Fraud, Abuse, Over-payment – When Does a Mistake Become Fraud?

If you are involved in any way in the health care system, it should be obvious by now that the government has committed ever increasing resources to the prosecution of fraud and abuse cases. Simply put, from a governmental standpoint, prosecuting fraud and abuse is good business. Every dollar that the government puts into pursuing health care fraud and abuse brings a return of around 7 or 8 dollars. If you are in business what do you do if you know that you can invest $1 and obtain a consistent $7 return on that investment; you spend the $1 as many times as you can. That is exactly what the government is doing when it comes to health care fraud and abuse. It is worthy of note that we are not just talking about pursuing criminals when we talk about health care fraud and abuse.

Certainly there are a lot of criminals out there who are intentionally trying to steal from the system through fraudulent schemes. Fraud and abuse encompasses a much broader type of activity. There are numerous situations where unintentional activity (i.e. a billing or coding error) can result in being overpaid by the federal government under a governmental health care program. I don’t want to say that this happens to everyone in the health care system; but it certainly happens to a lot of people, usually as a result of some sort of neglect or misinterpretation of some very complex regulations. Take for example the supervision rules that are discussed in another article in this newsletter. They are extremely convoluted and it is hard to imagine who every doctor could have it clear in his or her mind which rules apply and exactly what is required in each specific instance. Nevertheless, a billing occurs and if the proper supervision is later found to not be present, an over-payment results. This is an example of what the government considers to be “abuse.” No criminals are involved here, but an over-payment and technical abuse of the system has occurred.

The manner in which this situation is dealt with becomes critically important in determining whether there is a simple correction of the situation or whether it is escalated to higher levels of culpability; whether the simple inadvertent abuse becomes fraud. Let’s skip forward to a time when the doctor discovers that a mistake has been made in the level of supervision that was provided in the past. What happens now it very important. First, lets imagine that the doctor comes forward and admits the error. There is some money owed back to the governmental health program. This part of it will never go away. But lets say that the doctor lets it slide for half of a year and does nothing. Under current law, the doctor’s potential exposure has just escalated into a completely different zone of risk and potential culpability. Federal law says that the Federal False Claims Act applies if an over-payment is not corrected within 60 days after discovery. There are a lot to technical rules about when an over-payment is deemed to have been discovered. I am not going to get into that right now.  the doctor is potentially exposed to three times the original over-payment. But that is not the extent of it. The doctor is also exposed to additional damages in the amount of $11,000 per claim; for every individual service claim that resulted from the initial mistake in complying with the supervision regulations. This case has now escalated from abuse into fraud. From here it is just a matter of establishing intent to make this a criminal case.

False Claims Act Basics – Known Overpayment Become False Claims

The False Claims Act (“FCA”) provides a very strong enforcement tool to the federal government. The FCA also provides the opportunity for whistleblowers to bring “qui tam” cases and collect a portion of the recovery where false claims are proved against the federal government.

FCA recovery was originally intended to provide a remedy against unscrupulous civil war profiteers. Penalties were enhanced when the FCA was dragged off the shelf in the 1980s in reaction to some of the overpricing of government contracts selling supplies to the federal government.

Recently, the FCA has become one of the government’s prime enforcement tools t o deter fraud in the federal health care programs. Historically, the FCA has been available when a health care provider falsely bills for covered services. Triple damages and an $11,000 per claim penalty provide a strong deterrent in an industry that may make hundreds of claims per day.

Recent legislation has expanded FCA liability to claims that the provider knows resulted in an overpayment if the provider does not make repayment within 60 days of obtaining knowledge of the wrongfully billed amount. Some of the potential applications of this that makes a simple overpayment a false claim has generated much discussion among health care lawyers and compliance officers alike. When an organization is deemed to have knowledge of the overpayment has been the subject of much speculation due to the ambiguities that exist in the new rule.

It may be helpful to frame this discussion by touching on the general requirements that must be met in order to prove any claim under the Federal False Claims Act. The three general elements that must be proved include:

1. The submission of a claim to the federal government. In the health care context, the claim will normally be submitted to a government health program.

2. The claim must be false.

3. The claim must have been submitted knowingly. Actual knowledge that the claim was false will always prove the knowledge requirement. However, a FCA case can also be built around the submission of a claim with “reckless disregard” for its truth or falsity.

Recent health care legislation, in particular the Fraud Enforcement Recovery Act of 2009, greatly expanded the scope of the FCA. The FCA is now applicable to a wide variety of situations that would not have previously been covered. For example, the failure to return an identified overpayment now becomes a false claim. The potential remedies that a provider may face for not promptly repaying known overpayments creates a strong incentive for health care providers to monitor and audit their claims and set up processes that will catch improper billing that could ripen into the FCA.

