compliance roi · services rendered aca: duty to repay in 60 days. not for reproduction or...

Not for reproduction or redistribution

How Mitigating Risks Reduces Cost

Nancy J. Beckley, MS, MBA, CHC

Compliance ROI


Not for distribution or reproduction


• Financial– None

• Nonfinancial– None

Disclosures


• Understand why a compliance program is required for therapy practices

• Understand actual responses to noncompliance

• Learn how to develop and implement a practice-specific risk assessment

• Practice risk mitigation through planned monitoring and auditing, communication, education, and training

• Learn measurable metrics for compliance risk mitigation

Learning Goals


Chapter 1

Why Compliance?


• “Any health care entity which does not have a compliance program is ‘institutionally nuts’”– Karen Morrisette, Deputy Chief Criminal Division, Fraud

Section, U.S. Department of Justice

• Balanced Budget Act of 1997– $1500 therapy cap

– “Voluntary” compliance programs

The Therapy Cap and Compliance


Affordable Care Act

• Identified PTs as “moderate risk” to the Medicare program

• Broad compliance program requirements for all health care providers and suppliers

• Providers and suppliers “shall, as a condition of enrollment,” establish a compliance program that contains certain core elements established by HHS in consultation with OIG


• Suspending payments to providers and suppliers based on credible allegations of fraud

• Imposing a temporary enrollment moratorium

• Strengthening and building on current provider enrollment and screening procedures

• Requirements for states to terminate providers from Medicaid/CHIP when terminated by Medicare or other

• Provider compliance programs, now required under the ACA, that will ensure providers are aware of and comply with CMS program requirements

ACA: Stronger Fraud Protections


• Any Medicare provider or supplier who has identified an overpayment must report and return the overpayment within 60 days after the date on which the overpayment was identified, or the date any corresponding cost report was due

• For purposes of the rule, an overpayment is any Medicare funds that a provider or supplier receives in excess of the amount it should have received for actual services rendered

ACA: Duty to Repay in 60 Days


Carrot or the Stick?

Carrot and stick: the use of both reward and punishment to induce cooperation


Metrics: Pivot to Mitigation

• Business metrics– Operational

– Financial

– Marketing

• Clinical metrics– Outcomes

– MIPS

• Human resources– Retention

– Lost days

• Compliance?– Building compliance

dashboard– Working all the metrics

– Ownership?


• Intangible asset of company

• Implied level of compliance and standards of conduct

• Reputational value

• Measuring value– Decrease in damage multiplier

– Value in M and A transaction

The “Goodwill” of Compliance


• Legal mandates for compliance

• Duty to repay

• Carrot or the stick

• The value of compliance

Summary


Chapter 2

Assessing Risk


OIG Compliance Guidance: Risks

• Coding and billing– Services not rendered

or documented

– Double billing

– Misuse of provider number

– Unbundling

– Use of modifiers

– Upcoding

• Reasonable and necessary services

• Documentation quality

• Improper inducements

• Kickbacks

• Self-referrals

• Record retention


• Credentialing “borrowing”

• Billing rules

• Supervision

• Delegation

• Coding

• HIPAA privacy

• HIPAA security

• Discrimination

Fast Forward: Current Risks


• OCR (HIPAA): impermissible disclosure

• Self-disclosure: excluded individual

• Self-disclosure: PTA/OTA TRICARE services

• Whistleblower: PTA supervision

Therapy In the News


Risk: Hiding In Plain Sight

• Regulatory– Credentials– Medical necessity– Supervision– Documentation– Therapy cap– Students

• CMS and MAC– MR/TPE program– LCD– KX modifier profiling– CERT errors– ICD-10 map

• Internal– Monitor findings– Audit findings – EMR issues – HR issues – Billing issues


Risk Assessment Matrix

Seve

rity

of im

pact

1

2

3

4

5

1 2 3 4 5Risk

Like

lihoo

d of

occ

urre

nce

5

4

3

2

1

1 2 3 4 5

Risk


• Exclusion: listed in OIG LEIE “excluded in one, excluded in all” concept

• Heightened scrutiny: refused CIA; entered SA• CIA: settle allegations; agree to obligations• Case closed: no further action• Self-disclosure: “good faith effort” demonstrating effective

compliance program

https://oig.hhs.gov/compliance/corporate-integrity-agreements/risk.asp

OIG Risk Spectrum


• OIG compliance guidance identified risks

• Current risk topics in therapy

• Therapy in the news

• Using a risk matrix

• How the OIG assesses risk

• “Have you made a refund?”

Summary


Chapter 3

Mitigating Risk


Compliance Program Elements

1. Standards, policies, and procedures

2. Compliance program administration

3. Screening and evaluation

4. Communication, education, and training

5. Monitoring, auditing, and reporting

6. Discipline for noncompliance

7. Investigations and remedial measures

https://oig.hhs.gov/compliance/101/files/HCCA-OIG-Resource-Guide.pdf


• Communication– Method to report concerns– Policy on nonretaliation

• Compliance education and training– Fraud, waste, and abuse– HIPAA– Risk areas

• Documentation, coding, and billing

• New hire orientation• Annual compliance education• Remedial training and education

Communication, Education, and Training


Monitoring and Auditing

Monitoring– Based on risk

assessment

– Routine items

– Should be caught concurrently

– Daily checks

– Discharge checks

– Examples?

