Medicare

Published on: March 21, 2024

CMS Expands 36-Month Rule to Hospices

Hospice care has become an area of program integrity focus for the Centers for Medicare & Medicaid Services (CMS). Pursuant to that focus, CMS recently expanded the rules and scrutiny that it applies to hospices, including expanding the 36-month rule to apply to hospices.

The 36-month rule is a rule regarding changes of ownership in certain types of Medicare-enrolled entities. If an entity undergoes a change of majority ownership within three years of its initial enrollment in Medicare or within three years of its most recent change of majority ownership, the Medicare provider agreement generally cannot be transferred to the new owner. The new owner is generally required to enroll in Medicare as a new entity, including undergoing all site surveys, accreditations, and other requirements. In the absence of a new enrollment, the new owner will not be permitted to bill under the entity that it just bought. Purchases outside the 36-month window are generally not subject to this rule. Historically, the 36-month rule applied to home health agencies (HHAs). CMS has now expanded it to apply to hospices as well.

Further, CMS has redesignated some hospices as high-risk providers, subject to additional enrollment requirements. CMS classifies provider types based on the perceived risk that the provider type poses to the Medicare program. Hospices are generally in the “moderate risk” category, requiring a site visit on top of the standard enrollment screenings. However, in the recent rule, CMS designated newly-enrolling hospices and those reporting a new owner (5% or more) as part of the “high risk” category. All owners of newly-enrolled hospices and new owners of existing hospices will be required to submit fingerprints for a criminal background check. Note that a new hospice owner may be subject to “high risk” screening without implicating the 36-month rule depending on the nature of the purchase and how much of the ownership interest is transferred. Sales and purchases of Medicare-enrolled entities may also be subject to “change of ownership” or “change of information” requirements, again depending on the nature and amount of the transfer.

Published on: March 12, 2024

Providers Receiving Repayment Demands for Provider Relief Fund Payments

by Wachler & Associates, P.C.

In response to the unprecedented challenges created by the COVID-19 pandemic, the Coronavirus Aid, Relief, and Economic Security (CARES) Act established the Provider Relief Fund (PRF) as an effort to financially support the nation’s healthcare providers as they grappled with COVID-19. To achieve this goal, the Health Resources & Services Administration (HRSA) was tasked with administering the PRF program, and distributed hundreds of thousands of payments from the program’s $178 billion fund to healthcare providers of all types. However, even though providers may have used the PRF funds for permitted COVID-related purposes, many providers are increasingly being demanded to return the money, and being given little to no notice or information as to why.

In the early days of the COVID-19 pandemic, the first batch of disbursements under the PRF program were unsolicited and were deposited directly into providers’ bank accounts without prior application or notice. Providers had to quickly decide whether to return the funds, or to keep the money and agree to abide by the terms and conditions of the PRF program, despite not knowing at the time precisely what those terms were. Many providers that are being subjected to the current rash of repayment demands received PRF funds during the earliest distribution phases.

The repayment demands themselves and the processes available to dispute such demands present an entirely new set of complications and may often give the impression that a provider is being unfairly targeted for performing valuable healthcare services during a public health emergency. As the administrator of the PRF program, HRSA is supposed to initially notify providers of any alleged non-compliance with the PRF program terms and conditions. Usually, this is due to HRSA’s claim that a provider has not submitted the required reporting before the appropriate deadline or within the late reporting timeframe. Notably, providers are increasingly commenting that they are not receiving any notices regarding compliance with the PRF program or reporting requirements, or further, that they are later discovering such notices were sent to the wrong address.

Published on: February 27, 2024

RAC to the Future: AI in Healthcare Audits

by Wachler & Associates, P.C.

Healthcare providers are starting to see the first claims audits based on analysis and determinations made by artificial intelligence (AI). Although the technology is new, many of the issues remain the same. Especially where the companies that develop AI-based audit tools sell these tools and services to commercial insurance companies, AI-driven audits increasingly resemble audits of Medicare providers and suppliers performed by the Recovery Audit Contractors, or RACs.

RACs are Medicare contractors charged by the Centers for Medicare & Medicaid Services (CMS) to identify overpayments and underpayments made to providers and to facilitate return of overpayments to the Medicare Trust Fund. Primarily, RACs accomplish this by conducting audits and issuing repayment demands. RACs are different from other types of Medicare contractors that conduct audits because RACs are paid on a contingency fee. That is, RACs received a percentage of any funds they extract from providers, making them significantly incentivized to deny claims and demand repayment even where there is no clinical or legal basis to do so.

