Kusserow on Compliance: Using sanction-screening tools vs. outsourcing the entire process

In order to save time and costs, more and more health care organizations have been moving to outsource functions that are not core business activities. Compliance programs have been part of that trend: (1) 80 percent of compliance offices use vendors to provide hotline services, (2) 50 percent of compliance offices use vendors to provide policy development tools, and (3) two-thirds of compliance offices use vendors to provide E-learning tools. Included in the growing list of outsourced tasks has been the movement to address the rapidly growing cost and time commitment obligations related to sanction-screening. Two-thirds of compliance offices use a vendor search engine tools to assist in sanction-screening that saves an organization from downloading the sanction databases and developing a search engine. This is a trend driven by the rapid development of many new databases against which to screen employees, medical professionals, contractors, vendors, etc., including the following:

  • OIG List of Excluded Individuals and Entities (LEIE)
  • GSA Excluded Parties List System (EPLS)
  • 40 Medicaid states now have sanction data bases requiring monthly screening
  • Drug Enforcement Administration (DEA)
  • FDA

All this has increased the burden of sanction-screening exponentially, not only for the compliance office, but also human resource management for new hires and periodic screening of current employees and procurement with vendors and contractors. Medical credentialing is involved as result of having to screen physicians who are granted staff privileges. Using vendors has been a great help, but the most difficult part of the process is resolving “potential hits.” This can be a considerable effort and many organizations have to dedicate staff for investigation and resolution of these hits. It is complicated by the fact that most sanction data does not provide sufficient information to make positive identification. As a result of this heavy burden, many have moved beyond simply using a vendor tool to outsourcing the entire process to vendors. The following address selecting a sanction-screening vendor and outsourcing the process.

 

Tips for selecting sanction-screening vendor

 

Tips for outsourcing the sanction-screening process

  • Determine the cost of moving from use of a vendor search engine tool to outsourcing the screening, along with investigation and resolution of “potential hits.”
  • Inquire as to the methodology they follow in resolving potential “hits,” a critical part of any screening effort.
  • Ensure the vendor provides a certified report of the results that can be made part of the compliance office records.
  • Review an example of the type of reports they would provide to determine if it meets the documentary needs of the organization.

 

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on Google+ or LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2017 Strategic Management Services, LLC. Published with permission.

Kusserow on Compliance: Emerging government enforcement priorities for 2018

At the HCCA conference in April, there were several presentations regarding the government’s enforcement priorities. There were a number of emerging issues that were the subject of considerable attention: the opioid crisis, electronic health record (EHR) fraud, and telehealth/telemedicine. By far, the area given the most attention was the opioid crisis.  More than a dozen presenters included comments in their presentations on this subject, including presenters from the DOJ, OIG, CMS, and the OCR. This is not surprising in that last October the President declared this to be a national public health care crisis and marshaled regulatory and enforcement agencies to actively focus on steps to alleviate it. Other agencies not present at the HCCA are included in this effort, such as the FDA, FCC, CDC, Indian Health Service, Veterans Administration, Department of Defense TRICARE program, and others. At the federal and state level, there is increased legislative, regulatory, and enforcement actions activity related to substance abuse and behavioral health services. In January, the Attorney General announced the DEA was increasing its focus on pharmacies and prescribers who dispense unusual or disproportionate amount of such drugs. He also has created the Prescription Interdiction and Litigation (PIL) task force to aggressively deploy and coordinate all available criminal and civil law enforcement tools to address the crisis. Both DOJ and OIG presenters noted the July 2017 “take down” of 412 defendants in 41 different judicial districts. The defendants included over 100 doctors, nurses, and other medical license professionals. Together these individuals were responsible for over $1.3 billion in false billings.

The second most reported topic concerned cyber and IT security of Protected Health Information (PHI). This was a main topic in the presentation by OCR, but was alluded to in seven other presentations on cybersecurity and threats and complying with HIPAA Privacy and Security standards. The OCR reported that since 2009, there have been 2178 reports of breaches over 500 files with more than 300,000 cases of breaches affecting fewer than 500 files. The OCR has responded to over 170,000 complaints that resulted in over 25,000 cases being resolved with corrective action measures.  The OCR expects about 17,000 new complaints this year.  The top 10 recurring issues involve: (1) disclosure of sensitive paper information, (2) business associate agreements, (3) risk analysis, (4) failure to manage risks, such as with encryption, (5) lack of transmission security, (6) failure of ongoing auditing, (7) no patching of software, (8) insider threats, (9) improper disposal of records, and (10) insufficient backup of information and contingency planning.

Several sessions focused on physician arrangements and how they could implicate the Anti-Kickback Statute and Stark Laws.  Statistics from DOJ indicated the continuing trend of increased number of qui tam cases that has grown from 426 in 2015 to around 500 in 2017 with annual settlements averaging about $2.5 billion per year.

New cases involving Meaningful Use Fraud were reported with the promise that more new cases were under development.  Another area getting a lot of enforcement attention by the DOJ and OIG relate to telehealth and telemedicine. Cases surfacing now are focusing on claims arising from billings for these areas that did not qualify as such.  Only certain telehealth services are covered by Medicare and providers should take care to follow CMS guidance on what qualifies.

It is interesting to compare these priorities with results for the 2018 Compliance Benchmark Survey of compliance officers. There was no mention of the opioid crisis, as it was just an emerging national issue at the time the survey was taken. HIPAA security/cyber-security was the highest priority. It is troubling that corrupt arrangements with referral sources remains the number one regulatory and enforcement priority for the OIG and DOJ but is ranked fifth in priority to respondents. The other major and continuing enforcement priority related to claims submissions and that ranked third in priority by compliance officers.  A complementary webinar relating to this survey will be presented on May 9th.

