Internal Reporting System for Compliance Concerns

Setting Up Your Internal Reporting Mechanism

One of the primary elements in a Compliance Program is the creation of a system that permits employees and others to provide information regarding potential compliance issues without fear of retaliation.  In larger organizations, multiple pathways permitting employees to make anonymous complaints should be maintained.  Oftentimes providers use 24 hour compliance “hotlines.”  Online reporting systems or “drop boxes” are also commonly used.  Whatever system is used, it is crucial that employee understand that they are encouraged to provide information and that there is a clear prohibition against others in the organization retaliating against them for providing information.  It should also be made clear to employees that wherever possible the identity of the person providing the information will be kept confidential.

Establish Compliance Reporting Process

The establishment of the compliance reporting process and communication to employees that retaliation will not be tolerated is a central element to an effective compliance program.  Such a system will help the practice obtain valuable information, hopefully early on, before the issue becomes a big problem.  Additionally, the openness of the program will send a strong signal to the outside world, such as government regulators, that the organization takes compliance seriously.

If information is obtained through the hotline system it must be taken seriously.  Certainly not every piece of information will be reflective of a serious compliance problem, and an employee could potentially have other motives for making a compliant.  Regardless, it is crucial that the information be acted upon and that the action be documented.  If the compliance officer concludes that there were alternative motivations for the complaint, that fact should be substantiated and documented.  If an objective investigation indicates that there could be a compliance issue, the matter needs to be pursued through an appropriate outcome.  Depending on the circumstances and the result of a thorough investigation, the outcome could range anywhere from additional training through a self disclosure to the government.

 

Successor Liability and Compliance Due Diligence

Due Diligence of Compliance Issues in Acquisitions

Successor liability issues are a central factor to consider when assessing the scope of compliance due diligence.  The acquiring organization must assess the degree to which it will assume liability for the past obligations of the target company.  If there is no risk that past obligations for compliance issues will be assumed, compliance efforts can at least conceptually be focused on integrative activities rather than assessive activities.  In effect, if there is no risk of successor liabilities, the acquiring organization can focus on the future, at least when it comes to compliance issues.  Of course there is never a perfect world and likewise, there is never a perfectly “clean” deal when it comes to successor liability.  This is particularly true in the health care industry, which has some counteractive rules regarding successor liability.

Normally, if an asset acquisition takes place, the acquiring entity will only assume the liabilities that it expressly assumes or which attach to the assets that it is acquiring.  Normally, the closing process will result in satisfaction of liabilities that might attach to the acquired assets.  Past Medicare liabilities can be an exception to this general rule.  Under Medicare rules, even if the transaction is structured as an asset purchase, all of the past provider’s Medicare liabilities will be passed forward to the acquiring provider.  This is because the Medicare change of ownership rules (sometimes referred to as CHOW rules) provide for the automatic assignment of the past provider’s Medicare provider agreement.  By virtue of the automatic assignment of the provider agreement, the acquiring party is deemed to assume virtually all past Medicare obligations of the target company.

Federal courts have consistently upheld these rules and have held the acquiring organization liable for past obligations.  Federal cases have specifically held acquiring parties for overpayments that were previously paid to the seller and civil penalties arising out of the actions of the seller that occurred before the acquisition.

The outside parameters of successor liability are yet to be tested in the context of recently expanded health care fraud and abuse laws.  Medicare regulations specifically state that the acquiring party does not assume past obligations based on personal fraud.  However, questions still remain whether corporate fraud can be assumed under successor liability theories.  Issues regarding the extent to which liability based on “knowledge-based” statutes, such as the False Claims Act, can be passed on to the acquirer.  Our initial reaction may be that it is not possible to assume responsibility for a knowledge-based violation.  But what about violations that are invoked based on the “reckless disregard” for the truth?  Is it possible that failure to perform reasonable due diligence could be construed as “reckless disregard?”

Medicare rules permit the acquiring organization to specifically reject the provider agreement of the previous entity.  However, there are very specific, time sensitive requirements for effectively rejecting past obligations.  Additionally, rejection will require the acquiring party to obtain independent certification and enter into a new provider agreement.  This process will inevitably result in interruption of revenues to the acquiring party.  This will in turn affect purchase price and other business factors.

Skilled Nursing Facility Compliance Work Plan

Skilled Nursing Facility and Nursing Home Annual Work Plan

The OIG’s 2017 Annual Work Plan identified a few new areas of focus relating to nursing homes and skilled nursing facilities. Nursing home compliance officers should consider these newly identified issues when developing their annual compliance work plan.

