During three recent hearings, various members of Congress openly questioned the scope and integrity of federal healthcare fraud and abuse enforcement, remarking that the Centers for Medicare and Medicaid Services (CMS) and other federal agencies have created a “significant burden” on non-criminal providers through overreaching recovery audit programs that seek to reclaim improperly distributed funds from the Medicare program.¹

During two hearings held by the U.S. House Committee on Oversight & Government Reform on May 20, 2014, and July 10, 2014, as well as a roundtable discussion conducted by the U.S. Senate Special Committee on Aging on July 9, 2014, legislators claimed CMS recovery audit programs have created a 28-month backlog of over 450,000 appeals to CMS relating to coverage denials by Medicare auditors,²  which hinders the ability of providers to care for patients.³ The Congressional inquiries primarily examined the operations of the Recovery Audit Contractor (RAC) program, CMS’s most utilized internal auditing program for post-payment claims review,⁴ which has recovered over $8.9 billion in Medicare overpayments since the program’s creation in 2006 but fell under scrutiny as a program unfairly targeting innocent providers.⁵

“We have a policy of where we’re saying you’re guilty until proven innocent,” stated Rep. Mark Meadows, R-NC, during the May 20, 2014, hearing. “We’re all against waste, fraud, and abuse, but what we must make sure of is that we do it under the rule of law.”⁶

As mentioned in a December 2013 Health Capital Topics article, titled “Emboldened Government Pursuit and Prosecution of Healthcare Fraud and Abuse,” CMS auditing programs, along with increasing enforcement of federal healthcare fraud and abuse laws, work to recoup improper payments to providers and punish intentional violators of public insurance programs.⁷ In total, improper payments to criminal and non-criminal providers cost the Medicare program over $50 billion during the 2013 fiscal year.⁸ The Health Care Fraud and Abuse Control (HCFAC) program, a joint program between the Department of Health and Human Services (HHS), the Office of Inspector General (OIG) and the Department of Justice (DOJ) that utilizes the Anti-Kickback Statute (AKS), the Stark Law, and the False Claims Act (FCA) to fight fraud and abuse in the Medicare and Medicaid programs, recouped $4.3 billion during the 2013 fiscal year.⁹ In conjunction with these efforts, the Medicare recovery audit programs have recovered an additional $7.4 billion in improper payments made by the Medicare program from 2010 to the first quarter of 2014.¹⁰

CMS works to reduce improper payments and fraud during three stages of its reimbursement process: 1) provider enrollment; 2) review of claims before payment; and, 3) review of claims after payment. At the provider enrollment stage, CMS categorizes a provider as a certain risk level depending on the industry of the enrollee, e.g. home health agency, private oncology practice, and ambulatory surgery center, among others.¹¹ Additionally, CMS evaluates the past criminal histories of each type of enrollee industry.¹² Depending on the enrollee’s risk level, CMS will perform a background check of the enrollee, which may include site visits, criminal background checks, and confirmation of state licensure satisfaction.¹³ Next, CMS reviews claims submitted by enrolled Medicare providers before providing payment to that provider. CMS employs a Medicare Administrative Contractor (MAC) to perform all pre-payment claims reviews, and these contractors utilize Medicare policy manuals and instructions called “prepayment edits” to judge whether or not a claim satisfies the requirements for Medicare reimbursement.¹⁴

In addition to enrollee and pre-payment reviews, the Medicare program includes four types of post-payment review audit programs to check for improper payments: (1) the RAC program; (2) the MAC program; (3) the Zone Program Integrity Contractor (ZPIC) program; and, (4) the Comprehensive Error Rate Testing (CERT) program. RAC audits use manual searches and computer programming to identify improper payments through mistakes in coding and intentional misconduct, among other causes.¹⁵ When an overpayment is discovered, these auditors may either immediately deny the claim, which requires the provider to return the improper payment, or provide a notice to the provider, alerting them of potentially improper coding on a claim.¹⁶ Upon the RAC’s provision of notice of potential improper coding, the provider has the opportunity to submit documentation in support of the original award to the RAC auditor, which can lead to a full claim denial or an affirmation of proper coding by the RAC auditor.¹⁷ RAC reviews dominated the Medicare recovery programs in 2012, accounting for approximately 2.10 million post-payment claim reviews of a total of approximately 2.34 million reviews.¹⁸

While RAC reviews constitute the large majority of Medicare recovery audits, other recovery audit programs work to identify improper payments during post-payment review. MAC reviews search for payment errors made by providers, and seek to prevent those mistakes in the future by educating providers and adding automatic controls to its pre-payment review process.¹⁹ In addition, CERT reviews estimate the actual amount of improper payments made by Medicare for a particular set of claims initially reviewed by MACs at the pre-payment stage, as well as measure the “payment accuracy” of MACs during pre-payment review.²⁰ Finally, ZPIC audits search for intentional fraud by reviewing claims with significant differences from claims submitted by providers in the same or similar fields, searching for improper coding and active, intentional fraud.²¹

In addition to each of four separate auditing strategies, each Medicare recovery program performs “complex” reviews on Medicare claims, which involve manual examinations of individual claims for proper coding, medical necessity, and reasonableness of the medical service provided.²² Complex reviews often include “any related documentation requested and received from the provider, including paper files” to determine whether the provider submitted the claim properly.²³ Medicare recovery auditors performed over 1.1 million complex reviews in 2012.²⁴