Similarly, because few insurance carriers have developed sophisticated AI tools in house, they often contract outside technology companies to provide the AI audit tools, and often to conduct the audits themselves. These outside contractors are motivated to deny claims and identify alleged overpayments in order to retain the business of the insurance carrier. This motivation is further enhanced where the outside contractor is paid a percentage of the alleged overpayments that their AI tool identifies. Therefore, any provider should carefully scrutinize any such audit findings, much as they would scrutinize the findings of a similarly motivated RAC.

Published on: February 23, 2024

CMS Cautions MA Plans About Use of AI

by Wachler & Associates, P.C.

In the Medicare Advantage (MA) program, overseen by the Centers for Medicare & Medicaid Services (CMS), Medicare Advantage Organizations (MAOs) – typically private insurers – receive monthly payments from CMS. The MAOs then contract with healthcare providers and suppliers to provide services pursuant to multiple MA plans offered by the MAOs. With the rise of artificial intelligence (AI), many providers have expressed concern that MAOs are using AI tools to review claims, make coverage determinations, deny claims, and conduct audits with little to no human oversight.

CMS recently released its 2024 MA Final Rule and a set of accompanying frequently asked questions (FAQs). In these, CMS cautioned MAOs that, while an algorithm or software tool can be used to assist MA plans in making coverage determinations, it remains the responsibility of the MAO to ensure that the algorithm or AI complies with all applicable rules for how coverage determinations by MA organizations are made. CMS emphasized that this included that MAOs make medical necessity determinations based on the circumstances of each specific individual including the patient’s medical history, physician recommendations, and clinical notes; and in line with all fully established Traditional Medicare coverage criteria (including established criteria in applicable Medicare statutes, regulations, National Coverage Determinations (NCDs), or Local Coverage Determinations (LCDs)), or with publicly accessible internal coverage criteria that are based on current evidence in widely used treatment guidelines or clinical literature.

CMS gave several examples of non-compliant use of AI by MAOs, mostly due to a lack of human, clinical oversight of the AI-driven tool and the implementation of its outputs. In an example involving a decision to terminate post-acute care services, CMS noted that an algorithm or software tool can be used to assist providers or MA plans in predicting a potential length of stay, but that prediction alone cannot be used as the basis to terminate post-acute care services. For those services to be terminated in accordance with MA regulations, the patient must no longer meet the level of care requirements needed for the post-acute care at the time the services are being terminated, which can only be determined by re-assessing the individual patient’s condition prior to issuing the notice of termination of services. Additionally, for inpatient admissions, CMS noted that algorithms or AI alone cannot be used as the basis to deny admission or downgrade to an observation stay; the patient’s individual circumstances must be considered against the permissible applicable coverage criteria.

Published on: February 20, 2024

Updates to SMRC Project List

by Wachler & Associates, P.C.

Among the plethora of different contractors used by the Centers for Medicare & Medicaid Services (CMS) to administer the Medicare program is the Supplemental Medical Review Contractor, or SMRC. Like the Medicare Administrative Contractors (MACs), Recovery Audit Contractors (RACs), Unified Program Integrity Contractors (UPICs), and others, the SMRC – of which there is only one at any given time – also audits the claims submitted for reimbursement by Medicare providers and suppliers and issues allegations that providers have received overpayments. Noridian Healthcare Solutions, which is also a MAC, was selected as the SMRC in 2018 and remains the current SMRC.

SMRC audits generally begin with an Additional Documentation Request (ADR), usually in a distinctive green envelope with the Noridian SMRC letterhead or logo. After the provider submits the requested records, the SMRC conducts the review based on the analysis of national claims data, statutory and regulatory coverage, and coding, payment, and billing requirements. The SMRC should eventually issue a Review Results Letter. Providers should be aware that a SMRC review can sometimes last for several months with no intervening correspondence or status updates from the SMRC. Providers who expect, but have not received, a SMRC response should consider carefully checking their Medicare EOBs for activity their MAC may have taken based on the SMRC audit and note any appeal deadlines. Also, providers should be aware that the SMRC is a regional contractor who is allowed to conduct audits nationwide and thus may misunderstand local rules, state laws, or LCDs. SMRC audit findings should generally be carefully scrutinized.

