answer).   

[2] For those of you who have no idea what we are talking about see https://www.aaaa.org/timeline-event/mastercard-mccann-erickson-campaign-never-got-old-priceless/  

Click for past blogs with other helpful tips to avoid Medicare and Medicaid recoupments. medicaidlaw-nc.wordpress.com – Tip #2. 4. 6.

Ashley Thomson brings 20 years of extensive in-house, hospital counsel and law firm experience to our team.  Well-versed in a variety of disciplines, her emphasis is in health care, insurance and compliance, specifically medical malpractice, employment, healthcare and privacy law compliance and defense, including matters involving HIPAA. Ashley has also been heavily involved in risk management, patient safety, corporate governance, contract and policy drafting, negotiations and healthcare management. Prior to joining Practus, Ashley served as Associate General Counsel for Truman Medical Center (TMC) where she oversaw litigation, managed all aspects of their corporate compliance matters, including governmental audits and investigations, cybersecurity issues, HIPAA enforcement, 340B compliance and provider-based billing.  As their Staff Litigation Counsel, she defended and litigated medical malpractice and general liability matters on behalf of the hospital, its employees, physician group and residents. Prior to joining TMC, Ashley was an Associate Attorney for Husch Blackwell.

Ashley is an outdoors woman at heart. When she’s not working, she’s hiking, walking, working in her yard, or playing with her kids. She’s also an avid reader and a football fan especially when she’s watching her favorite team, the Kansas City Chiefs! 

“Credible Allegations of Fraud”: Immediate Medicare Payment Suspension!

If you are accused of Medicare fraud, your Medicare reimbursements will be immediately cut off without any due process or ability to defend yourself against the allegations. If you accept Medicare and Medicaid then you are held to strict regulations, some of which are highly, Draconian in nature without much recourse, legally, for providers. Many, many a provider have gone bankrupt and been forced out of business due to “credible allegations of fraud.” You see, legally, “credible allegations of fraud” is a low standard to meet. The definition of “credible” is “an indicia of reliability.” “Indicia” is defined as “signs, indications, circumstances which tend to show or indicate that something is probable. It is used in the form of “indicia of title,” or “indicia of partnership,” particularly when the “signs” are items like letters, certificates, or other things that one would not have unless the facts were as the possessor claimed. It can be a disgruntled worker. I am sure that none of the listeners here today have ever dealt with a disgruntled employee. Yes, that is sarcasm.

42 CFR § 405.372 is the regulation outlining the requirements for suspending Medicare payments. 42 CFR § 455.23 is the regulation mandating suspension of Medicaid payments upon credible allegations of fraud.

Pursuant to Medicare regulations, CMS must suspend Medicare reimbursements to a healthcare provider “in whole or in part” if it has been “determined that a credible allegation of fraud exists against a provider or supplier.” 42 C.F.R. § 405.371(a)(2). A credible allegation of fraud is “an allegation from any source, including … civil fraud claims cases, and law enforcement investigations.” 42 C.F.R. § 405.370(a). The decision to suspend Medicare payment or continue a payment suspension is made at the discretion of CMS – not the MAC. If you receive a letter from a MAC alleging fraud, be sure to check whether the letter states that the decision was made in collaboration with CMS. The MACs do not have the authority.

The suspension, however, is not indefinite, although the length is normally a year, which is financially devastating. The regulations allow CMS to maintain the suspension until a “legal action is terminated by settlement, judgment, or dismissal, or when the case is closed or dropped because of insufficient evidence to support allegations of fraud.” 42 C.F.R. §§ 405.370(a) and .372(d)(3); see also § 405.371(b)(3)(ii) (CMS may extend the suspension of payment if the Department of Justice submits a written request that “suspension of payments be continued based on the ongoing investigation and anticipated filing of criminal or civil action or both or based on a pending criminal or civil action or both.”).

When you receive a fraud accusation of any type – it is imperative to send it to your counsel. If you opt to litigate the suspension by asking the Court to enjoin the suspension, your first legal obstacle will be to argue that you do not have to exhaust your administrative remedies before appearing for the injunction. Cases have been decided both in the favor of providers and their suspensions have been lifted and against the providers. These cases usually win or lose on the argument that the suspension of reimbursements is an ancillary subject from the actual investigation of fraud. It is a jurisdictional argument.

It is my opinion that the federal regulations that allow for suspension of payments upon credible allegations of fraud need to be revised. Any of you with lobbyists, we need to revise the regulations to require due process – notice and an opportunity to be heard – prior to the government suspending Medicare and Medicaid reimbursements based on a spurious accusation from an anonymous source.

Back in 2015, I am sure that you all recall the case in New Mexico where NM accused 15 BH care provider of credible allegations of fraud. The providers constituted 87.5% of the BH in NM. I was one of the attorneys representing the larger BH cos. Prior to my involvement, all 15 providers requested good cause. All were denied. Lawmakers think that the good cause exception written into the regulation is enough defense for providers. But when the good cause is almost always denied, it isn’t much help. Write to your congress people. Amend the regulations to require due process.