When a Medicare recovery auditor denies a Part A or Part B claim at the pre-payment or post-payment stage, the provider submitting the claim may appeal the denial in an attempt to receive reimbursement for a Medicare claim permanently.²⁵ Providers must exhaust four levels of appeals within CMS before filing for external judicial review.²⁶ CMS contractors conduct the first two levels of appeals: 1) an initial appeal conducted by the MAC that originally processed the claim; and, 2) a second appeal conducted by a Qualified Independent Contractor (QIC).²⁷ The third level of appeal is conducted by an administrative law judge (ALJ) within the Office of Medicare Hearings and Appeals (OMHA), an autonomous group within HHS.²⁸ The final level of appeal within CMS is conducted by the Medicare Appeals Council, whose decisions are final unless challenged in federal court.²⁹ The standard timeframe for delivering MAC and QIC appellate decisions is 60 days after either contractor receives notice of appeal,³⁰ while the standard for ALJ and Medicare Appeals Council decisions is 90 days after each body receives a notice of appeal.³¹

While recovery auditing has recouped over $8.9 billion in improper payments, members of Congress questioned the methods and motives of recovery auditors to recoup improper payments.  The legislators continually voiced their bipartisan concerns about the impact of post-payment auditing by Medicare recovery programs, particularly focusing on: 1) the backlog and overturn rate within the Medicare appeals process; 2) the burden of Medicare recovery audits on small providers; and, 3) inadequate oversight of Medicare recovery auditors from CMS. During the hearing on May 20^th, the U.S. House Committee on Oversight & Government Reform stated that audits under these programs had created a backlog of over 460,000 appeals within OMHA that would take over 28 months to fully adjudicate, much longer than the standard 90 days.³² Further, according to written testimony from Brian Ritchie, OIG Assistant Inspector General for Audit Services, providers who appealed their coverage denials to OMHA have won their appeals at a rate of 56%.³³ This provider appeal success rate at OMHA troubled legislators, especially in light of the 20% provider success rate at the QIC level, and prompted some legislators to question the integrity and consistency of the appeals process.³⁴ “The due process system is clearly broken,” Rep. Michelle Lujan Grisham, D-NM, stated at the hearing.³⁵

Noting that “the vast majority of all physicians are not fraudsters and are deeply dedicated to the care of their patients,” committee members challenged CMS to lessen the backlog caused by post-payment auditing by Medicare recovery programs to avoid a “lose-lose situation” for providers and beneficiaries.³⁶ “Many of the smaller providers couldn’t afford to appeal,” stated Rep. Lujan Grisham, citing unidentified providers in her district.³⁷ Rep. Lujan Grisham also noted some providers fear “intimidation and retaliation and just pay or do whatever it is they are asked to do at the next level (of appeal).”³⁸ Rep. James Lankford, R-OK, voiced the concerns of numerous members of the committee, who fear that providers, in response to this burden, would opt out of the Medicare program:

“We’re advocates to make sure that we don’t lose providers, that our seniors still have access to multiple providers out there, that there aren’t providers that say it’s not worth it” to participate in the Medicare program.”³⁹

Throughout the hearing, committee members attacked RAC auditors as the cause of many of the issues facing providers in CMS’s aim to recoup improper payments. Rep. Lankford noted that the contingent fee structure of RAC payments, which allows RACs to receive payment only after successfully spotting an improper payment and winning on appeal, encourages RACs to deny a higher number of claims. Rep. Lankford stated:

“These recovery audits, given that is there is a contingency fee where they’re being incentivized to identify issues and problems, this creates a ripe environment for what I think (CMS has) today.”⁴⁰

Testimony submitted by the Government Accountability Office (GAO) noted that RACs nationally increased the number of reviews from 1,358,097 in fiscal year 2011 to 2,107,455 in fiscal year 2012, an increase of 55%.⁴¹ The GAO testimony attributed the backlog of Medicare appeals at OMHA to the increase in RAC and other post-payment reviews since 2011.⁴²

Different groups offered various solutions to solve the issues surrounding Medicare recovery audit programs. The U.S. Senate Special Committee on Aging recommended CMS: 1) solidify the pre-payment review process in order to reduce the prevalence of the “pay-and-chase” model in the current system of Medicare recovery audits;⁴³  2) hold contractors accountable to CMS in the implementation of “contractor error rate reduction plans;”⁴⁴ and, 3) reduce incentives for identification of improper payments by RACs at the expense of actually reducing improper payments before a claim is distributed.⁴⁵ Further, according to Dr. Shantanu Agrawal, Deputy Administrator and Director at the Center for Program Integrity at CMS, the agency is considering strategies that “ratchet down” the intensity of review for providers who have adequate basis for their claims, as opposed to what he described as the “ratcheting up” approach taken toward criminal prosecutions under the fraud and abuse laws.⁴⁶ “As providers get audited and it turns out that their claims are substantiated, (then) we can perhaps audit them less,” Dr. Agrawal stated to the Oversight Committee at its May 20^th hearing. Additionally, the OIG suggested that CMS develop more comprehensive policies and guidance in regard to its conflict of interest policies for ZPICs⁴⁷ as well as clarify vague provisions in Medicare policy manuals consistently interpreted differently during the Medicare appeals process.⁴⁸

CMS has published limited changes to the RAC program, including withholding of a contingency fee payment until the QIC appeal process has been exhausted and variances on documentation request limits based on type of claim and provider.⁴⁹ These changes will be implemented when the agency designates a new group of RACs later this year.⁵⁰ Additionally, RACs are currently barred from initiating new claims reviews until the new RACs are appointed by CMS, although the current RACs are expecting to update the status of claim reviews and provider appeals filed before June 1, 2014.⁵¹ Providers may continue to receive post-payment audits from MAC, ZPIC, and CERT auditors during the suspension of RAC audits, and may continue to conduct appeals from RAC reviews submitted before June 1, 2014.⁵²