SMRC audit findings also have an additional appeal mechanism available to them. Where the SMRC denies claims, the provider generally has a right to appeal the findings directly to the SMRC and can sometimes request a discussion and education session directly with the SMRC. If the SMRC denies the appeal, it will refer the case to the provider’s local MAC to collect the alleged overpayment or to other government agencies for further action. Where the MAC demands that the provider return an overpayment based on the SMRC’s findings, that demand is subject to the standard Medicare claims appeal process.

Published on: February 13, 2024

The Basics of Stark, AKS, and EKRA

by Wachler & Associates, P.C.

When structuring healthcare arrangements, three major compliance challenges frequently emerge: the Stark Law (officially the Physician Self-Referral Law), the Anti-Kickback Statute (AKS), and the Eliminating Kickbacks in Recovery Act (EKRA). These laws govern referrals to or from a healthcare provider or supplier and carry the risk of severe, sometimes criminal, penalties. Yet, each also offers several exceptions or safe harbors that certain business models might meet. Even a simple arrangement with a healthcare entity can involve complex analysis regarding these three statutes.

The Stark Law (42 U.S.C. 1395nn) prohibits doctors from referring patients to entities providing “designated health services” covered by Medicare or Medicaid if there is a financial relationship between the physician (or their immediate family) and the entity, except under specific exceptions. Financial relationships subject to the Stark Law encompass both compensation and investment interests. Covered services range from clinical labs to physical and occupational therapy, durable medical equipment, certain imaging services, and more. Common exceptions include provisions for in-office ancillary services, fair market value compensation, and legitimate employment relationships. Recently, CMS introduced additional exceptions for value-based arrangements to accommodate evolving healthcare delivery models.

Similarly, the AKS (42 U.S.C. 1320a-7b(b)) criminalizes the exchange of “remuneration” to influence patient referrals or generate business for services billed to federal healthcare programs. “Remuneration” is broadly defined to include any item of value, not just cash. Nonetheless, where conduct implicates the AKS, it may still be lawful if the conduct fits within one of the statute’s “safe harbors,” which cover certain investments, rental agreements, and personal service contracts, among others. Recent updates have also added safe harbors for value-based healthcare arrangements, reflecting the industry’s shift towards this model.

Published on: February 5, 2024

COVID-19 Audits Still an Issue for Providers

by Wachler & Associates, P.C.

Nearly 4 years after the beginning of the COVID-19 pandemic, healthcare providers continue to see payor audits and demands for repayment for services provided during the pandemic, primarily COVID-19 testing and vaccinations. While these services were an essential public function during the pandemic, constantly changing and often unclear rules and regulations governing the coverage of these services have created fertile ground for payors to allege after-the-fact that provider were not entitled to payment.

The issues asserted by payors tend to be systemic; that is, related to the process used by the provider rather than issues related to any unique characteristics of any specific claim. Therefore, these allegations often lead to demands that the provider pay back a significant portion of reimbursements for their COVID-19 services, often in the hundreds of thousands or millions of dollars.

COVID-19 audits tend to focus on a few common issues. Payors may audit providers based on the requirement for an “individualized clinical assessment,” including whether the ordering provider was authorized, whether the order for testing was within the scope of state law, whether the assessment was conducted by telemedicine or by a questionnaire, whether the ordering provider used a standing order, and what rules apply where a state does not or did not require an order for COVID-19 testing. The use of standing orders has become a particular point of contention, especially in cases where the practitioner who issued the standing order did not personally examine patients, was located offsite, or was under contract with and receiving reimbursement from the entity billing for the services.

Published on: February 1, 2024

Enrolled as a Medicare Provider or Supplier? Make Sure PECOS is Current.

by Wachler & Associates, P.C.

Both the Centers for Medicare & Medicaid Services (CMS) and its plethora of contractors rely on the mail to notify providers and suppliers of document requests, audit findings, disciplinary actions, and many other important items. Providers should be careful that their mailing addresses on file with Medicare are current and accurate. Failure to do so can result in the provider not receiving an important piece of correspondence and inadvertently causing significant consequences for the provider.

