External Billing Audits: Lessons Learned

External Billing Audits: Lessons Learned Kathleen Naughton HCCA Compliance Seminar Newport Beach, CA June 22, 2012 Outline Audit focus Selection triggers Process Lessons learned Moving forward HCCA, 06/22/2012 1

UC San Diego Health Sciences Fast Facts San Diego s only academic medical center License capacity: 600 beds UC San Diego Health System is comprised of: UC San Diego Medical Center in Hillcrest UC San Diego Thornton Hospital, La Jolla Sulpizio Cardiovascular Center (SCVC), La Jolla UC San Diego Moores Cancer Center NCCI designated Comprehensive Cancer Center Shiley Eye Center UC San Diego Medical Group (physician group) Level 1 Trauma Center designation; Level 3 Neonatal ICU Regional Burn Center TJC certified Stroke Center for San Diego & Imperial Counties Outpatient clinics throughout San Diego County and beyond UC San Diego School of Medicine UCSD Skaggs School of Pharmacy & Pharmaceutical Sciences Faculty: 1,000 physicians & scientists; 600 interns and residents http://health.ucsd.edu/about/who-we-are/pages/fact-sheets.aspx Working with the OIG Initial contact: Mar.2011 Focus: Hospital billings to Medicare (CY2008 2009) Claim volume: 209* (initial 200 plus 9 add l claims) On-site field work: March 2011 June 2011 Exit conference: Sept.2011 Draft report: Sept.2011 Nov.2011 Final report: Feb.2012 HCCA, 06/22/2012 2

The Auditors Six agents at the entrance conference: 3 from San Francisco office 3 from San Diego area assigned to be on-site Only 1 member consistently present for on-site work All 3 members participated in weekly meetings and post-field work conference calls Steps taken after the initial contact Immediately notify general counsel, hospital leadership and internal audit Form an internal team: Compliance Officer Compliance Coding Manager Revenue Cycle Administrator Physician Advisor to Compliance Program Identify one primary contact for all communications (CO) Utilize an issue log to track requests & responses HCCA, 06/22/2012 3

OIG s Audit Method & Data Selection Reviewed applicable Fed laws, regulations, guidance Extracted the hospital s inpatient & outpatient paid claim data from CMS s National Claims History file for CYs 2008 2010 Used computer matching, data mining and analysis techniques to identify claims potentially at risk for noncompliance with selected Medicare billing requirements Reviewed: Data from CMS s Common Working File (CWF) for the selected claims to determine whether the claims had been canceled or adjusted Itemized bills & medical record documentation (provided by hospital) Requested the hospital to conduct its own review to determine if the selected claims were billed correctly Discussed the results of OIG s review with hospital officials Followed generally accepted gov t auditing standards Data Mining / Analytics How were claims selected? 1. Inpatient transfers to SNF, HHA, Other Acute Care 2. Coding: Modifier 59, HCPCS codes 3. Payments > Charges 4. Payments > $150,000 5. Payments > $ 25,000 6. Payments for Hemophilia Services 7. Medical devices (replacement during warranty) HCCA, 06/22/2012 4

Audit Area: Hospital Billing Types of Billed Services (risk areas) INPATIENT 1 Coding: Post-Acute Transfers 2 Coding: DRG (septicemia) 3 Credits: Replaced Med Devices 4 Payments: Greater than Charges 5 Payments: > $150,000 6 Payments: Psych interrupted stay OUTPATIENT 1 Coding: HCPCS (Rx, devices, units) 2 Coding: Modifier - 59 3 Credits: Replaced Med Devices 4 Payments: Greater than Charges 5 Payments: > $25,000 6 Payments: Hemophilia Factor 7 Payments: DRG payment window Documentation request: Produce itemized bills and medical records for each claim (each date of service / episode of care). Conduct a self-audit and provide the results to the OIG. Notes on Risk Areas 1 Post-Acute Transfers Disposition status; claim history; CWF 2 I/P claims > charges Validate DRGs, disposition status, short LOS 3 O/P claims > charges Devices, HCPCS code accuracy, units 4 I/P claims > $150,000 Validate DRG, question: outlier payments 5 O/P claims > $25,000 Mixture: coding accuracy, units, payer rules (coding for compound drugs) 6 Hemophilia services RC 250 vs. RC 360; HCPCS; units 7 Modifier 59 Coding accuracy, unbundling 8 Medical devices Credits: requested, obtained, reported? Modifiers: FB & FC and $ credit reported? Condition code: 49, 50 reported (I/P claims)? HCPCS: correct for the device? HCCA, 06/22/2012 5