Provider Relief Funds: The Hottest RAC Audit Subject

Reporting the use of PRFs will be an ongoing issue due to the fraud and abuse implications of misusing PRFs.

The federal Provider Relief Fund (PRF) was created under the provisions of the Coronavirus Aid, Relief, and Economic Security (CARES) Act, which was passed to address the economic harm suffered by healthcare providers that have incurred (or will incur) additional expenses and have lost (or will lose) significant revenue as a result of the COVID-19 pandemic. PRF payments have been made from either the “general distribution” tranche or via various “targeted distributions.” PRF payment amounts and whether the providers complied with the terms and conditions will be a hotly contested topic in Recovery Audit Contractor (RAC) and Medicare Administrative Contractor (MAC) audits for years to come. If Centers for Medicare & Medicaid Services (CMS) auditors put out a monthly magazine, like Time, PRF would be on the cover. This will be the hot topic of RAC audits, come Jan. 1, 2021.

The U.S. Department of Health and Human Services (HHS) Office of Inspector General (OIG) will audit Medicare payments made to hospitals for COVID-19 discharges that qualified for the 20-percent add-on payment under the CARES Act, according to a new item on the agency’s work plan.

To use the PRF funding from either the general or targeted distributions, providers must attest to receiving the funds and agree to all terms and conditions. However, what constitutes a “healthcare-related expense” or how to calculate “lost revenue” is not clearly defined. Similarly, how you net healthcare-related expenses toward lost revenue is also vague and undefined. On Nov. 2, HHS issued a clarification to post-payment reporting guidance for PRF funds.

The current guidance, issued Oct. 22, includes a two-step process for providers to report their use of PRF payments. The guidance specifically cites:

  • Healthcare-related expenses attributable to COVID that another source has not reimbursed and is not obligated to reimburse, which may include general and administrative (G&A) or “healthcare-related operating expenses;” and
  • PRF payment amounts not fully expended on healthcare-related expenses attributable to coronavirus are then applied to lost revenues associated with patient care, net of the healthcare-related expenses attributable to coronavirus calculated under the first step. Recipients may apply PRF payments toward lost revenue, up to the amount of the difference between their 2019 and 2020 actual patient care revenue.

HHS’s newest clarification came from its response to a FAQ, in which it said that healthcare-related expenses are no longer netted against the patient care lost revenue amount cited in the second portion. HHS indicated that a revised notice would be posted to remove the “net of the healthcare-related expenses” language in the guidance. Of course, as of now, we have no guidance regarding when this clarification is to be put into place officially. Yet another moving target for auditors.

Anticipate audits of the use of your PRF payments. CMS is choosing a sample of hospitals across the country that have received PRF payments to verify that such expenditures were for healthcare-related expenses. For each audit, OIG will obtain data and interview HHS/PRF program officials to understand how PRF payments were calculated, and then review actual PRF payments for compliance with CARES Act requirements. OIG will also review whether HHS’s controls over PRF payments ensured that payments were calculated correctly and disbursed to eligible providers.

Audits will also focus on how providers initially applied to receive PRFs, including calculations utilized and how COVID-19 patients are defined. When each hospital ceased netting expenses against lost revenue will now be another hot topic.

Balance billing is another area of interest. The terms and conditions require providers that accept the PRFs not to collect out-of-pocket payments from patients for all care for a presumptive or actual case of COVID-19 that exceeded what they would pay an in-network provider.

More havoc may ensue with any purchases or sales transactions that occur in the next year or so. Providers will need to know how to navigate compliance risks associated with any accepted or transferred PRFs. Tracking and reporting use of the PRFs will also be an ongoing issue due to the fraud and abuse implications of misusing PRFs, and there is limited guidance regarding how use will be audited. Many questions remain unanswered. Many terms remain undefined.

Programming Note: Knicole Emanuel, Esq. is a permanent panelist on Monitor Mondays. Listen to her RAC Report every Monday at 10 a.m. EST.

Fairness in Medicare: Post Payment Review in the Courts of Equity

As children, we say things are or are not fair. But what is fair? In law, fairness is “tried” in the courts of equity rather than law. Equitable estoppel and the defense of laches are arguments made in the courts of equity. Is it fair if you’ve been billing Medicare for services that you were told by CMS was billable and reimburse-able – for years – then, unexpectantly, CMS says, “Hey, providers, what you were told was reimburse-able, actually is not. In fact, providers, even though you relied on our own guidance, we will cease and desist from paying you going forward AND…we are now going back three years to retroactively collect the money that we should never have paid you…”

How is this fair? Yet, many of you have probably encountered RAC or MAC audits and a post payment review. What I described is a post payment review. Let me give you an example of a nationwide, claw-back by CMS to providers.

On January 29, 2020, CMS announced that beginning March 1, 2020, MACs will reject claims for HCPCS code L8679 submitted without an appropriate HCPCS/CPT surgical procedure code. Claims for HCPCS code L8679 billed with an appropriate HCPCS/CPT surgical code will be suspended for medical review to verify that coverage, coding, and billing rules have been met.

