Audits said to put hospitals on track

If the auditors at the inspector general's office of HHS had unlimited time and resources, they would like to launch focused audits on all 3,600 or so community hospitals that receive Medicare payments.

The office, however, lacks such a luxury in the real world. So auditors have had to content themselves with an ongoing series of focused compliance reviews of hospitals. At least 87 hospitals have been chosen for review, partly through data-mining, examining as many as 30 common error-prone types of Medicare bills.

“If we had adequate funds, we'd like to get all 3,600 hospitals because we really do think it is helping hospitals comply with the rules,” Brian Ritchie, an assistant inspector general with HHS, said in an interview. “We have all eight of our regional offices working on this.”

In written comments, many of the hospitals have thanked the office for professionalism and helpful feedback.

Most of the audit targets contacted by Modern Healthcare declined to comment or didn't return calls, but the experiences described by the executives who did respond suggest those formal letters don't tell the whole story.

Officials at two hospitals said the auditors didn't seem knowledgeable about the complex healthcare coding issues facing the industry. And they said the final audit reports were written to make it seem as though something other than human error may have led to billing disputes.

“Bottom line, I was not impressed with the entire process, and much of it was caused by the auditors assigned to us not having the appropriate expertise to do a healthcare audit,” Christine Newgren, University of Colorado Health chief compliance officer, said in an e-mail.

And it's not clear how the inspector general's office was selecting the hospitals that were singled out for the audit treatment.

Hospitals received about $168 billion in 2011 to care for Medicare beneficiaries, and an untold portion of that 12-figure sum was lost to waste, fraud and abuse—some of it intentional and some not, officials say.

To date, the office has released the results for about 42 hospital Medicare compliance audits, and another 45 are in progress. The efforts have returned about $20 million to Medicare so far, or about $480,000 per audit. Investigators say each noncompliant claim for Medicare services averages about $1,700 in overpayments.

“We have to pay attention to where the money that is paid to hospitals is going,” Office of the Inspector General Chief Counsel Greg Demske told a banquet hall full of health lawyers and compliance officials this month at the annual Fraud and Compliance Forum in Baltimore. “As we do more of these, we further refine how we engage in these audits.”

In written responses to auditors available publicly, many of the hospitals thanked the inspector general's office for its work and admitted that the issues brought to light by auditors should have not have been billed as they were.

For example, officials with 339-bed West Florida Hospital, an HCA facility in Pensacola, agreed to repay $172,995 after concurring with the auditor's finding that 151 of the 208 claims reviewed by investigators contained billing errors.

“We appreciate the OIG's audit review for the 2009 and 2010 years,” Chief Financial Officer Randy Butler wrote to the agency in a May 31 letter that also outlined how staff received additional training and internal policies were beefed up after the probe.

Stephanie Barnes Taylor, the chief legal officer for 381-bed Singing River Hospital in Pascagoula, Miss., was not so sanguine.

She said she still remembers the feeling when she learned in August 2011 that the inspector general's office had some questions about the documentation to support $3.4 million in Medicare payments the hospital received between 2008 and 2010.

“Obviously, it is always a bit anxiety-provoking when you get a notice from the OIG about a potential audit,” Taylor, who was chief compliance officer at the publicly owned hospital at the time, said in an interview.

As the auditors took up residence in a conference room at the hospital, she remembered thinking that although the auditors were professional and courteous, they didn't seem well-versed in the complex world of healthcare billing.

“The auditors weren't very familiar with a lot of the processes,” she said.

Singing River officials got the chance to work directly with the auditors before and after they turned over electronic documentation to support the 100 inpatient and 269 outpatient Medicare claims that the inspector general's office had turned up as questionable through data-mining of the hospitals bills. Although Taylor felt the hospital could support all of the bills, auditors ultimately concluded that 192 of the claims lacked supporting documentation.

After a yearlong investigation, the hospital first learned through a public filing—not a direct letter from the inspector general's office—that the auditors had concluded the hospital received $515,651 in overpayments over the three years.

The audit report had two main findings: that the hospital incorrectly billed Medicare for $390,276 worth of small-dose Lupron cancer treatments when larger, less expensive doses were used and that it billed $120,789 for inpatient visits that should have been outpatient stays. The hospital is still contesting the findings with its Medicare Administrative Contractor, which has tried to recoup the payments.

Although the hospital disagreed with both conclusions, auditors noted that they had removed allegations in their original draft report that said physicians had actually prescribed Lupron for reasons other than those approved by the Food and Drug Administration.

Taylor said she was pleased to find the audit “interactive,” but said the government could do more to prevent such reviews in the first place: “I would much rather have a truly educational opportunity where the OIG is coming in and explaining billing rules prospectively, 'Here's how to bill Medicare going forward.' ”

Glen Moyers, an advisory partner with the healthcare practice at auditing and professional services firm KPMG, said hospitals that have not yet been notified of such reviews ought to take the chance now, before an audit letter arrives, to review their internal policies on the specific billing practices outlined by the inspector general.

“I've been advising my compliance officer clients to take a look at this list of risks, map it against your own business, and look in particular at the policies and procedures and monitoring that you are doing in those risk areas,” Moyers said. “Proactively look at the risk areas, understand how they exist in your organization.”

Investigators have homed in on a host of specific kinds of Medicare inpatient and outpatient claims that they say are “at risk for noncompliance,” according to past auditing efforts.

The kinds of things that government officials look at include some unsurprising categories such as short inpatient hospital stays and outpatient bills for evaluation and management services, both of which have been the subject of past public statements and broad investigation efforts by public officials.

The risk areas also include some lesser-known targets, such as outpatient claims for Lupron injections and blood-clotting factor drugs, claims for services in which manufacturers have given hospitals credits for replaced devices, and “outpatient claims billed with Modifer -59,” which involves bundling of payments for separate services.

But the hospitals singled out for review aren't necessarily the biggest offenders in those coding areas.

Moyers, whose practice at KPMG has included several hospitals singled out for review, said the agency is not revealing precisely how it chooses its targets.

“I've observed clients of ours across a broad spectrum that have been selected for these audits. It's unclear to me what the criteria for selection is,” he said. “So I don't think a hospital should be singled out or branded as a result of selection.”

Ritchie said the targets of the investigations don't necessarily have claims targeted for review in each of the high-risk areas.

Rather, investigators mine the HHS' National Claims History database for patterns on which hospitals seem to have rates of use of the inpatient and outpatient codes worth examining. That data is passed on to the inspector general's regional offices, which then make the final decisions about which hospitals to audit.

That means that just because a particular hospital hasn't been selected, officials there shouldn't necessarily infer they have been given “a clean bill of health” by the data-mining, Ritchie said.

Auditors don't pick every claim for a particular service within a two-year window of time, he said. Rather, the goal is to pick a few and use them to instruct the hospital on best practices and prevent any future problems.

“If it's short stays, we're not picking 100 short stays, we're picking a handful and working with them on that,” Ritchie said. “While it does require some time, we do think there is a benefit” to the provider as well as the federal healthcare programs.

David Centafont, a principal with the ForensiCorp litigation support firm in Brisol, Pa., said the sheer volume of auditing work hospitals have to deal with can be overwhelming.

Between RACs, MACs, ZPICs, state-based contractors, and the new program to audit compliance with rules on protected health information, some hospitals may feel that there are “constantly people looking over your shoulder.”

However, if the auditing program is truly intended to be educational, that would seem to be a departure from the offices' past practices, he said.

“It feels like a different hat that the OIG is wearing in that respect. It traditionally has not been their role to educate,” Centafont said. “We can welcome that with some cautious optimism.”