Sarah Q. Wirskye

In December 2013, HHS' Office of Inspector General (OIG) issued a report entitled

 "Not All Recommended Fraud Safeguards Have Been Implemented in Hospital EHR Technology."

 The government conducted the study in response to a concern that EHRs, which are quickly replacing traditional paper medical records, can make it easier to commit fraud.



In order to complete the study, the government gathered data from hospitals and EHR vendors. It also conducted on-site interviews and observed hospitals' certified EHR technology.

The first objective of the study was to assess the extent to which hospitals that received EHR Medicare incentive payments implemented the recommended fraud safeguards for EHR technology in the following categories: audit functions; user authorization and access controls; data transfer standards; and  patient involvement in anti-fraud activity. The second objective was to assess the extent to which hospitals have implemented policies to address appropriate copy/paste functions in EHR.

Nearly all hospitals with EHR technology had the recommended audit functions in place, but were not always being used to their full extent. For example, the audit log captured the recommended data. However, almost half of the hospitals had an ability to delete their audit logs. Moreover, the audit logs' data was being analyzed to ensure privacy of patient data, as opposed to detecting and preventing fraud and abuse.

Second, all hospitals employed a variety of recommended user authorization and access controls. One of the concerns in this area, however, was limiting outside entities' access to EHR data to ensure that the appropriate individuals are actually making the entries. Third, the study found that nearly all hospitals were using recommended data transfer safeguards. However, only approximately a quarter of the hospitals reported that they require users to provide a reason before exporting, transferring or printing data. The resulting recommendation was to institute safeguards to restrict such. Fourth, almost half of the hospitals had begun implementing recommended tools to include patient involvement in anti-fraud efforts.

One of the report's most significant findings was that only about a quarter of the hospitals had policies regarding the use of the copy-paste feature in EHR technology. Recognizing this feature can greatly enhance efficiency of data entry, there is a concern that it is easier to inflate, duplicate, or even create fraudulent health claims by merely cutting and pasting a prior entry.  The second area of concern with this function is that auto-population features that generate extensive documentation on the basis of a simple click may generate information that is not accurate for the specific patient encounter and over represent what the practitioner performed. The study recommended that the use of such tools be captured in the audit log and more careful use of this function.

HHS' recommendations were as follows, and CMS concurred with those recommendations:

1. Audit logs be operational whenever EHR technology is available for updates or viewing;

2. Office of National Coordinator for Health Information Technology (ONC) and CMS strengthen their collaborative efforts to develop a comprehensive plan to address fraud vulnerability in EHRs; and

3. CMS develop guidance on the use of the copy-paste function in EHR technology.

Based upon the report and recommendations, expect to see further scrutiny and crackdowns of EHR abuses. There will be adjustments to payments to professionals and hospitals, beginning in 2015, for failing to successfully demonstrate meaningful use of certified EHR technology. Both HHS and the U.S. Attorney General recently warned medical providers who commit billing fraud with EHR that they will be prosecuted. Additionally, insurance companies will also likely begin more closely scrutinizing EHR and possibly even reject claims if they believe that the copy-paste function is not being used appropriately. In order to protect themselves, healthcare providers should attempt to follow the recommendations in the report with a focus on the cut-paste function and potential abuses.

Articles

A recent report from HHS warns physicians about improper use of their EHRs, especially the copy-paste function.

Physicians Need to Be Aware of Heightened Scrutiny of EHRs

Technology is playing a growing role in helping the government identify and combat potential healthcare fraud. It not only helps the government identify areas of fraud, but also makes it easier to share the results of its investigation with other agencies and health insurers.

Recently, the chief counsel of HHS' Office of Inspector General (OIG) testified before Congress regarding the growing role of information technologies and analytics - including data mining, trend evaluation, and modeling- to better identify fraud vulnerabilities and target their oversight efforts.  The OIG's data warehouse integrates data from Medicare parts A, B, and D so that the government can develop a comprehensive picture of beneficiaries' medical care and providers' billing patterns. The data warehouse also allows the government to work more quickly.

In fraud investigations, technology and databases have been increasingly used by Medicare Fraud Strike Forces, allowing quicker identification of fraud schemes and trends. The data-driven approach of the strike force is to pinpoint fraud hotspots through the identification of suspicious billing patterns and quickly target potential criminal behavior. Since their inception in 2007, strike force teams have charged more than 1,000 individuals with seeking to defraud Medicare of more than $2.4 billion.

As a healthcare provider, this will impact how you, your peers, and the healthcare sector overall are targeted for investigation. As always, many healthcare investigations will continue to be opened based upon personal tips or whistleblower actions.