At least according to the announcement, it sounded like CMS instructed the MACs to stop reimbursing L8679 going forward, but I read nothing about going back in time to recoup.

In the last few months, my team has been approached by chiropractors and holistic medical providers who received correspondence from a UPIC and their MACs that they owe hundreds of thousands of dollars for L8679 going back three years prior to CMS’ 2020 announcement to cease using the code.

In this particular instance, many of the providers who had been using the L8679 code did so under the direct guidance of CMS, MACs, and other agents over the years. It becomes a fairness question. Should CMS be able to recoup for claims paid for services rendered when CMS had informed the providers it was the correct code for years?

Another factor to consider is that many of these providers are victims of an intentional scheme to sell devices with the false advice that the devices are covered by Medicare. Litigation has already been filed against the company. In a case filed December 6, 2019, in US District Court of the Eastern District of PA, Neurosurgical Care LLC sued Mark Kaiser and his current company, Doc Solutions LLC, claiming that Kaiser’s company falsely marketed the device as being covered by Medicare. Stivax is a “non-narcotic and minimally invasive form of neurostimulation” which is represented as “one of the only FDA approved microchip controlled microstimulation devices for treating back, joint and arthritic pain.”

Recall that, over the years, CMS paid for these approved procedures with no problem. This situation begins to leave the realm of the courts of law and into the court of equity. It becomes an equitable issue. Is there fairness in Medicare?

There may not be fairness, but there is an administrative appeal process for health care providers! Use it! Request redeterminations!

RAC Audits Expected During the COVID Pandemic

Even though the public health emergency (“PHE”) for the COVID pandemic is scheduled to expire July 24, 2020, all evidence indicates that the PHE will be renewed. I cannot imagine a scenario in which the PHE is not extended, especially with the sudden uptick of COVID.

Center for Medicare and Medicaid Services (CMS) has given guidance that the voluminous number of exceptions that CMS has granted during this period of the PHE may be extended to Dec. 1, 2020. However, there is no indication of the RAC, and MAC audits being suspended until December 2020. In fact, we expect the audits to begin again any day. There will be confusion when audits resume and COVID exceptions are revoked on a rolling basis.

Remember the emergency-room physician whom I spoke about on the June 29 on Monitor Mondays? The physician whose Medicare enrollment was revoked due to a computer error or an error on the part of CMS. What normally would have been an easy fix, because of COVID, became more difficult. Because of COVID, he was unable to work for three months. He is back up and running now. The point is that COVID really messed up so many aspects of our lives.

The extension of PHE, technically, has no bearing on RAC and MAC audits coming back. Word on the street is that RAC and MAC audits are returning August 2020.

This month, July 2020, CMS released, “Coronavirus Disease 2019 (COVID-19) Provider Burden Relief Frequently Asked Questions (FAQs).” (herein afterward referred as “CMS July 2020 FAQs”).

The question was posed to CMS: “Is CMS suspending most Medicare-Fee-for-Service (FFS) medical review during the PHE for the COVID-19 pandemic? The answer is, according to CMS, “As states reopen, and given the importance of medical review activities to CMS’ program integrity efforts, CMS expects to discontinue exercising enforcement discretion beginning on Aug. 3, 2020, regardless of the status of the public health emergency. If selected for review, providers should discuss with their contractor any COVID-19-related hardships they are experiencing that could affect audit response timeliness. CMS notes that all reviews will be conducted in accordance with statutory and regulatory provisions, as well as related billing and coding requirements. Waivers and flexibilities in place at the time of the dates of service of any claims potentially selected for review will also be applied.” See CMS July 2020 FAQs.

Monday, July 13, 2020, we began our fourth “COVID-virtual trial.” The Judges with whom I have had interaction have taken a hard stance to not “force” someone to appear in person. It appears, at least to me, that virtual trials are the wave of the future. This is the guidance that conveys to me that RAC and MAC audits will begin again in August. Virtual audits may even be the best thing that ever happened to RAC and MAC audits. Maybe now the auditors will actually read the documents that the provider gives them.

Another specific issue addressed in the CMS’ July 2020 FAQs is that given the nature of the pandemic and the inability to collect signatures during this time, CMS will not be enforcing the signature requirement. Typically, Part B drugs and certain Durable Medical Equipment (DME) covered by Medicare require proof of delivery and/or a beneficiary’s signature. Suppliers should document in the medical record the appropriate date of delivery and that a signature was not able to be obtained because of COVID-19. This exception may or may not extend until Dec. 31, 2020.

The upshot is that no one really knows how the next few months will unfold in the healthcare industry. Some hospitals and healthcare systems are going under due to COVID. Big and small hospital systems are in financial despair. A RAC or MAC audit hitting in the wake of the COVID pandemic could cripple most providers. I will reiterate my recommendation: In the re-arranged words of Roosevelt, “Speak loudly, and carry a big stick.”

Programming Note: Knicole Emanuel is a permanent panelist on Monitor Mondays. Listen to her live reporting every Monday at 10 a.m. EST.