Investigation of Serious Nursing Home Conditions

The Work Plan references a 2006 OIG report which found that state agencies failed to investigate in a timely manner some of the most serious complaints regarding nursing home conditions. The report referenced nursing home complaints involving immediate jeopardy and/or actual harm to residents. Complaints that rise to this level of severity are to be investigated by applicable state agencies within a 2 and 10 day timeframe. The Work Plan states that OIG will determine the extent to which State agencies investigate serious nuring home complaints within the required timeframes. Nursing homes can expect this to put more pressure on states that are responsible for these investigations to meet these timeframes on a more regular basis.

Unreported Incidents of Potential Abuse and Neglect

This newly identified topic relates to skilled nursing facilities. The OIG states that is plans to “assess” the incidence of abuse and neglect that occurs in skilled nursing facilities. It then plans to make a determination whether these incidents were properly reported and investigated as required under applicable Federal and state law. It appears that the OIG will be taking a sampled representation of cases to investigate. This conclusion can be garnered from reference in the Work Plan to “sampled” incident reports. The OIG plans to interview state officials to assure that incident reports that are examined under its sampling system were reported as required under law. The OIG plans to go even further and determine whether each reportable incident was investigated and subsequently prosecuted by the state.

This area could create some immediate risk exposure to facilities who are sampled as part of the OIG’s investigation. Facilities who are found to have failed to appropriately report potential abuse and neglect incidents could be subject to sanctions.

Review of SNF Use of Minimum Data Set Tool

the OIG states that it will review documentation of selected Skilled Nursing Facilities to determine whether Minimum Data Set Tool have been properly used to determine the severity of the patient’s condition. SNF reimbursment is tied to the severity of the patient’s condition through application of this tool. Periodic assessments must be performed on each patient by applicable skilled nursing facility. Improper use of the tool results in higher reimbursment than may be justified by the patient’s condition.

This issue was called out by previous OIG studies that indicated higher levels of reimbursement were being paid due to improper use of the Minimum Data Set Tool. Again, this is an area of specific concern for facilities who are lucky enough to be selected for audit by the OIG. If the facility is found to have improperly assessed patient severity, overpayment and potential penalties may be imposed. A finding on a small sample could also lead to expansion past the initially reviewed cases.

 

Compliance Committee Charter Example

COMPLIANCE COMMITTEE  CHARTER – Introduction Example

The Compliance Committee (“Committee”) is an oversight group for clinical compliance issues related to ________________ (the “System”).  The Committee is advisory to both the Compliance Officer of the System and the System Compliance Officer.    The Committee also assists with the Clinical Compliance Program.  The term “compliance” used in this charter refers to adhering to federal, state, and local laws and regulations; System policies; coding and billing rules for third party payors that impact or relate to System services.  The Committee membership represents the hospital services of the Health Care System defined below.

Introduction Only – Remainder of Body of Charter Omitted

 

Yates Memorandum Main Steps and Key Priorities

General Priorities in the Yates Memorandum

  • The Yates Memo prioritizes the manner in which Government civil and criminal law enforcement investigations are conducted.
  • It begins by proclaiming that “One of the most effective ways to combat corporate misconduct is by seeking accountability from the individuals who perpetrated the wrongdoing . . .
  • [accountability] it deters future illegal activity, incentives to changes in corporate behavior . . . and it promotes the public’s confidence in our justice system.”

The Yates Memo identifies six “key steps” to enable DOJ attorneys “to most effectively pursue the individuals responsible for corporate wrongs.”

  • Corporations will be eligible for cooperation credit only if they provide DOJ with “all relevant facts” relating to all individuals responsible for misconduct, regardless of the level of seniority.
  • Criminal and civil DOJ investigations should focus on investigating individuals “from the inception of the investigation.”
  • Criminal and civil DOJ attorneys should be in “routine communication” with each other, including by criminal attorneys notifying civil counterparts “as early as permissible” when conduct giving rise to potential individual civil liability is discovered (and vice versa).
  • Absent extraordinary circumstances, DOJ should not agree to a corporate resolution that provides immunity to potentially culpable individuals.
  • DOJ should have a “clear plan” to resolve open investigations of individuals when the case against the corporation is resolved.
  • Civil attorneys should focus on individuals as well, taking into account issues such as accountability and deterrence in addition to the ability to pay.

