Fraud & Abuse

Published on: February 13, 2024

The Basics of Stark, AKS, and EKRA

When structuring healthcare arrangements, three major compliance challenges frequently emerge: the Stark Law (officially the Physician Self-Referral Law), the Anti-Kickback Statute (AKS), and the Eliminating Kickbacks in Recovery Act (EKRA). These laws govern referrals to or from a healthcare provider or supplier and carry the risk of severe, sometimes criminal, penalties. Yet, each also offers several exceptions or safe harbors that certain business models might meet. Even a simple arrangement with a healthcare entity can involve complex analysis regarding these three statutes.

The Stark Law (42 U.S.C. 1395nn) prohibits doctors from referring patients to entities providing “designated health services” covered by Medicare or Medicaid if there is a financial relationship between the physician (or their immediate family) and the entity, except under specific exceptions. Financial relationships subject to the Stark Law encompass both compensation and investment interests. Covered services range from clinical labs to physical and occupational therapy, durable medical equipment, certain imaging services, and more. Common exceptions include provisions for in-office ancillary services, fair market value compensation, and legitimate employment relationships. Recently, CMS introduced additional exceptions for value-based arrangements to accommodate evolving healthcare delivery models.

Similarly, the AKS (42 U.S.C. 1320a-7b(b)) criminalizes the exchange of “remuneration” to influence patient referrals or generate business for services billed to federal healthcare programs. “Remuneration” is broadly defined to include any item of value, not just cash. Nonetheless, where conduct implicates the AKS, it may still be lawful if the conduct fits within one of the statute’s “safe harbors,” which cover certain investments, rental agreements, and personal service contracts, among others. Recent updates have also added safe harbors for value-based healthcare arrangements, reflecting the industry’s shift towards this model.

Published on: February 5, 2024

COVID-19 Audits Still an Issue for Providers

by Wachler & Associates, P.C.

Nearly 4 years after the beginning of the COVID-19 pandemic, healthcare providers continue to see payor audits and demands for repayment for services provided during the pandemic, primarily COVID-19 testing and vaccinations. While these services were an essential public function during the pandemic, constantly changing and often unclear rules and regulations governing the coverage of these services have created fertile ground for payors to allege after-the-fact that provider were not entitled to payment.

The issues asserted by payors tend to be systemic; that is, related to the process used by the provider rather than issues related to any unique characteristics of any specific claim. Therefore, these allegations often lead to demands that the provider pay back a significant portion of reimbursements for their COVID-19 services, often in the hundreds of thousands or millions of dollars.

COVID-19 audits tend to focus on a few common issues. Payors may audit providers based on the requirement for an “individualized clinical assessment,” including whether the ordering provider was authorized, whether the order for testing was within the scope of state law, whether the assessment was conducted by telemedicine or by a questionnaire, whether the ordering provider used a standing order, and what rules apply where a state does not or did not require an order for COVID-19 testing. The use of standing orders has become a particular point of contention, especially in cases where the practitioner who issued the standing order did not personally examine patients, was located offsite, or was under contract with and receiving reimbursement from the entity billing for the services.

Published on: February 1, 2024

Enrolled as a Medicare Provider or Supplier? Make Sure PECOS is Current.

by Wachler & Associates, P.C.

Both the Centers for Medicare & Medicaid Services (CMS) and its plethora of contractors rely on the mail to notify providers and suppliers of document requests, audit findings, disciplinary actions, and many other important items. Providers should be careful that their mailing addresses on file with Medicare are current and accurate. Failure to do so can result in the provider not receiving an important piece of correspondence and inadvertently causing significant consequences for the provider.

The Medicare Provider Enrollment, Chain, and Ownership System (PECOS) is the online Medicare enrollment management system. It allows individuals and entities to enroll as Medicare providers or suppliers. When a provider or supplier enrolls in Medicare, it must provide a series of addresses, including a correspondence address, medical review address, and payment address. Whether a provider enrolls online or uses a paper application, once the provider is enrolled, these addresses are stored in PECOS. In PECOS, a provider can check and edit their listed addresses. When CMS or a contractor needs to mail correspondence to the provider, they will look to PECOS for the address to use. As there are multiple address types listed in PECOS, which may list different addresses, the address selected may relate to the purpose of the correspondence, or a contractor may simply choose an address seemingly at random.

Items that may be sent to a provider’s address or addresses listed in PECOS may be Additional Documentation Requests (ADRs), notices of audits, notices of audit findings with appeal rights, and notices of disciplinary proceedings such as Medicare suspensions, revocations, and exclusions. A provider that does not receive one of these because of an incorrect address listed in PECOS may inadvertently fail to provide records, miss an appeal deadline, or otherwise miss the chance to address some action that Medicare takes against them. In general, where correspondence is sent to the address in PECOS, Medicare will assume that it was received and shift the responsibility to the provider to keep PECOS updated. Not receiving such mail can have devastating consequences for the provider and make subsequent appeal or remedials actions much more difficult.

