On August 13, 2014, the Government Accountability Office (GAO) released a report criticizing the handling of post-payment claims reviews by auditors for the Centers for Medicare and Medicaid Services (CMS). The report, entitled, “Medicare Program Integrity: Increased Oversight and Guidance Could Improve Effectiveness and Efficiency of Postpayment Claims Reviews,” highlighted specific flaws within CMS’s Medicare contractors, a group of private auditing organizations that have recently come under scrutiny from members of Congress and healthcare providers based on allegations of burdensome post-payment review requirements and the resulting financial strain.¹ Utilizing interviews and documentation from CMS officials and representatives from the contractors, the GAO report provided four broad recommendations to CMS to improve the Medicare post-payment claims review process:

1. Require and monitor that all Medicare contractors submit required data to the Recovery Audit Data Warehouse (RADW), a mechanism to prevent duplicate reviews;
2. Develop “complete guidance” regarding the ability of Medicare contractors to conduct duplicate claims reviews;
3. Clarify the standards and requirements for Medicare contractor correspondence to providers during a post-payment claim review; and,
4. More thoroughly monitor and audit Medicare contractors regarding compliance with standards for Medicare contractor correspondence.²

As mentioned in a December 2013 Health Capital Topics article, entitled, “Emboldened Government Pursuit and Prosecution of Healthcare Fraud and Abuse,” CMS created the Medicare contractor programs to assist other federal efforts in identifying and pursuing healthcare fraud and abuse.³ Additionally, the Medicare contractor program works to “ensure that payments are made correctly the first time and to identify, investigate, and recoup payments made in error.”⁴ These twin aims of the Medicare contractor program work to offset what the GAO describes as the “high-risk” nature of the Medicare program, particularly due to its “size, complexity, and susceptibility to mismanagement and improper payments.”⁵ The GAO estimates that CMS made $36 billion in improper payments for fee-for-service (FFS) claims under Medicare Part A, which covers hospital and other inpatient stays, and Medicare Part B, which covers physician, hospital outpatient, home healthcare, the rental and purchase of durable medical equipment (DME), and other services.⁶

As part of its effort to recoup overpayments and fraud and abuse within the Medicare program, CMS utilizes four types of post-payment claim review contractors to check for improper payments and fraud. The most commonly utilized post-payment review organization is the Recovery Audit Contractor (RAC). RACs “conduct postpayment claims reviews to identify improper payments” through manual searches and computer programming software to identify outlier payments and irregular billing patterns for particular providers.⁷ From 2011 to 2012, the number of RAC-conducted post-payment claims reviews increased from 1.35 million to over 2.34 million,⁸ while post-payment claims reviews conducted by RACs in 2012 recouped over $2.29 billion in improper payments made under the Medicare program.⁹ Along with RACs, three other Medicare contractor programs conduct post-payment claims reviews under the authority of CMS. The Medicare Administrative Contractor (MAC) also conducts post-payment claims reviews in order to “identify ways to address future payments errors” through: (1) automated controls to claims that may be applied before payment; and, (2) educating providers about common errors in coding and the claims submission process.¹⁰ The Zone Program Integrity Contractor (ZPIC) utilizes post-payment reviews as part of their mission to detect Medicare fraud. ZPICs identify these potentially fraudulent providers by comparing “billing patterns (that) are unusual or aberrant in relation to those of similar providers” to determine whether these claims show potential evidence of fraud.¹¹ Finally, the Comprehensive Error Rate Testing (CERT) program conducts post-payment claims reviews to estimate the actual amount of an improper payment on a claim in order to support CMS’s compliance with improper payment reporting.¹²

The GAO report found that each type of Medicare audit contractor uses a similar, though not uniform, process to conduct post-payment claims reviews. First, each type of contractor selects a claim (or set of claims) to review from a provider.¹³ Each post-payment review contractor utilizes different criteria to determine whether to review a particular claim or set of claims.¹⁴ For example, while MACs select claims based on the history of improper billing for a particular provider, RACs select claims for review based on “data analyses of all paid claims” that reveal potential improper payments.¹⁵ The GAO report noted that selection of claims based on different criteria can lead to duplicate post-payment claims reviews by different Medicare audit contractors.¹⁶ In response to the potential for duplicated reviews, CMS developed the RADW to prevent RACs, who perform the largest number of claims reviews, from performing its reviews on claims already reviewed by other contractors.¹⁷

