Healthcare Law Blog

CMS Ruling on Part B Rebilling

Increasingly, Administrative Law Judges (“ALJs”) and the Medicare Appeals Council were upholding Part A denials on RAC audit appeals based on determinations that inpatient admissions were not reasonable and necessary, and then ordering payment under Part B as if services were rendered at an outpatient or “observation level” of care. The problem with this practice is that Medicare Benefit Policy Manual (“MBPM”) allows hospitals to bill a Part B inpatient claim for only a limited set of medical and other health services. Additionally, the providing for payment of all reasonable and necessary Part B services under these circumstances are contrary to CMS policy that the services be billed within the usual timely filing restrictions. The Centers for Medicare & Medicaid Services (“CMS”), concerned about this practice, recently released both a Ruling and a Proposed Rule to seemingly help the hospital community. How much relief it will actually provide is yet to be seen. More >

EHR Systems: Contracting for Change

On Tuesday, I discussed the recent decertification of two EHR Technology systems previously certified under ONC standards and, therefore, ineligible for use to meet “meaningful use” requirements.  Recently, these products failed a retest conducted by an ONC-authorized certification body.  The decertification was the first following the push to adopt EHR Technology to qualify for meaningful use incentives and to avoid an eventual reduction in Medicare program reimbursement. More >

EHR Systems: Is Certification Ever Certain?

The 2009 Health Information Technology for Economic and Clinical Health (“HITECH”) Act provides the Department of Health & Human Services (“HHS”) with the authority to establish programs to improve health care quality, safety, and efficiency through the implementation of health IT, including electronic health record technology (“EHR Technology”). Under HITECH, eligible health care providers can qualify for Medicare and Medicaid incentive payments when they adopt certified EHR technology and use it to achieve specifically outlined objectives, known as “meaningful use" requirements. More >

OIG Updates Self-Disclosure Protocol, But Discourages Action, cont.

On Tuesday, the changes to eligibility and disclosure requirements for the OIG’s Self-Disclosure Protocol (“SDP”) were discussed. Now, let’s take a look at certain disclosures and what has changed from the ’98 version.

Disclosures Involving Excluded Persons

Many SDP disclosures involve violations of employing or contracting with individuals who are on OIG’s List of Excluded Individuals and Entities (“LEIE”).  With the update, OIG has specified what is needed for a complete disclosure of this violation. A disclosure must include, among other things, biographical information on the excluded party, description of the disclosing party’s screening process, and a description of how the conduct was discovered.  The disclosing party must also screen all current employees and contractors against the LEIE.

OIG has also provided guidance on calculating damages for this disclosure. For direct providers who bill separately, the disclosing party must provide the total amounts claimed and paid by federal health care programs for the items or services. If items or services are not billed separately, a formula will be used based on the excluded party’s total cost of employment or contracting. This amount will be multiplied by the disclosing party’s federal program payor mix.

Disclosures Involving Anti-Kickback and Stark Law

Since the 2009 Open Letter, conduct involving only potential violations of the Stark Law is not eligible for SDP. To qualify, violations must potentially involve both the AKS and Stark Law. It is the disclosing party’s responsibility to describe each disclosed arrangement and determine on their own why each arrangement may violate the AKS and, if applicable, the Stark Law.

If a disclosure is limited solely to the Stark Law, this potential violation should be disclosed to the Centers for Medicare and Medicaid Services (“CMS”) through their Self-Referral Disclosure Protocol (“SRDP”). Providers should be prepared for the possibility that OIG and CMS will work together.

A disclosing party must include the total remuneration provided through the agreement, but a party may explain why portions of the remuneration should not be considered by the OIG when determining the settlement amount.

Disclosures Involving False Billings

For potential improper claim disclosures, a disclosing party must estimate the total financial impact to government health care programs. To do this, a party can either disclose all claims with specific information or use a sample size. When using the latter method, a party must use a statistically valid sample of, at minimum, 100 claims and use the mean point estimate for calculating the effect. The ’98 version only required 30 claims and called for a “minimum precision level.”

The updated SDP does offer a short list of benefits for disclosing parties. Resolution will continue to occur in most matters without a corporate integrity agreement. This has been the general policy since the 2008 Open Letter. OIG will maintain its general practice to require a minimum multiplier of 1.5 times the single damages for many instances. Lastly, there will be a suspension of the obligation to report and return overpayments to the federal health care programs while the SDP is pending.

In evaluating the pros and cons of the updated SDP, the scales weigh heavily in favor of OIG and against self-disclosure. Entry into the SDP should be carefully considered. The new version offers only minor benefits while posing significant risks to a disclosing party who is seeking to come forth with potential violations.

Christopher J. Shaughnessy is a member at McBrayer law.  Mr. Shaughnessy concentrates his practice area in healthcare law and is located in the firm’s Lexington office.  He can be reached at cshaughnessy@mcbrayerfirm.com or at (859) 231-8780, ext. 1251. 

Services may be performed by others.

This article does not constitute legal advice.

OIG Updates Self-Disclosure Protocol, But Discourages Action

On April 17, 2013, the Office of Inspector General (“OIG”) issued an updated Provider Self-Disclosure Protocol (“SDP”). The initial protocol was created in 1998 (“’98 version”) with the goal of having providers voluntarily identify and disclose potential federal health care program fraud and work with the OIG to resolve the identified abuses. Specifically, the SDP offered guidance to providers (both individuals and entities) on how to investigate conduct, quantify damages, mitigate potential penalties, and report to OIG.  Further guidance came in a series of OIG Open Letters to the health care industry in 2006, 2008, and 2009. The updated SDP provisions supersede both the original version and the subsequent Open Letters. More >

Plan for the Worst, Hope for the Best: Why You Must Have a HIPAA Risk Assessment

“The single biggest and most common compliance weakness is the lack of a timely and thorough risk analysis.” More >

Tools for the Trade: Understanding HIPAA

As a result of the intricate details and requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), it comes as no surprise that HIPAA Privacy and Security Rules can cause challenges and confusion for even the most sophisticated providers. With this in mind, the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) has recently provided tools meant to educate both consumers and providers on HIPAA. More >

Association Group Coverage Changes

Trade Associations in Kentucky are being asked to show that they meet ERISA “bona fide association” requirements in order to continue to provide group health insurance for their members under health reform requirements effective in 2014.  Such group health insurance may be a more affordable option for some businesses as new health reform requirements begin to take effect. More >

Doe v. Guthrie Clinic, Ltd.: A New Privacy Battleground?, cont.

Earlier this week, I mentioned the Doe v. Guthrie Clinic, Ltd.[1] case and what it may mean for provider liability. In a nutshell, the plaintiff in Guthrie seeks to extend the fiduciary duty of patient confidentiality beyond the licensed provider to the medical corporation, including hospitals and medical practices.  Under the proposed theory, the hospital or medical practice could be held directly liable for the unauthorized disclosure of patient information regardless of whether an employee disclosed the information within the scope of employment.  In other words, the unauthorized disclosure of patient information would be attributed to the medical corporation, which acting through its representatives, breached patient confidentiality. More >

Doe v. Guthrie Clinic, Ltd.: A New Privacy Battleground?

Most health care providers are aware of the significant liability implications of a breach of protected health information, including, in some cases, the cost of issuing a breach notification to affected individuals.  Providers have not, however, faced significant liability from patient lawsuits filed directly against a hospital or medical practice for damages arising from a breach of confidentiality.  The reason is that patients face an uphill battle when suing a hospital or medical practice directly because most laws that protect patient information, including HIPAA, do not provide a private right of action for patients to sue the provider. More >