Published on: January 24, 2024

Is the FDA About to Regulate Lab-Developed Tests?

by Wachler & Associates, P.C.

The Food and Drug Administration (FDA) and the Centers for Medicare and Medicaid Services (CMS) recently released a joint statement suggesting that the FDA is about to end its decades-long policy of declining to regulate lab-developed tests (LDTs). The statement casts the policy as outdated and suggests that the FDA is about to impose regulation to treat LDTs with the same approach as all other laboratory tests.

Testing by clinical laboratories is regulated by both the FDA and by the Clinical Laboratory Improvement Amendments (CLIA), as administered by CMS. The FDA regulates medical devices, including in vitro diagnostic products (“IVDs”). The FDA considers LDTs to be IVDs that are intended for clinical use and are designed, manufactured, and used within a single laboratory. CLIA, on the other hand, regulates the laboratory itself and classifies LDTs as “high complexity tests,” with corresponding standards imposed on the laboratory. Importantly, regarding the LDT itself, CLIA generally requires only analytical validation, which can occur after testing has already begun. LDTs may also be subject to more stringent state and private sector oversight.

Historically, the FDA had exercised enforcement discretion and not regulated LTDs, but this began to change in recent decades and accelerated during the COVID-19 pandemic. The pandemic caused an explosion in the need for quick, accurate, and cost-effective means to detect the virus that causes COVID-19. Many clinical labs responded by developing LDTs to detect COVID-19. As LDTs, labs were quickly able to innovate and begin bringing tests for COVID-19 to market. FDA responded by muddying the waters and adding regulatory burden. Initially, the Department of Health and Human Services (HHS), then under the Trump administration, released guidance that, during the public health emergency (PHE), LDTs for COVID-19 would not require pre-market approval. FDA then, in seeming contradiction of HHS, determined that the at-home collection kit of a COVID-19 LDT was distinct from the test itself and subject to FDA regulation. Later in the pandemic, HHS, now under the Biden administration, changed policy again and allowed the FDA to regulate all COVID-19 LDTs.

Published on: January 10, 2024

Michigan Medicaid Reminds Providers of Audit Requirements

by Wachler & Associates, P.C.

The Michigan Medicaid program recently sent a program-wide email to healthcare providers and suppliers reminding them of certain duties under the Michigan Medicaid program. Specifically, the Michigan Department of Health and Human Services (“MDHHS”), which oversees the Michigan Medicaid program, emailed providers that:

“As a reminder, all Medicaid-reimbursed services are subject to review for conformity with accepted medical practice and Medicaid coverage and limitations. The Michigan Department of Health and Human Services (MDHHS) conducts post-payment reviews to verify services, providers, settings, and appropriate billing. Providers must, upon request from authorized agents of the state or federal government, make available for examination and photocopying all medical records, quality assurance documents, financial records, administrative records, and other documents and records that must be maintained. Providers must maintain, in English and a legible manner, written or electronic records necessary to fully disclose and document the extent of services provided to beneficiaries. The records are to be retained for a period of not less than seven years from the date of service, regardless of a change in ownership or termination of participation in Medicaid for any reason.”

Generally, each of these is a basic program requirement applicable to all providers and suppliers who submit claims to the Michigan Medicaid program and are found in state statute, regulation, policy, participation agreement, or other sources.

Published on: December 20, 2023

New Medicare Provider Enrollment Changes for 2024

by Wachler & Associates, P.C.

Recently, the Centers for Medicare & Medicaid Services (CMS) published the calendar year (CY) 2024 physician fee schedule (PFS) final rule, which solidified certain proposed changes to Medicare provider enrollment requirements. The changes discussed below go into effect January 1, 2024.

The final rule expands CMS’s current revocation and denial authorities in two significant ways. First, CMS now has the ability to revoke enrollment if a provider, supplier, or any owner, managing employee or organization, officer, or director has been convicted of a misdemeanor under federal or state law within the previous 10 years that CMS deems detrimental to the best interests of the Medicare program and its beneficiaries. Previously, CMS only had the authority to revoke a provider’s Medicare enrollment in the event of a conviction for certain felonies. CMS has stated that this could include any misdemeanor that, in its judgment, places the Medicare program or its beneficiaries at immediate risk, such as a malpractice suit that results in a conviction of criminal neglect or misconduct.

Second, the final rule expands CMS’s authority to revoke and deny enrollment if a provider, supplier, or any owner, managing employee or organization, officer, or director has had a civil judgment under the False Claims Act (FCA) imposed against them within the previous 10 years. Prior to the CY 2024 final rule, CMS did not have the authority to revoke a provider’s Medicare enrollment solely related to FCA activity. For purposes of this ground for revocation or denial, the term “civil judgment” would not include FCA settlement agreements – the provision requires a judgment against the provider or supplier.

Published on: December 18, 2023

CMS Finalizes CY 2024 Medicare Physician Fee Schedule

by Wachler & Associates, P.C.