Medical Devices Background notes Federal law allows CMS to reduce the amount of payment for both inpatient and outpatient claims for an implanted device when a significant portion of the payment is attributable to the cost of the device and the: Service is replaced without cost; or Provider receives full credit or credit > 50% of the new device 42 C.F.R. 419.45; 42 C.F.R. 412.89 http://www.cms.hhs.gov/mlnmattersarticles Reduction in payment is permitted when the provider actually receives the appropriate credit. Hospitals are required to seek credits when available from manufacturers for replaced medical devices and to report a modifier & charges to reflect credits received. Modifier FB, partial credit (> 50%) Modifier FC, full credit received Phase-1: Pre-Audit & Entrance Process Notice to CFO & advance call to Compliance Officer Respond to pre-audit controls questionnaire Schedule entrance conference with leadership OIG requested site to conduct a self-audit & provide results to OIG Receive audit sample from OIG (beneficiary, DOS, claim #s) Arrange for secure audit space: network access, phone, desks, keys If error identified, indicate the correct code, units, provide an explanation for the error, remediate the claim. OIG focused on validating results of the internal self-audit: Claims with errors Claims assessed as accurate Validation process: Review itemized bills (UB04) vs. medical records, physician orders, claim history. HCCA, 06/22/2012 6

Phase-1: Documentation Production Claims selected from National Claims History file All claims: Itemized bills (UB04) Medical records Medication administration records (HCPCS J-codes) Claims for medical devices: Credits: Provide detail re: $ received from manufacturers Warranty information for explanted devices Invoices (P.O.s) for implanted & explanted devices Phase-2: Intra-Audit Activities Assemble a qualified team: coding expert(s), compliance, revenue cycle, physician advisor Maintain a log: documents requested, responses & dates Gather & sequester audit s medical records Implement and QC self-review results Organize documentation: records, results, outcome, claims A = Inpatient, post-acute transfers B = Credits, replaced medical devices Maintain original claim sample #s (e.g., 1, 2, 3 ) Schedule meetings: discuss results and provide records Provide responses to OIG questions (written & verbal) HCCA, 06/22/2012 7

Phase-3: Post-Audit Activities Remediate claims Work with MAC Scan tagged medical record pages, upload to secure site Submit copies of R.A.s for each claim Validate dollars and adjustments Draft report: review & comment period Validate dollars (actual and estimated dollars) Implement other corrective actions to reduce errors Phase-4: The Final Report The OIG writes an executive report for the record, which really just confirms what we have told them in our verbal and visual presentations every couple of weeks., p.16 (June 1988) The final written report has become more of a summary to document the record.editors play a key consultative role in how findings and recommendation should be stated and what graphics should be presented. The OIG uses consulting firms and standardized software for the reports. http://oig.hhs.gov/oei/reports/oai-05-87-00019.pdf Experience: Verbal explanations, followed by written explanation for each error Errors are then grouped into a few general categories Validate report s explanation as to cause of error and all numbers HCCA, 06/22/2012 8

Outcome: Audit Reports CY2008 CY2010 # Hospital Sample Size # Claims Adj Refund % Error 25 All hospitals 192 Hi: 389 Lo: 60 60 $281,292 Hi: $784,000 Lo: $0 9% Hi: 49% Lo: 0% TN Regional Med 60 0 0 0% GA Piedmont 62 2 129,653 2% CA UC San Diego 209 90 $350,897 3% MA Cape Code 382 204 $379,182 9% FL Bay Medical 197 48 $289,846 10% MO Barnes-Jewish 240 58 $725,185 13% MA South Shore 389 249 $341,033 18% Disclaimer: % error rate was derived by dividing reported refund dollars by total dollars reviewed which could differ from actual refunded dollars for over- and under-payments. The error rate will be lower when applied to the universe of claims for the same time period. Data as reported by OIG, http://oig.hhs.gov/oas/reports/ Lessons Learned - 1 Assess impact on resources Determine if external resources will be needed Anticipate a long audit. Resolution process is lengthy (months!) Decide how to organize data and internal numbering scheme Self-review of claims needs to be thorough, not just coding Physician orders, dates, medical necessity, diagnoses Evaluate each claim s history, adjustments, rebill, RA, $$ Expect new issues during the audit engagement Re-visit of closed cases ; additional claims New issues identified during other OIG audits elsewhere Be receptive to providing / receiving education: Provide guidance to auditors on clinical care, med necessity, coding. Learn from the auditors, e.g., CMS policies, documentation questions. HCCA, 06/22/2012 9