However, technology more easily allows the government to identify a provider as an outlier as far as billing a particular code. The government will also be able to use the integrated data to identify providers with certain billing patterns that appear suspicious. The fact that a provider services a certain segment of the population may make him a statistical anomaly that will have to be explained to the government. Mere dollar amounts may also put a provider on the government's radar. So a multi-office practice or a particularly busy office may be suspect based upon data alone.

One of the biggest changes is something we are already seeing. State agencies and insurance providers are increasingly becoming more active in investigating potential fraud. Because it is easier to share data, for example, an investigation that was not big enough for the federal government may be more likely handled at the state level. State medical boards are expected to become more active as well. And there likely will be more exclusions based upon state and private investigations for the same reasons.

Therefore, as a healthcare provider it is more important than ever:

• That your charting justify the codes you are billing, especially if you are billing for a more complex procedure;

• That you have a compliance program already in place;

• That you are able to show proactive measures to identify and return overpayments; and

• That you remember just because you do not accept Medicare or Medicaid, you are not automatically protected from a potential investigation.

Health IT and its data is rapidly becoming a powerful tool for the federal government in combating potential healthcare fraud nationwide.

The Latest Weapon to Fight Healthcare Fraud: Health IT and Analytics

Most people think of "cybercrime" as actions by someone who wrongfully gains access to electronic information and then uses it for their benefit illegally. However, "cybercrime" cases also include enforcement actions regarding data breaches against reputable entities who allegedly did not take adequate protection measures safeguarding client data. Both the federal and state governments have pursued such actions and published requirements in dealing with sensitive, and particularly HIPAA-related, information.

HHS' Office for Civil Rights (OCR) entered into several major settlements of HIPAA-based enforcement actions in 2012. The entities include a major health insurance provider in Tennessee, a hospital in Massachusetts, and the Alaska Department of Health and Human Services. All of these cases settled for between $1.5 million and $1.7 million. These cases stem from reported data breaches involving lost or stolen electronic storage media allegedly containing protected health information (PHI). These settlements also generally include corrective action plans, some with third-party compliance monitoring, in addition to the monetary payments mentioned earlier.

Recently, WellPoint settled a similar case and agreed to pay $1.7 million for leaving information accessible over the internet. OCR began its investigation following a breach report submitted by WellPoint as required by the HITECH Act. The HITECH Breach Notification Bill requires HIPAA-covered entities to report a breach of unsecured PHI. The report indicated that the security weakness in an online application database left electronic PHI of over 612,000 individuals accessible to unauthorized individuals over the Internet. OCR’s investigation indicated that WellPoint did not implement appropriate administrative and technical safeguards as required under the HIPAA Privacy Rule.

Notably, the government is not only pursuing actions against large insurance carriers or hospital systems. A cardiac surgery practice in Phoenix settled a case for $100,000 with OCR resulting from allegedly posting PHI on a publicly accessible, Internet-based appointment calendar. State attorneys general have also pursued "smaller" cases, which have resulted in six-figure settlements. Therefore, it is clear that physician practices must take adequate measures as well.

Whether system upgrades are conducted by covered entities or their business associates, OCR expects organizations to have in place reasonable and appropriate technical administrative and physical safeguards to protect the confidentiality, integrity, and availability of electronic PHI -especially information accessible over the Internet. Moreover, beginning September 23, 2013, liability for many of HIPAA’s requirements will extend directly to business associates that receive or store PHI, such as contractors and subcontractors.

On November 26, 2012, OCR released guidance regarding methods for de-identification of PHI in accordance with the HIPAA Privacy Rule. The Privacy Rule essentially establishes two methods to de-identify PHI. The first is removing 18 specific identifiers, including name, address, and social security numbers. The second is obtaining a professional statistical analysis and opinion that the risk of identification of an individual is very small.

With the government focus on "cybercrime" becoming an increasing area of scrutiny, physicians who have access to and record PHI should ensure they are familiar with and implement the appropriate procedures in securing and protecting PHI.

. However, the rules are not always clear and ideally you should contact a healthcare attorney to ensure you are HIPAA-compliant and what to do if there may be a potential breach.

You may not equate a HIPAA violation with a cybercrime, but if you have patient records, you need to secure and protect that information electronically.

Why Your Medical Practice May Have Exposure to a Cybercrime

While the Affordable Care Act is not generally characterized as healthcare fraud legislation, there are some aspects of the Act that certainly affect healthcare fraud. Nowhere is this more evident than the ACA’s provisions that make the failure to return an overpayment a basis for a False Claims Act violation.

The Act requires anyone who has received a Medicare or Medicaid overpayment to report and return it and to notify the government for the reason of the overpayment. Generally speaking, the overpayment must be reported and returned within 60 days. The deadline for reporting and returning payments is 60 days from the date on which the overpayment was identified or the date any corresponding cost report is due, if applicable. Notably, the False Claims Act definition of knowledge applies to this provision - so a provider cannot avoid having actual knowledge, and therefore liability, if they act in reckless disregard or deliberate ignorance of the overpayment.