After selecting a claim for review, each Medicare contractor notifies the provider who submitted the claim (or set of claims) that the contractor is performing a post-payment review on a provider’s claim(s).¹⁸ In its notification to the provider, the contractor includes an Additional Documentation Request (ADR) to the provider, which informs the provider of its right to submit further proof from the medical record in question to support the claim being reviewed.¹⁹ After either a contractor reviews additional documentation from the provider or the timeframe for documentation submission has passed, the contractor conducts its full claim review to determine whether Medicare improperly paid the provider for the claim(s).²⁰ If the contractor concludes that Medicare overpaid the provider for the claim(s), then the contractor will send a “demand letter” to the provider seeking the return of the overpayment.²¹ If the contractor concludes Medicare underpaid the provider for the claim(s), then the contractor will “return the balance in a future remittance.”²² As mentioned in a July 2014 Health Capital Topics article, titled “Congressmen Question Reach of Fraud & Abuse Enforcement,” the provider may appeal the contractor’s determination through a four-step administrative appeals process within CMS, although this process has become backlogged due to the increase in post-payment claims reviews by Medicare contractors.²³

In response to Congressional scrutiny regarding the appeals backlog, the wide breadth of the RAC program, and the burden on providers resulting from post-payment claims reviews by Medicare contractors,²⁴ the GAO began a year-long investigation into the Medicare contracting program and its operations. The investigation revealed problems attributable to both CMS and its Medicare contractors, including duplication of claims reviews, unclear correspondence to providers, and ineffective quality controls on the post-payment claims review process, including internal quality controls within Medicare contractor organizations, as well as external quality controls conducted by CMS.

First, the GAO noted numerous issues regarding duplicate claims reviews, including usage of the RADW system and the lack of CMS guidance regarding duplicating review. In its investigation, the GAO discovered more than half of all ZPICs did not enter reviewed claims into the RADW System, which prevents RACs from affirmatively knowing if they are duplicating reviews on claims.²⁵ Further, only RACs can utilize the RADW system to check for previous post-payment claim review, a glitch that prevents MACs, ZPICs, and CERT contractors from verifying if a claim has been reviewed.²⁶ According to the GAO Report, this gap in internal oversight ability makes the RADW data “not sufficient and reliable” for use as a resource to prevent duplicate claims reviews.²⁷

Compounding these duplicate reviews problems, the GAO noted CMS also lacks useful guidance regarding the appropriateness of duplicating post-payment review on a claim. For MACs, the GAO report discovered a discrepancy between appropriate standards for duplicating a review by another Medicare contractor. While one CMS official stated to the GAO that MACs must check the RADW to prevent duplicate reviews,²⁸ CMS’s written guidance to MACs states that MACs are only prohibited from duplicating ZPIC claims reviews and “does not address whether MACs are expected to check the (RADW) to prevent duplication.”²⁹ Further, the GAO report noted written guidance for RACs and CERT contractors regarding duplicate review differed materially: while RACs must utilize the RADW to verify the number of reviews on a claim, CERT contractors are not required to utilize the RADW to avoid duplicating reviews.³⁰ The GAO noted that these inconsistencies regarding duplicate reviews “can leave providers confused about whether a duplicate review is appropriate,” a sentiment reflected by the American Hospital Association in its July 9, 2014 statement to the U.S. Senate’s Special Committee on Aging.³¹