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on Google+ or LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2018 Strategic Management Services, LLC. Published with permission.

Kusserow on Compliance: Tips on what to expect from hotline vendors

The U.S. Sentencing Commission and HHS Office of Inspector General (OIG) make it clear that for any compliance program to be effective, it must have active compliance communication channels that meet defined capabilities. Translated, this means organizations must have an employee hotline that permits reporting sensitive matters outside the normal supervisory channels. The failure to establish a credible internal compliance reporting channels often drives individuals to report externally to the OIG and DOJ as “Whistlblowers.”  Internally operated and managed hotlines are generally a bad idea because they are extremely inefficient, costly, and seldom meet any minimum standards. Internal hotlines raise the question of whether anonymity is truly offered and whether employees will ever sufficiently trust calling an employee. It is therefore not surprising that 80 percent of organizations participating in the 2018 Compliance Benchmark Survey Study reported using a hotline vendor. Hotline vendors have the training and experience to handle complainants. However, determining who can provide the best service at the right price is a challenge.

 

What to Expect from Hotline Vendors

    1. Two levels of service are needed: (a) live operator answered calls and (b) a web-based reporting system which prompts individual complainants. Over the last decade there has been a marked trend towards reporting via the web—today web-based reporting almost equals operator answered calls. Organizations should pass on any vendor that does not provide both services.

     

    1. Avoid start up hotline services and ask for a statement of their experience. The more a service knows about hotline operations, the less likely they are to encounter problems or mishandle information.

     

    1. Use only vendors knowledgeable with issues, concerns, and regulatory issues unique to the health care sector. Also, ensure they recognize and ask the right questions about high risk areas identified by the HHS OIG, including those related to the Stark Law and the Anti-Kickback Statute.

     

    1. Avoid any vendor contract that won’t permit cancellations without cause with a simple 30-day written notice. Hotline vendors should hold clients by good service not by contracts. In any contract with a vendor, look to see if cancellation of service is restricted. If so, consider finding a way out of the arrangement and in obtaining service elsewhere.

     

    1. Vendor contracts should include a provision requiring a full written report within the same day of receipt of a call. Urgent matters should be reported immediately via phone.

     

    1. The hotline must provide an option for The U.S. Sentencing Commission, DOJ, and OIG call for anonymity in their guidelines. In the health care sector, nearly two-thirds of all hotline reporters request anonymity. Anonymity is generally in the best interest of the organization as there is no burden of protecting identity if it is unknown. The hotline vendor should have as part of their service a means of communication between the compliance officer and an anonymous reporter. Insist on having that included in the service.

     

    1. Avoid any vendor that provides reports by facsimile or email, as they are not secure and where PHI may be involved could be a complicating HIPAA privacy factor. Web-based reporting is the most secure with notification of a report being provided via email.

     

    1. Compare costs of service, keeping in mind that a vendor should be able to provide their services at a set fee that can be used for comparison purposes. A good rule of thumb is that the cost of a hotline service should not be more than $1 per employee per year. Periodically, compare costs of the vendor being used against other vendors. It may prove to be an opportunity to save money.

     

    1. Look for any inclusive vendor services, such as providing operating protocols for following up on allegations and complaints received through the hotline, as well as other related policies. More reputable firms also provide newsletters or report updates to keep clients up to date on issues relating to their hotline function. Find out what they offer.

     

    1. Look for a vendor that will provide personalized service and is easily accessible and responsible for any and all issues that arise under the contract. Avoid the frustration of interactive voice response (IVR) phone systems, which move callers from one office to another before reaching a stranger who may or may not be able to answer questions.

     

    1. Like any other vendor, the company should have at least one- to three-million dollars liability coverage.

     

    Richard Kusserow will be available to answer any questions related to hotlines at booth 412 at the Las Vegas HCCA Conference.

     

     

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on Google+ or LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2017 Strategic Management Services, LLC. Published with permission.

Kusserow on Compliance: CMS improperly paid $367M for outpatient physical therapy

The OIG issued an audit report that found sixty-one percent of Medicare claims for outpatient physical therapy services reviewed did not comply with Medicare medical necessity, coding, or documentation requirements, resulting in an estimated overpayment of $367 million for outpatient physical therapy services that did not comply with Medicare requirements. These overpayments occurred because CMS controls were not effective in preventing improper payments for outpatient physical therapy services. The Medicare Part B program paid approximately $2 billion for outpatient physical therapy services provided to beneficiaries and past OIG reviews of individual physical therapy providers identified claims for outpatient physical therapy services that were not reasonable, medically necessary, or properly documented.  The OIG analyzed a stratified random sample of 300 outpatient claims for physical therapy services. The OIG’s stated objective was to determine whether Medicare claims for outpatient physical therapy services complied with Medicare requirements. Errors identified fell under three categories:

  1. Services that were not medically necessary, including services which were not reasonable—there was no evidence that the services would be effective, the services did not require the skills of a therapist, or there was not expectation of significant improvement.
  2. Coding did not meet medical requirements—timed units claimed did not match units in treatment notes; missing modifiers; and incorrect codes.
  3. Documentation did not meet Medicare requirement—plan-of-care deficiencies; treatment note deficiencies; and recertification deficiencies.

The OIG recommended CMS: (1) instruct the Medicare contractors to notify providers of potential overpayments so that those providers can exercise reasonable diligence to investigate and return any identified overpayments, (2) establish mechanisms to better monitor the appropriateness of outpatient physical therapy claims, and (3) educate providers about Medicare requirements for submitting outpatient physical therapy claims for reimbursement. CMS generally disagreed with these findings and believes further analysis of the sampled claims is warranted to determine whether the claims met Medicare requirements, according to the report.

 

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on Google+ or LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2018 Strategic Management Services, LLC. Published with permission.