Lessons Learned - 2 Involve the appropriate people from the beginning Document, document, document Develop a consistent QA process for the self-review Avoid QA headaches: Multiple worksheet versions & authors; multiple case reference #s Coordinate and communicate with core team & leadership Daily de-briefing / status report Start the claim remediation process early Data from remittance advice for adjusted claims is necessary. Over-payments for pending claims might reflect total projected payments from a fee schedule, rather than net payment. Verify all data figures and dollars in the draft report Highlight proactive efforts, e.g., claims remediated prior to the audit What worked well: No Surprises! Nobody likes bad news, but people hate surprises! Single contact point for the OIG & within the hospital Daily debriefings with core team Medical director s role, very helpful for medical necessity questions Weekly meetings with the OIG (set agenda in advance) Original medical records: scan tagged pages, upload to OIG s secure site (trade-off: scanning vs. copying expense) Single exit worksheet: outcome for all claims (OIG & entity) Claim remediation process: Detailed instructions, worked by specific staff members, add l QA by Compliance prior to claim release. Single contact point for MAC. Follow-up calls with OIG after the on-site work completed Patience, respect and professionalism: both sides! HCCA, 06/22/2012 10

Audit #2: Dec. 2011 Herceptin OIG Work Plan 2012: Herceptin (Trastuzumab) Objectives: Medically necessary & appropriate reimbursement Focus: Herceptin, a high-priced chemotherapy drug O/P claims with multiples of 44 units or payments > $10,000 Review: Orders, dispensed, administered, wasted, charged & controls Type of solution used to reconstitute Herceptin Issue: Medicare pays for wasted drugs from single-use vials, but wasted product from multi-use vials is non-billable. Herceptin comes in powder form and is reconstituted into a 440- mg multi-use vial. It expires 28 days after the first dose. HCPCS code: J9355, 10 mg/unit Medicare pays $71.76 per 10 mg of Herceptin. References: Medicare Claims Manual (Chapt17), OIG Work Plan 2012 (new project Part B Payments for Prescription Drugs), AISCompliance, Oct.2011 & 1, http://aishealth.com/sites/all/files/marketplace_pdf_samples/rmc102411.pdf HCCA, 06/22/2012 11

Audit #2: Herceptin Initial request: Dec.2011 Sample size: 66 outpatient claim lines HCPCS: J9355 and units = 44 Type of audit: Self-audit, provide results & records in 30 days Side notes: All claims had been adjusted 2 years ago (system error identified, proactively corrected). Audit continued anyway! OIG is required to report as a security breach any audit information sent to OIG that does not meet FIPS 140-2 requirements. (AES-256 and FIPS 140-2 certified method) Status: in progress Other OIG Audit Focus Areas Source: http://oig.hhs.gov Renal disease services: claiming unallowable costs Global Surgery: E/M visits < than expected for RVUs Medicare: O/P brachytherapy Medicare: O/P pharmacy billing selected drugs Oregon HSU: injections for paclitaxel, bortezomib, doxorubicin hydrochloride liposome, and adenosine (Mar2012) Catskills Reg.Med.Ctr (NY): injections for doxorubicin hydrochloride liposome, trastuzumab, and epoetin alfa. (Mar2012) Medicaid: costs for selected high-dollar O/P claims GME: Resident data vs. resident information systems (Medicare cost reports) HCCA, 06/22/2012 12

Corrective Actions Educate staff about coding rules (inpatient, outpatient) Educate billing staff (data entry errors; pre-claim edits) Update and document controls (P&Ps), review processes Promote monitoring tools for risk areas for site managers Initiatives: Disposition status codes: update dictionaries, reviews, EMR Pharmacy billing Medical devices: coding; track replacements, seek credits from manufacturers for products replaced during warranty, report credits Easier said then done Medical Devices Focus areas for monitoring Replacement of joints (hips, knees) Replacement of cardiac devices (see APC list) APCs: Outpatient payment classifications 0089, Insertion / Replacement of Perm. Pacemaker &Electrodes 0090, Insertion / Repl. of Pacemaker Pulse Generator 0106, Insertion / Repl. of Pacemaker Leads and/or Electrodes 0107, Insertion of Cardioverter Defibrillator 0108, Insertion / Repl. / Repair of Cardioverter Defib. Leads 0654, Insertion / Repl. of a Permanent Dual Chamber Pacemaker 0655, Insert. / Repl. / Conversion: perm. dual chamber pacemaker Refer to OIG audt report focused on medical devices, http://oig.hhs.gov/oas/reports/region5/51100012.pdf HCCA, 06/22/2012 13

Summary: Moving Forward Corrective action plans Use data analytics during annual risk assessment. Incorporate results into your compliance work plan. Data sources: PEPPER, OIG s work plan & audit reports, data mining process to identify unusual practices, Medicare Tip sheets. Use published audit reports to identify potential risk areas Undertake your own audits, whether routine or focused, to help uncover areas of potential abuse. Take proactive steps to correct problems and document. Incorporate emerging risk areas into annual Work Plans NO QUESTIONS HCCA, 06/22/2012 14

Questions? Kathleen Naughton, CHC, CCS-P, CPC Chief Compliance / Privacy Officer UC San Diego Health Sciences T: 619-471-9152 E-mail: knaughton@ucsd.edu HCCA, 06/22/2012 15