Yate Memorandum Compliance Program Impact – Progression of DOJ Pronouncements

Yates Memorandum and Progression of DOJ Pronouncement Memos

The Yates Memo is the latest in a line of similar pronouncements that began in 1999

  • “Bringing Criminal Charges Against Corporations
  • Thompson Memo(2003)
  • McNulty Memo(2006)
  • Filip Memo(2008)
  • U.S. Attorney’s Manual (“USAM”) as the Principles of Federal Prosecution of Business Organizations(USAM § 9-28.000).
  • The “Principles” have been revised to incorporate the Yates Memo’s dictates on individual accountability for corporate wrongdoing.

False Claims Act – Lincolns Law and the Health Care Compliance Industry

Federal False Claims Act – Lincoln’s Law Applied to Health Care

When Congress originally passed the False Claims Act (31 USC §§ 3729-3733), no one had the health care system in mind.  The False Claims Act was also commonly referred to as the “Lincoln Law”.  The original law was focused on unscrupulous vendors who provided overpriced and often faulty supplies to the military during the Civil War.  In modern times, the False Claims Act has been commonly applied when claims are made under Federal health care programs.  The application of the law that ware originally intended to penalize war profiteers leads to draconian results when applied to the health care industry where numerous smaller claims are made by a provider every day.  However, because this law has become a significant source of revenue for the Federal government, we are not likely to see any politicians running to adjust the law to make it consistent with the realities of the modern health care system.

The Lincoln Law was unique in several ways.  The law created “qui tam” rights that permit individuals to bring suit alleging false claims and to retain a portion of the award.  The amount of potential award available to a qui tam claimant depends on whether the government chooses to take over the case after it is brought.  With Federal remedies of nearly $22,000 per claim, potential claimants have a real chance for a payday.  In fact, private litigants are often even more inflexible than the Federal government when it comes to settling a potential fraud claim.

The False Claims Act was strengthened in 1986 in response to some of the much publicized $1,000 toilet seats and other abuses with respect to companies supplying the United States military.  The 1986 amendments to the False Claims Act provided for treble damages plus civil penalties of between $5,000 and $11,000 per claim.  These legislative changes were intended to add real incentive for “qui tam” litigants to bring fraud claims.  Just a few months ago the per claim penalty under the False Claims Act was increased to a minimum of $11,000 and a maximum of nearly $22,000.

The health care industry was never the real target of the False Claims Act.  In fact, when the original “Lincoln Law” was passed in the 1860’s, there was no federal health care program in existence.  From the inception of the False Claims Act through the 1986 amendments, the primary target had been the suppliers to the defense industry.  The defense industry generally makes claims on a monthly or other periodic basis for large amounts of supplies.  Although the 1986 amendments added substantial penalties for making false claims, the impact on the defense industry does not come close to matching the impact on health care providers.

In health care, a single hospital may make hundreds of claims to the federal government per day.  False claim allegations can cover a number of years, greatly increasing the number and value of claims that may be at issue.  When treble damages plus $11,000 to $22,000 per claim are applied on top of the actual amount of a “fraudulent” claim, the obligation amount can become staggering.

When coupled with new regulations that impute False Claims Act liability based on the failure to repay an overpayment, the result can be really quite absurd and greatly disproportionate to the level of culpability involved.   For example, a simple overpayment created by a routine billing error that is not properly identified can result in potential False Claims Act liability in the millions of dollars.  Under new Federal law, failure to repay a known overpayment within 60 days creates a False Claim.  However, actual knowledge is not required.  Identification of the overpayment can be imputed if the provider should have discovered the overpayment.

Even though the False Claims Act was not originally designed to target the health care industry, there does not seem to be any momentum toward mitigating these extreme results.  To the contrary, the government is quite content to leave these disproportionate penalties in place as part of its effort to reduce cost of health care (and to generate additional revenues) by assessing astronomical fines against health care providers and to hold these penalties over their heads to force health care providers to take extreme actions to prevent compliance problems.  The government is taking a “return on investment” approach to health care fraud enforcement.  The False Claims Act allows the government to put its thumb on the scale in the “return on investment” game.  The qui tam provisions provide the government with “quasi agents” who may be disgruntled employees or others who can scout out potential claims, bring them to the governments attention, and take a piece of the financial reward.