Auditing– Based on risk

assessment

– Routine audits

– Special audits

– QA/UR: is this audit?

– Chart review: is this audit?

– Examples?


Compliance

High-value targets

Hotline and grapevine

Exclusion monitoring

The usual suspects

Monitor and Audit: Topic Sources


• All hands on deck– Compliance empowerment

• Contemporaneous items: correct immediately– Correcting codes

– Adding modifiers• PTA/OTA: Medicare and TRICARE

– Verifying direct supervision for claim submission• “She was out of the country when the claim was submitted”

Monitor Activities: Samples


Monitor Activities: Samples (cont.)

High-value targets– Scheduling

– Delegation

– Supervision– Credentialing

– Physician contracts

– Upcoding

– Privacy

– Security

– Civil rights


Monitor Activities: Samples (cont.)

The usual suspects– Legible and dated

signatures

– Minutes, minutes, minutes

– Progress/discharge reports?

– Modifiers?

– Proof of medical necessity

– POC certification?

– ABN coded to claim


• Create audit parameters, summarize in audit face sheet– Identify data, records, other information needed; who to

interview?

• Findings: objective and subjective– Interpret findings with respect to future risk– Recommend action steps

• Employee discipline process• Training and education• Duty to repay, report, or refund• Re-audit

• Under “privilege” discussion if appropriate

Audit Activities


• Is there an overpayment?– Potential benefits of self-disclosure

– Potential risks of self-disclosure

• Potential pathways to self-disclosure– CMS: refund

– CMS: SRDP

– OIG: SDP

– DOJ/AUSA

What About Self-Disclosure?


• A voluntary refund when an overpayment has been self-identified – A check is required to be submitted along with the appropriate

form– The check will be applied to the identified overpayments

• “Providers need to be aware that the acceptance of a voluntary refund as repayment for the claims specified in no way affects or limits the rights of the Federal Government, or any of its agencies or agents, to pursue any appropriate criminal, civil, or administrative remedies arising from or relating to these or any other claims.”

https://www.cms.gov/Outreach-and-Education/Medicare-Learning-Network-MLN/MLNMattersArticles/downloads/mm3274.pdf

Voluntary Refunds


Sample Voluntary Refund

• Refund form (non-MSP)• Refund spreadsheet• Reason code for claim adjustment• Don’t forget patient portion and letter• Clerical reopening (follow MAC

instructions)• Check number and date• Reason

– CIA– OIG self-disclosure protocol– Voluntary refund

• Use MAC SS

Reason codes– Billed in error – Duplicate– CPT code change– Corrected DOS– Not our patient(s)– Services not rendered– Modifier add/remove– Insufficient documentation– Patient in HMO– VA not paid– Medical necessity– Patient in SNF

https://med.noridianmedicare.com/documents/10525/2052366/Non-MSP+Voluntary+Checks+Form

ICN Beneficiary Medicare # DOS $ to be Refunded Procdure Code Reason Code

Refer to MAC for specific guidance

Sample non-MSP spreadsheet


Source: CMS: CPI Key Antifraud Activities

CMS Program Integrity

Error

Waste

Abuse

Fraud

Mistake Inefficiencies Bending rules Intentional deception


Evaluation plan of

care

Encounter notes

Progress reports

Medical necessity

Risk and Interdependencies

• Patient care

• Medical necessity

• Documentation

• Practice

• Supervision and delegation

• Coding and billing

Practice

Supervision

Delegation

Coding and billing


• Compliance program elements

• Focus on communication, education, and training

• Monitoring: high-value targets, usual suspects

• Audit activities: tool

• Self-disclosure

• Voluntary refunds

• Risk and interdependencies

Summary


Chapter 4

Scaling Compliance (and Cost)


• Evaluation of Corporate Compliance Programs – Department of Justice, updated June 2020

• Measuring Compliance Program Effectiveness: A Resource Guide – HCCA-OIG Compliance Effectiveness Roundtable (2017)

https://www.justice.gov/criminal-fraud/page/file/937501/downloadhttps://oig.hhs.gov/compliance/101/files/HCCA-OIG-Resource-Guide.pdf

Compliance Program Effectiveness


Sample OIG Report Replica Audit

0

20

40

60

80

100

120

Yes No

Plan of care compliance

2014 audit 2013 audit


Sample Sanctions Screening

0

2000

4000

6000

8000

10000

12000

14000

16000

Jan Feb Mar Apr May June July Aug Sept Oct Nov Dec

Sanctions screening

Number of staff screened Number of hits ruled out


22%

22%

21%

35%

Work stations not secured:monitors not locked ifunattended

PHI/medical records notsecured: not faced down ifunattended

Patient information notdisposed of daily: notplaced in shred bin

Positive reinforcement

Sample HIPAA Physical Rounds Audit


Governing body (owner)