Significantly, the failure to do so within the deadline could be a basis for a False Claims Act violation. Penalties under the False Claims Act could include civil penalties between $5,500 and $11,000 per violation, plus treble (or triple) damages. Any person who fails to report and return the overpayment may also be found liable under the Civil Monetary Penalties Law and could be excluded from participation in federal healthcare programs.

The potential liability under the False Claims Act is particularly important because the ACA is the basis of most whistleblower actions. This change in the law coupled with the 2011 amendments to the False Claims Act statute make it easier than ever for a whistleblower to file a False Claims Act violation.

It is imperative that procedures are implemented or modified to identify overpayments. This may include payments for non-covered services or payments in excess of allowable amounts. This may also include situations where there may be a duplicate payment in error or receipt of payment when another payor had the primary responsibility of the payment.

This change in the law is just another example of increased healthcare legislation attempting to target healthcare fraud and abuse. Notably, the ACA appropriated over $350 million for fighting healthcare fraud. Therefore, it is more important than ever to ensure that you are compliant with all applicable laws and regulations.

It is imperative that procedures are implemented or modified to identify overpayments at your medical practice to avoid a False Claims Act violation.

Expansion of the False Claims Act under the Affordable Care Act

The government often focuses on potential kickbacks and self-referral arrangements in healthcare fraud investigations. As one federal publication recently stated, “in some industries, it is acceptable to reward those who refer business to you. However, in the federal healthcare programs, paying for referrals is a crime.”

These are typically easier cases for the government to prove than cases that turn largely on expert testimony regarding complex medical procedures. The government’s concern is that kickbacks and self-referral arrangements can lead to overutilization, increased costs, corruption of medical decision making, patient steering, and unfair competition.

The federal Anti-kickback Statute prohibits knowing and willful conduct involving the solicitation, receipt, offer, or payment of any kind of remuneration in return for referring, directly or indirectly, an individual or for recommending or arranging the purchase, lease, or ordering of an item or service that may be wholly or partially paid for by any federal healthcare program. “Federal healthcare program” not only includes Medicare, but also, Medicaid, Tricare, Vetrans Administration, and other federally funded programs. While the AKS prohibits remuneration for referrals wholly or partially paid for by government funds, many state versions of the AKS cover non-government pay.

Notably, “knowing and willful conduct” has been very broadly interpreted to mean that a person need not have 

 intent to violate this law. “Remuneration” has been interpreted to include anything of value (tangible or intangible), such as a reduction or discount, direct payment of cash or loans, and free items or services, including transportation. There are also cases stating that if at least part of the payments were intended to induce referrals, the AKS is violated. Moreover, the government does not need to prove patient harm or financial loss to the program. Finally, there can be a violation of the AKS even if the service was rendered, and the service was medically necessary. A violation of this statue can be the basis for civil or criminal penalties, and collateral consequences such as exclusion and licensure issues.

There are statutory exceptions and voluntary safe harbors to the AKS. Some of the more commonly implicated ones involve discounts, certain employer/employee relationships, space and equipment rental, and practice sales. There are certain rules that must be strictly followed in order to fall within these exceptions and/or safe harbors, however.

Physician Self –Referral Statute (“Stark Law”)

The Stark Law limits physician referrals for “designated health services” (“DHS”) when a physician or immediate family member has a financial relationship with the entity, unless an exception applies. A financial relationship is defined as either a compensation arrangement (which includes any remuneration) or an ownership or investment interest. A referral includes any direct request for a DHS or a request for a consultation with another doctor who then orders a DHS.

This is a strict liability statute. The individual need not be aware that he or she is referring to an entity with which the provider has a prohibited interest in order to break the law. Penalties include fines and exclusion from Medicare and Medicaid. Unlike the AKS, Stark only applies to Medicare and Medicaid and not all federal healthcare programs.

DHS include 1.) clinical laboratory services; 2.) physical therapy, occupational therapy, and outpatient speech-language pathology services; 3.) radiology and certain other imaging services; 4.) radiation therapy services and supplies; 5.) durable medical equipment and supplies; 6.) parenteral and enteral nutrients, equipment, and supplies; 7.) prosthetics, orthotics, and prosthetic devices and supplies; 8.) home health services; 9.) outpatient prescription drugs; and 10.) inpatient and outpatient hospital services. There are statutory and regulatory exceptions to the Stark Law as well.

These statutes have a very broad application. If you or your practice is involved in the following conduct, you may need to conduct further investigation in order to ensure you are in compliance with the statutes discussed in this article: 1.) waivers of co-pays or deductibles; 2.) joint ventures with Medicare/Medicaid pay; 3.) arrangements with doctors, such as medical directors, and incentives for recruitment and retention; 4.) lab discounts; 5.) office rental; 6.) gifts to patients, and particularly Medicare/Medicaid beneficiaries; and 7.) paying employees based upon production.