Providers have only one real way to reduce the disproportionate impact of the False Claims Act on their operations.  This is to create an effective compliance program that proactively detects problems so they can be addressed and corrected before they create excessive risk.  Compliance programs are an outgrowth of the federal sentencing guidelines that permit reduced corporate penalties for fraud if an “effective” compliance program will actually reduce the risk of a violation occurring or depending because it forces the organization to proactively look for compliance problems and correct them before they become insurmountable.  An effective compliance program will also include regular training to staff which also reduces the risk of compliance problems.

Compliance Policy and Procedures List of Compliance Policies

LIST OF COMPLIANCE-RELATED POLICIES AND PROCEDURES

PROCESS POLICIES AND PROCEDURES

  1. Compliance Program Resolutions
  2. Appointment Of Compliance Officer
  3. Compliance Plan Document – General
  4. Code Of Conduct
  5. Statement Of CEO On Compliance
  6. Statement Of Board Of Directors
  7. Compliance Committee Charter
  8. Uniform Compliance Definitions
  9. Compliance Plan Elements
  10. Compliance Oversight Committee Policy
  11. Compliance Office Staff
  12. Yearly Compliance Program Review
  13. Recommendation Of Additional Policies And Procedures
  14. Amendments To Compliance Policies
  15. Non-Retaliation And Non-Retribution Policy
  16. Excluded Individuals And Entities
  17. Compliance Reporting System
  18. Compliance Hotline
  19. Compliance Training Policy
  20. Compliance Reporting To The Board
  21. Discipline For Compliance Infractions
  22. Compliance As A Performance Factor
  23. External Compliance Investigations
  24. Execution Of Search Warrants
  25. Self-Disclosure And Self-Reporting
  26. Compliance Audits, Monitoring And Self-Assessment

RISK AREA POLICIES AND PROCEDURES

 

Tax – Nonprofit Status

  1. Conflict of Interest Policy
  2. Whistleblower Policy
  3. Board Review of 990 Policy
  4. Joint Venture Policy
  5. Community Need Assessments
  6. Physician Recruitment

Document Control

  1. Contract Review and Execution Policy
  2. Contract Control System Policy
  3. Document Retention Policy
  4. Record Management Policy
  5. Offsite Storage of Records
  6. Destruction of Records
  7. Definition of Medical Records

Discharge and Transfer

  1. Discharge Planning
  2. Transfer to Skilled Nursing Facility
  3. Transfer to Hospice

Admissions

  1. Admission and Continued Stay Review
  2. Readmission Policy
  3. Admissions Through Emergency Room
  4. Plans of Care

Billing and Coding

  1. General Billing and Coding Policy
  2. Requests for Coding Changes and Rebilling
  3. Changes to Patient Records
  4. New and Adjusted Billing Codes
  5. Chargemaster
  6. E&M Coding
  7. Specific Area Coding
    • Anesthesia
    • Radiology
  8. Professional Courtesy

Patient Billing and Collections

  1. Patient Billing and Collection Policies/Guidelines
  2. Billing Inquiries and Audits
  3. Reducing a Patient’s Bill
  4. Waiver of Co-Insurance and Deductibles
  5. Determination of Need and Hardship
  6. Referrals to Collections
  7. Advance Beneficiary Notices
  8. Customer Complaints

Additional Policies

  1. Medical Necessity
  2. Professional Behavior
  3. Disruptive Practitioners
  4. Incident Reporting
  5. Alleged Caregiver Misconduct
  6. Caregiver Background Checks
  7. Never Events
  8. Physician Compensation
  9. Physician Contracting
  10. Medical Directorships
  11. Leases to Referral Sources
  12. Anti-Kickback Policies
  13. Stark Law Policies
  14. Relationship with Pharmaceutical Representatives
  15. Acceptance of Gifts
  16. Confidentiality of Information

EMTALA Policies

  1. Interfacility Transfers
  2. EMTALA Triaging
  3. EMTALA – Financial Information
  4. Refusal of Delay of Medical Services
  5. Emergency Room Coverage
  6. Delineation of Roles in Emergency Department
  7. Emergency Room Trauma Diversion

Employment Policies

  1. Make Consistent with Compliance

Credentialing Policies

 

Medical Information, HIPAA, Etc.