Clinical Operations Admin HR Finance IT

LegalChief

compliance officer

Privacy officer

Security officer

Compliance director(s)

Compliance manager(s)

Compliance “Mature Structure”

$$$ Budget• Staff• Benefits• Education• Certification• Training

Measuring effectiveness• Risk assessment• Program adaptation• Resources• Investigation,

analysis, remediation• Compliance

personnel


Owner(s)

Clinical

PT, OT

PTA OTA

PT and compliance

Admin

Contracting

Marketing

Front office

HR Revenue cycle

Finance

Claims

Compliance Chart Audit Structure

$ Budget• Staff “a few hours”

Measuring effectiveness• Required checklists• Scores?• Feedback?


Owner(s)

Clinical Admin HR Finance

Compliance Committee Structure

$+$ Budget• Time allocation• Education• Certification• Training

Measuring effectiveness• Plan• Metrics• Refunds• Follow-up• Corrections• Communication• Investigations


• Fact: there is money associated with compliance

• Commitment from high-level compliance sponsor– Money value of time in creating value

• Budget (no budget, no compliance)– Expertise development

• Compliance Today Magazine/HCCA membership• Regional and National Compliance Conference

• Compliance LISTSERV (free)

– Allocations of time/talent, and reporting of such

https://www.hcca-info.org/

Cost of Compliance


Cost of Noncompliance

• Errors and mistakes– Wrong billing rule

• Waste– Inefficiencies

• Abuse– Bending rules

• Fraud– Intentional deception

• Errors and mistakes–

• Waste–

• Abuse–

• Fraud–


Mitigating Compliance Risk: Best Practice

2. Detect

3. Correct1. Prevent


• Compliance program effectiveness

• Replicating reviews: measuring baseline, providing education, measuring again

• Compliance program sample structures: one size does not fit all

• Compliance has a cost

• Noncompliance has a greater cost

• Identify the delta for your practice

Summary


Final Thoughts on Compliance ROI


• Compliance Program Guide – https://nancybeckley.com/downloads/compliance-program-

guide/• The Essential Physical Therapy Private Practice Policy and

Procedure Manual – https://nancybeckley.com/downloads/essential-physical-

therapy-private-practice-policy-procedure-manual/ • Compliance Bundle (one and two)

– https://nancybeckley.com/downloads/compliance-bundle-for-private-practice/

• Essential Policies for Telerehabilitation—NEW! – https://nancybeckley.com/downloads/essential-policies-for-

telerehabilitation/

https://nancybeckley.com/store/

Nancy Beckley and Associates: Rehab Compliance Resources


Nancy Beckley and Associates

Training and Education

SERVICES

Audits and Investigations

› External Audit Partner› Investigations and

Audit Representation› Guidance in OIG Audits› M and A due Diligence

› Fraud and Abuse Training› Documentation and Coding › Online Learning Via LMS› Custom Training for Risk

Areas› Onsite Custom Training

Compliance Program› Risk Assessment› Compliance Program› Compliance

Effectiveness› Auditing and

Monitoring› Outsourced

Compliance

NancyBeckley.com

Rehab Compliance firm experienced in:Rehab Compliance Experts

Compliance Program Development

Training

Outsourced Compliance Functions

Corporate Integrity Agreements

OIG Audits

DOJ Investigations

Mergers and Acquisition due Diligence Support


Question and Answer Session

References Compliance ROI: How Mitigating Risk Reduces Cost, Nancy Beckley MS, MBA, CHC

1. Office of the Inspector General: Avoiding Medicare Fraud & Abuse: A Roadmap for Physicians, Washington DC, 2013.

2. Centers for Medicare & Medicaid Services: Medicare Program Integrity Manual (100-08): Baltimore, MD.2020.

3. Centers for Medicare & Medicaid Services: Medicare Benefits Policy Manual (100-02): Baltimore, MD.2020.

4. Centers for Medicare & Medicaid Services: Medicare Claims Processing Manual (100-04): Baltimore, MD.2020.

5. Medicare Learning Network: Medicare Quarterly Provider Compliance Newsletter, various dates.

(Nancy Beckley Articles in Compliance Today and APTA PPS Impact Magazine):

1. Dry needling codes: Compliance implications. Impact, February 2020. 2. I know who you are, and I saw what you did: Social media, your practice, ethics

and laws. Impact, November 2019. 3. Outpatient therapy: Myths and risks. Compliance Today, August 2019. 4. Connecting for advice, and maybe a breach? Facebook grand rounds.

Compliance Today, June 2018. 5. A picture says a thousand words – Be careful what you say; Compliance Today.

December 2017. 6. How can my practice become compliance? Impact, March 2017. 7. Hiding in plain sight: Therapy coding, billing and compliance risk. Impact,

September 2016.

compliance roi · services rendered aca: duty to repay in 60 days. not for reproduction or...

Documents