Reckless disregard or hiding your head in the sand like an ostrich is no longer a way to avoid massive potential FCA liability.

Compliance programs need to be amended appropriately to address the new potential legal and financial risk presented by these new penalties.

Proposed 60 Day Repayment Rules Push Providers Toward More Robust Compliance Programs

CMS has released a long awaited proposed rule defining provider obligations to report Medicare and Medicaid over-payments within 60 days of identification.  Section 6402 of the Patient and Program Protection Act created possible False Claims Act liability and possible program exclusion for the knowing concealment or avoidance of a repayment obligation.  The new proposed rule is intended to add definition to the general obligation that was included in the initial statutory provisions.  Section 6402 of PPACA requires providers to report and return over-payments within 60 days of identification.  The original statute broadly defined the provider obligations but did not provide specifics on several topics such as when an overpayment is deemed to be “identified” or how long providers were obligated to look back when identifying potential over-payments.

The Proposed Rule created an extremely onerous look-back period of ten years.  This means that providers will be obligated to report overpayment obligations that they discover which date back as far as ten years from the date of discovery.  The actual disclosure rules are somewhat less oppressive than the self disclosure rules that were already in place with regard to the Anti-kickback Statute and the Stark Law.  Nevertheless, many aspects of the proposed regulations, and in particular the ten year look-back rule, are likely to generate comments from affected parties. The specific requirements of the self disclosure rule leave much room for debate over several issues such as the level of detail that is required to be included in the disclosure.  There will certainly be a lot of debate at upcoming conferences that begin to dissect the specifics of the proposed regulations. 

The 60 day clock once an overpayment has been identified.  The proposed rule considers an overpayment to be “identified” when (i) there is actual knowledge that an overpayment exists, (ii) there is a reckless disregard or deliberate ignorance that an overpayment exists.  There will be a lot of debate over when someone obtains “actual knowledge.”  There will likely be even more debate over when someone begins acting in “reckless disregard” that an overpayment exists.  The “reckless disregard” standard involves an imputation of knowledge to an individual and will revolve over the facts that were present or should have been observed.  This requires a objective imputation of a subject standard of “identification.”  These areas of the law always involve much debate.  The definition that CMS chose for “identification” forces providers to be overly diligent in their proactive efforts to uncover billing inaccuracies.  Virtually any error that goes uncovered and could lead to a repayment could be imputed to the provider under the “reckless disregard” standard.  The entire standard contemplates the use of a diligent system of audits being put in place in order for a provider to demonstrate that they have not acted in deliberate ignorance or reckless disregard of the existence of an overpayment.  The standard that CMS set is just a further indication that the Federal government is attempting to push past the “pay and chase” approach of the past toward a system that requires providers to actively police themselves for errors.

To put this in perspective, failure to report an “identified” overpayment within 60 days opens the provider to liability under the False Claims Act.  The False Claims Act providers for penalties of three times the actual amount of the overpayment, plus between $5,000 and $11,000 per claim.  If a provider discovered a systematic error that may have led to a significant number of claims being overpaid, the amount of financial exposure under the False Claims Act can be very substantial; substantial to the point of presenting a grave threat to financial viability in some cases.  Under the Proposed Rule, reporting and repayment would be required for all  identified within ten years of receipt.  In the case of the discovery of a systematic billing problem, this could require repayment for the past ten years of claims.  If the False Claims Act obligation is applied to the entire look back period, the amount due grows exponentially.

If the proposed rule is finalized in its current form, it should have a very significant affect on compliance activities.  In order to meet the “reckless disregard” standard, providers will need to engage in very robust auditing and monitoring programs; in most cases much more extensive than are currently being utilized.  Some compliance officers tend to rank risk by the degree of potential consequences to the organization.  Risk identification is a function of two factors; the likelihood of a matter occurring and the degree of consequences.  What the CMS overpayment disclosure rules do, in conjunction with the False Claims Act damage computation, is to greatly increase the consequences of systematic billing errors.  The only way for a provider to prevent these errors, or at least create a plausible argument that it was taking appropriate steps to flush out errors, is to implement a robust auditing program.

Keep in mind that these rules do not only apply to large health care providers.  They also apply to individual and small physician practices and other small health care companies.  The potential impact on smaller organizations can be even more severe.  The recent health care reform law made compliance programs mandatory for most providers starting with nursing homes in 2013.  Mandatory compliance programs will extend to other types of providers as regulations are put in place.  In view of the proposed repayment regulations, providers of all size should seriously look at the areas of risk that apply to their operations and implement compliance programs that include an audit plan that is tailored to the provider’s specific risk areas.