In light of the government focus on these provisions, there are a few steps a provider can take to help minimize his/her exposure. A provider should have a written policy regarding gifts. This should include prohibiting and/or limiting both the giving and receiving of gifts to any patient or referral sources.

In healthcare fraud investigations, the government usually examines a provider’s marketing practices, and will examine advertising and mailed materials. Providers need to ensure that their marketing professionals know what is appropriate in the healthcare field. For example, gift cards are a commonly promoted marketing tool used by healthcare consultants that likely violate federal and state law.

The HHS' Office of Inspector General (“OIG”) also has a voluntary self-disclosure program to resolve Stark and AKS issues. A careful analysis must be performed when and how to do a disclosure. If the government does not feel the disclosure meets the criteria and is not truthful or complete, it does not offer any protection, and it may actually help the government make a case.

Because what is generally accepted in many other industries may be illegal in the healthcare industry, it is important to make sure you are in compliance with these rules. Be careful!

Business practices generally accepted in other industries can be illegal in healthcare, so it is important to be sure you are in compliance.

Kickback and Self–referral Statutes Physicians May be Violating

The government examines the same areas in every healthcare fraud investigation. In light of that, there are some things that a physician can do in order to minimize their liability if they find themselves under audit or investigation.

The government often examines whether services that were billed were actually rendered. One of the government’s favorite techniques for doing so is examining the amount of time the physician spends with each patient. In other words, the government divides the number of hours the physician is in the office by the number of patients seen during that day. If the time per patient is unreasonable in the government’s opinion, it frequently takes the position that the physician did not see all of the patients and/or did not see the patients long enough to adequately provide the service. The government has an even stronger case in situations where the billing codes are time based. The government will frequently examine a physician’s travel and credit card records to determine which days he or she was in the office, and compare that analysis with their billing records.

Services not rendered are perhaps one of the most critical issues that the government will examine. If the government concludes that unqualified, non-physician personnel must be treating patients because of the number of patients seen and/or the physician is not spending adequate time with each patient, the government is much more likely to suspend payments or bring an indictment.

Necessity is another critical issue in government investigations. The person making the determination of necessity must be qualified. If the requirement in a particular area is that a doctor must make the determination, this task cannot be delegated to an assistant. The government will also examine how and if the person making the determination of necessity is compensated. If it is an unrelated individual, the government will examine whether there are improper payments, or potentially kickbacks. If it is someone affiliated with the entity, the government will examine whether the professional is being paid fair market value and whether the compensation is based on the number of patients approved for treatment or revenue. Again, such compensation arrangements can be viewed as a kickback.

The government often examines whether a physician is consistently coding a more complex procedure, for which the reimbursement is higher, rather than a less complex version of that same procedure. This is called upcoding. It is critical that the documentation in the patient chart supports the level of service that is being provided - particularly the more complex codes.

Unbundling is where one procedure is split up and billed as a number of individual procedures to maximize reimbursement. When two procedures are performed together and there is one lower paying “combination” billing code, that code must be billed.

Kickbacks can be gifts or benefits to referral sources, beneficiaries, or employees. These are typically easier cases for the government to prove than cases that turn largely on expert testimony regarding complex medical procedures. It is good practice not to make any substantial gifts to referral sources or any gifts at all to beneficiaries, such as rebates or gift cards. The government also sometimes takes the position that employee compensation based upon revenue is a kickback.

In healthcare fraud investigations, the government usually examines a physician’s marketing practices, and will review advertising and mailed materials. Physicians need to ensure that their marketing professionals know what is appropriate in the healthcare field. What is generally accepted in many other industries may be illegal in the healthcare industry. For example, giving government-paid beneficiaries gift cards for referrals could be a violation of federal and state law.

The government also examines referrals to and from related entities. The Physician Self-Referral Statute, commonly known as the “Stark Law,” limits physician referrals for “designated health services” when a physician or immediate family member has a financial relationship with the entity, unless an exception applies.

It is imperative that physicians be very careful, particularly when working with the government. One of the most basic things a physician can do to minimize liability is to thoroughly and accurately chart. Physicians and their staff must also take the time to learn and follow the often complex rules. They need to make sure they are following every procedure in order to minimize their liability if they find themselves in the government’s sights.

is a partner with Dallas-based law firm Meadows, Collier, et. al. Her practice concentrates on healthcare, tax, and securities fraud. Ms. Wirskye is also a certified public accountant. E-mail her 

Want to know what the government looks for in healthcare fraud investigations? Here's some conduct you may want to avoid at your medical practice.