The Centers for Medicare & Medicaid Services (CMS) recently issued the final rule for the physician fee schedule (PFS) for calendar year (CY) 2024, which implements new evaluation and management (E/M) policies and solidifies certain existing telehealth policies.

In the final rule, CMS reduced overall payment rates under the PFS by 1.25% in CY 2024 compared to CY 2023. The final CY 2024 PFS conversion factor is $32.74, which is a decrease of $1.15 (or 3.4%) from the current CY 2023 conversion factor of $33.89, representing a decrease in overall pay to physicians.

CMS has also finalized a new payment code to reflect changes in policies regarding evaluation and management (E/M) services. Beginning January 1, 2024, a separate add-on payment for healthcare common procedure coding system (HCPCS) code G2211 is being implemented for billing split (or shared) visits. Split (or shared) E/M visits refer to visits provided in part by physicians and in part by other non-physician practitioners in hospitals and other institutional settings. The new code reflects the resource costs associated with E/M visits for primary care and longitudinal care. Generally, it will be applicable for outpatient and office visits as an additional payment, recognizing the inherent costs involved when clinicians are the continuing focal point for all needed services, or are part of ongoing care related to a patient’s single, serious condition or a complex condition.

Published on: December 7, 2023

HHS OCR Announces First Ransomware Resolution Agreement and Corrective Action Plan

by Wachler & Associates, P.C.

The Department of Health and Human Services (HHS) Office of Civil Rights (OCR) recently entered into a first of its kind resolution agreement and corrective action plan to settle potential HIPAA violations arising out of a ransomware attack. The agreement to settle alleged HIPAA violations was entered into with Doctors’ Management Services (DMS), a practice management company acting as a business associate to several covered entities.

By way of background, in April 2019, OCR opened an investigation based on a breach report from DMS. The report stated that approximately 206,695 individuals were affected when the DMS network server was infected with ransomware. The initial unauthorized access to the network occurred several years prior. However, DMS did not detect the intrusion until late 2018 after ransomware was used to encrypt their files. Based on its investigation, OCR alleged that:

DMS failed to conduct an accurate and thorough risk analysis that assessed technical, physical, and environmental risks and vulnerabilities associated with handling electronic patient health information (ePHI);

Published on: November 28, 2023

Healthcare Providers See Drastic Increase in Medicare Advantage Denials

by Wachler & Associates, P.C.

A recent report published by the Syntellis Performance Solutions and the American Hospital Association demonstrated a shocking 56% increase in Medicare Advantage (MA) claim denials from January 2022 to July 2023. The report was based on an analysis of data from over 1,300 health systems and hospitals, and further showed a 20% increase in commercial payor denials. The findings are especially concerning given that healthcare systems across the U.S. experienced drastic increased in operating expenses over the period, with a nearly 90% increase in maintenance costs, 33% increase in professional fees costs, 24% increase in labor costs, and a 35% increase in utility costs.

The substantial decrease in payments and significant increase in costs has put several health systems in the precarious position of being less equipped to navigate unforeseen market shifts. The serious physician and nursing labor shortage currently seen in the United States compounds the problem even further. Beneficiaries have also seen an increase in MA denials, which has led to increased congressional and regulatory scrutiny.

The increase of MA claim denials has led to increased scrutiny over the use of AI by insurance companies to evaluate claims for denial. A recent class action lawsuit was filed against UnitedHealth Group by MA beneficiaries, who claim the company’s AI algorithm systematically denies elderly patient’s claims. UnitedHealth began using an AI algorithm developed by its subsidiary NaviHealth, known as nH Predict, which the lawsuit alleges is used to “prematurely and in bad faith discontinue payment for healthcare services.”

Published on: November 20, 2023

OIG Issues New General Compliance Program Guidance

by Wachler & Associates, P.C.

In November 2023, the Department of Health and Human Services (HHS) Office of Inspector General (OIG) released its General Compliance Program Guidance (GCPG). This guidance was released as part of OIG’s Modernization Initiative, which seeks to make compliance program guidance more user friendly and accessible. The document does not include new information but instead summarizes existing guidance regarding fraud and abuse risk, serving as an up-to-date comprehensive reference guide for the general healthcare community and industry stakeholders. OIG also noted that in 2024 it will begin publishing industry segment-specific CPGs (ICPGs) which will address compliance measures for industry subsectors.

The GCPG is not legally binding on any individual or entity, but contains valuable information regarding compliance with federal fraud and abuse statutes and regulations. The OIG guidance includes information regarding key fraud and abuse laws, the primary elements of an effective compliance program, program adaptations for small and large entities, other compliance considerations, and OIG resources and processes.

The GCPG begins with an overview of the principal federal fraud and abuse laws including the Anti-Kickback Statute (AKS), the Physician Self-Referral Law (PSL; also known as the “Stark law”), the False Claims Act (FCA), and the Civil Monetary Penalty law (CMP). Their stated goal in summarizing these laws is to “create awareness and provide tools and resources to aid compliance efforts in both preventing violations and identifying potential red flags early with respect to these laws and regulations.”