  1. Protection of Patient Health Information
  2. Joint Notice of Privacy Practices
  3. De-Identification of Protected Health Information
  4. Protected Health Information Defined
  5. Proposal and Destruction of Protected Health Information
  6. Breach Reporting Policies
  7. Minimum Necessary Use Policy
  8. Permitted and Required Use of Protected Health Information
  9. Use and Disclosure of Protected Health Information for Treatment, Payment, Operations
  10. Use and Disclosure of Protected Health Information to Family and Others Involved in Care
  11. Authorizations for Use and Disclosure with Forms
  12. Uses and Disclosures Not Requiring Authorization
  13. Uses and Disclosures for Fundraising
  14. Uses and Disclosures for Marketing
  15. Uses and Disclosures for Research Purposes
  16. Recognition of Patient Personal Representatives
  17. Business Associates
  18. Verifying Identity of Persons Requesting Protected Health Information
  19. Patient Right to Access Protected Health Information
  20. Denial of Patient Access to Protected Health Information
  21. Patient Right to Accounting of Protected Health Information Disclosures
  22. Patient Right to Request Designated Record Set
  23. Patient Right to Request Alternative Means of Communication
  24. Patient Right to Request Restrictions on Use of Protected Health Information
  25. Protection of Information Subject to FDA Regulation
  26. Protection of Information Subject to AIDS Related Information
  27. Protection of Mental Health Treatment Records
  28. Psychotherapy Notes
  29. Government Requests, Court Orders, Warrants Covering Protected Health Information

Telemedicine Policies

  1. Provider Licensure and Credentialing
  2. Remote Access Policies
  3. Security Policies
  4. Telehealth Policies and Procedures
  5. Telecommuting Application
  6. Telecommuting Agreement
  7. Telecommuting Equipment
  8. Scheduling Telemedicine Services
  9. Emergency Room Consults
  10. Billing Telemedicine Service
  11. Checklists for Providing Telehealth Services

Technology Policies

  1. Passwords, Domains, Local Servers
  2. Individual Password Protection
  3. Information Security Policies
  4. Information Security Incident Process
  5. Encryption Policies
  6. Physician Access and Restriction Policies
  7. Technology Life Cycle Review Policies
  8. Technology Disposal Policies
  9. Wireless Communication Policy
  10. Technology Inventory System
  11. Acceptable Use of Computer Equipment
  12. Internet Usage Policies
  13. Workstation Security
  14. Use of Portable Devices
  15. E-mail Usage Policies
  16. Blogging Policies
  17. Social Media Policies
  18. Firewall Policy
  19. Virus Protection Policy
  20. Vendor Credentialing and Access
  21. Software Licensing Policies
  22. Providing Technology to Referral Sources

Identifying Practice Outliers Using Data Mining

Data Mining Used to Identify Practice Outliers

A Note From the OIG Presentation at the HCCA Compliance Institute

The federal government is actively using data to identify providers who perform outlier billing.  If your billing patterns reflect a pattern that is greatly outside of norms, you should be prepared to defend the deviation from the norm.  Certainly not every practice pattern that falls outside of norm indicate nefarious wrongdoing.  What is important is that your practice maintain awareness of and understand the reasons why billings may be picked up as falling outside of industry norms.  You must be prepared to educate government officials as to the reasons for having outlier claims data.

Primary care and pediatric practices will have very little opportunity to deviate from norms in most cases.  Highly trained specialists such as neurological surgeons can easily have unusual practice patterns that translate into outlier data that could trigger further government inquiry into billings.  Proactive audits performed as part of active compliance program will help the provider identify potential issues.  If abnormal data is identified through this process, the provider can address the situation in a proactive manner before the government becomes involved.

If there is an explanation for the anomalies, the provider can establish it in advance.  This type of practice approach strengthens the case if the government later raises the issue.  The provider should be fully prepared to explain the reasons for the apparent anomalies.  In a small and highly specialized practice, data anomalies can easily result from numerous possible non-nefarious reasons.  Because the government is actively using data analysis to identify fraud, the provider should assume that data that falls outside of norms will eventually be questioned.  Preparation, readiness, and proactivity are the keys to resolving issues with government investigators.

One message was loud and clear when OIG and DOJ lawyers spoke at the HCCA compliance institute.  The government is increasingly looking at data to identify inherent billing patterns, referral patterns and other information that could be reflective of improper billings, kickbacks, or other violations.

This information spotlights the need for providers to take a proactive approach in identify their own errors before the government brings these errors forward in a much less friendly manner.  If errors or overpayments are identified, repayment should be made promptly.  Repayments that are not made promptly are deemed to become false claims and expose the provider to much more severe penalties.

If the circumstances warrant, it may also be necessary to consider using the OIG or CMS self disclosure process to investigate potential penalties.