Second, the GAO report found that inconsistent standards in correspondence from Medicare contractors to providers reduced the effectiveness of the Medicare contractor programs. In particular, the GAO report focused on the variance between the ADRs of Medicare contractor programs sent to providers. The GAO discovered that some elements of ADRs sent to providers, including the contractor’s name, the contractor’s address, and an indication of the ADR’s connection to CMS or the Medicare Program, are necessary for MACs & ZPICs, but not CERT contractors and RACs.³² In addition, the GAO noted that ADRs sent to providers by ZPICs and CERT contractors are not required to include information as to “reason for selection” or whether there is “good cause to reopen the claim.”³³ Moreover, only ADRs from CERT contractors are required to affirm that the release of medical records supporting the claim in question to the CERT contractor does not violate the Health Insurance Portability and Accountability Act (HIPAA).³⁴ The GAO argued that these findings place burdens on providers and inhibit a provider’s ability to fully “understand their responsibilities in responding (to an ADR) or their rights if their claims are denied.”³⁵ The GAO’s findings regarding contractor ADR inconsistencies echo a similar claim from the U.S. Senate’s Special Committee on Aging that “the significant inconsistency in contractor requirements places additional burdens on providers to ensure compliance with these varying requirements.”³⁶

In addition to inconsistencies in CMS standards for contractor correspondence, the GAO also found instances of noncompliance from Medicare contractors regarding current correspondence standards. According to the GAO report, 100% of CERT contractor ADRs, 50% of MAC ADRs, and 30% of ZPIC ADRs improperly stated the time window required to submit additional documentation.³⁷ Further, no post-review letter from a RAC to a provider included the required statement of “reason for conducting the review or the rationale for good cause for having reopened the claims.”³⁸ The GAO also cited MACs for a number of noncompliance patterns. For example, only 27% of result letters sent by MACs after a review “explained the procedures for recovering overpayments, including Medicare’s right to recover and charge interest on overpayments,” a requirement under CMS guidelines.³⁹ Additionally, 55% of result letters sent by MACs told providers of their right “to submit a financial rebuttal statement within 15 days of the date on the (result) letter.”⁴⁰ The GAO noted that these and other instances of noncompliance by CMS post-payment contractors may prevent providers from properly “exercising their rights within required time frames, which could have financial consequences for them.”⁴¹ The GAO report also attributed noncompliance issues to variances in the thoroughness of CMS examination of internal quality reviews performed by Medicare contractors.⁴²

Responses to the GAO report have been varied. While provider groups such as the American Hospital Association commended the GAO report, the American Coalition for Healthcare Claims Integrity, an organization representing the interests of many RACs, released a statement highlighting the role Medicare contractors play in promoting the “Medicare Trust Fund’s solvency,” including recovering over $8 billion in Medicare funds over the past five years.⁴³  Further, although CMS concurred with the four recommendations by the GAO, it is still unclear to what extent, and on what timeline, CMS will implement the recommendations from this and other reports regarding the Medicare contractor programs. On June 2, 2014, CMS established the Provider Relations Coordinator, an entity within CMS that works to “increase program transparency and offer more efficient resolutions to providers affected by the medical review process.”⁴⁴ While CMS suggests that providers raise issues with specific claims reviews with the Medicare contractor, CMS envisions that the Provider Relations Coordinator is available for providers to “raise larger process issues” with the post-payment claims review process.⁴⁵ Coinciding with the creation of the Program Relations Coordinator, CMS restarted RAC reviews on August 4, 2014.⁴⁶ Since then, there has been a gradual increase in the number of RAC reviews conducted nationally.⁴⁷ Providers may be wise to allocate resources appropriately to prepare for the likely rise in new RAC and other post-payment claims reviews by Medicare contractors in the near future.

The latest GAO report on Medicare contractors conducting post-payment claims reviews also support the efforts of healthcare providers to encourage institutional and contractor compliance with the regulations and standards for the Medicare program.  Along with the most recent report by the GAO, previous reports and guidance by government entities, including the GAO, CMS, and the Office of Inspector General (OIG), can be used as the latest resource for healthcare providers and suppliers to develop compliance training programs and workplace procedures that promote institutional efficiency and clean claim submission as well as identify instances of noncompliance by Medicare contractors during post-payment claims review. For example, the GAO report details many of the requirements regarding contractor correspondence with providers, as well as the timelines for document submission and review. Providers can train staff members that handle post-payment claim reviews of Medicare contractors on these standards, utilizing the GAO report as guidance for the development of this training. The various provisions within this GAO report, as well as other sources detailing contractor requirements, including the actual contractor guidance from CMS, may serve to support improvements in how providers handle post-payment claims reviews.