The Medicare Provider Enrollment, Chain, and Ownership System (PECOS) is the online Medicare enrollment management system. It allows individuals and entities to enroll as Medicare providers or suppliers. When a provider or supplier enrolls in Medicare, it must provide a series of addresses, including a correspondence address, medical review address, and payment address. Whether a provider enrolls online or uses a paper application, once the provider is enrolled, these addresses are stored in PECOS. In PECOS, a provider can check and edit their listed addresses. When CMS or a contractor needs to mail correspondence to the provider, they will look to PECOS for the address to use. As there are multiple address types listed in PECOS, which may list different addresses, the address selected may relate to the purpose of the correspondence, or a contractor may simply choose an address seemingly at random.

Items that may be sent to a provider’s address or addresses listed in PECOS may be Additional Documentation Requests (ADRs), notices of audits, notices of audit findings with appeal rights, and notices of disciplinary proceedings such as Medicare suspensions, revocations, and exclusions. A provider that does not receive one of these because of an incorrect address listed in PECOS may inadvertently fail to provide records, miss an appeal deadline, or otherwise miss the chance to address some action that Medicare takes against them. In general, where correspondence is sent to the address in PECOS, Medicare will assume that it was received and shift the responsibility to the provider to keep PECOS updated. Not receiving such mail can have devastating consequences for the provider and make subsequent appeal or remedials actions much more difficult.

Published on: January 29, 2024

Wound Care Audits on the Rise

by Wachler & Associates, P.C.

Medicare providers who use skin substitutes, allografts, and similar products for wound care are seeing a sharp increase in audits by Medicare contractors. These products often carry high reimbursement rates and require frequent reapplication. Therefore, they are seen by the Medicare program as high risk for improper payments or outright fraud. Providers who use these products or who are subjected to audit should know the consequences of an audit and that there are avenues to respond.

Many of these audits are conducted by Unified Program Integrity Contractors (UPICs), such as CoventBridge group. UPICs are Medicare contractors tasked with auditing providers for suspected fraud in claims submitted to the Medicare or Medicaid programs. Notably, UPICs are quick to deny claims and allege that the provider has committed fraud for any perceived noncompliance with documentation requirements, no matter how minor. A UPIC’s allegation of fraud can nonetheless have serious consequences for a provider, especially when not rebutted, but such allegations may be addressed through the timely appeal of claims denied by the UPIC.

Denial reasons in wound care audits generally include: the specific product was investigational or experimental, conservative treatment was not documented prior to application of the product, there is no documentation regarding why one product was chosen over another product or another course of treatment, the product was reapplied too many times or over too long a period, the patient did not show significant enough improvement to justify continued use, and that the product was not used for a “homologous use.” “Homologous use” is defined by statutes and regulations governing FDA approval for a product and generally means that tissue is used by the patient in the same manner as it was used by the donor. For example, auditors often claim that placental-derived products can only be used as a “wound covering” because the placenta “covers” the fetus, and that “wound healing” is a separate, inappropriate use. Each of these denial reasons can be addressed in the claims appeal process.

Published on: December 20, 2023

New Medicare Provider Enrollment Changes for 2024

by Wachler & Associates, P.C.

Recently, the Centers for Medicare & Medicaid Services (CMS) published the calendar year (CY) 2024 physician fee schedule (PFS) final rule, which solidified certain proposed changes to Medicare provider enrollment requirements. The changes discussed below go into effect January 1, 2024.

The final rule expands CMS’s current revocation and denial authorities in two significant ways. First, CMS now has the ability to revoke enrollment if a provider, supplier, or any owner, managing employee or organization, officer, or director has been convicted of a misdemeanor under federal or state law within the previous 10 years that CMS deems detrimental to the best interests of the Medicare program and its beneficiaries. Previously, CMS only had the authority to revoke a provider’s Medicare enrollment in the event of a conviction for certain felonies. CMS has stated that this could include any misdemeanor that, in its judgment, places the Medicare program or its beneficiaries at immediate risk, such as a malpractice suit that results in a conviction of criminal neglect or misconduct.

Second, the final rule expands CMS’s authority to revoke and deny enrollment if a provider, supplier, or any owner, managing employee or organization, officer, or director has had a civil judgment under the False Claims Act (FCA) imposed against them within the previous 10 years. Prior to the CY 2024 final rule, CMS did not have the authority to revoke a provider’s Medicare enrollment solely related to FCA activity. For purposes of this ground for revocation or denial, the term “civil judgment” would not include FCA settlement agreements – the provision requires a judgment against the provider or supplier.