Reprinted from REPORT ON MEDICARE COMPLIANCE, the nation's leading source of news and strategic information on false claims, overpayments, compliance programs, billing errors and other Medicare compliance issues.

A ton of money is at stake on the compliance front, as hospitals learn to cope with the overhaul of the DRGs while fending off challenges to paid claims from recovery audit contractors (RACs) and to long-standing reimbursement streams, such as graduate medical education (GME) and provider-based entities. And that's just for starters - compliance officers have their plates full. But just what are the top 10 challenges? Larry Vernaglia and Maria Gonzalez Knavel, two attorneys from the law firm Foley & Lardner LLP, posed this question recently to about 50 experts: compliance officers, consultants and attorneys who work on compliance issues in private practice and as in-house counsel.

The goal was to help compliance officers focus their auditing and monitoring. "A lot of attention is spent putting out fires, but you also have to plan what you will review," says Vernaglia.

Here's the consensus on the top 10 hospital compliance challenges according to their survey, along with tips from Boston-based Vernaglia and Milwaukee-based Gonzalez Knavel:

1. RACs: These contingency-fee auditors have recovered so much money that they influence other Medicare auditors to be more aggressive and to "have an orientation leaning towards simply collecting money, not making accurate payment decisions," Vernaglia says. He and Gonzalez Knavel urge hospitals to assemble a multidisciplinary RAC response team to prepare for these auditors. Among other things, the team should develop a process to review RAC audit findings. "Hospitals should evaluate their trigger points to build a record of winning. If they don't, they will get the death of a thousand cuts" - with RACs hitting the same coding or medical-necessity issue over and over, Vernaglia says. "But if you win early on, you send a message to the RAC" that your hospital has its act together. Also, while CMS pays RACs for identifying both overpayments and underpayments, the deal is not the same. On the underpayment side, RACs receive a contingency fee only for flagging a partial underpayment (e.g., a missed complication/comorbidity or major CC), he says.
   
   
2. Supplemental and certification payments: Regulators and enforcement agencies "continue to be interested in the additional money hospitals get in excess of DRGs," Vernaglia says. There are two ways hospitals get extra payments: (a) through special certification status (e.g., provider-based entities, long-term care hospitals, critical-access hospitals), which means compliance with a special set of rules; and (b) supplemental payments, such as outliers for resource-intensive patients, GME, Medicare bad debt and disproportionate share hospitals. "We have seen a lot of these issues paid attention" to by the government, he says. In terms of supplemental payments, for example, provider-based payments are a ripe area for audit. The Medicare rules governing them went into effect with the advent of the outpatient prospective payment system in 2000, and since then intervening factors (e.g., operational changes) may have knocked compliance out of whack. Similarly, CMS has made almost constant adjustments to the way it pays for GME. "OIG did a bunch of audits of these complex, ever-changing rules," says Vernaglia. "Then Medicare auditors are coming in and unpacking GME reimbursement for disallowance through the Notice of Program Reimbursement," which is how Medicare fiscal intermediaries settle up after cost-report audits. "They are coming in and doing take-backs," he says, especially in the area of resident training off-site with physicians who volunteer their time. (And now CMS is stopping all Medicaid payment for GME.)
   
   
3. Medicaid compliance: With CMS's Medicaid Integrity Program, increased OIG funding for Medicaid audits and investigations, new state false claims laws enacted partly in response to financial incentives dangled by the Deficit Reduction Act and aggressive Medicaid Inspector Generals in almost 10 states, Medicaid is a top enforcement priority. In response, hospitals' compliance programs must adjust to account for this new onslaught.
   
   
4. Stark self-referral ban: More Stark enforcement is predicted, initiated by the government without whistle-blowers now that the Phase III of the Stark II law has been finalized. "The closer we get to rules that are more definitive, the easier it is for prosecutors" to make cases, says Gonzalez Knavel. Since Stark is not an intent-based statute - a hospital violates Stark if it bills Medicare for designated services referred by a physician with whom it has a financial relationship that does not meet a Stark exception - enforcers get a big leg up from final rules. However, providers are still waiting for CMS to finalize provisions originally proposed in the 2007 Medicare physician fee schedule. This includes the crackdown on so-called "under arrangements". Stark compliance will take on added prominence assuming CMS gets the Office of Management and Budget's (OMB) approval to move forward with the Disclosure of Financial Relationships Report. OMB's approval is required by the Paperwork Reduction Act.
   
   
5. Present-on-admission (POA)/hospital-acquired conditions: Starting Oct. 1, hospitals won't get paid for eight conditions that are hospital acquired. Some are the result of hospital error (e.g., object left in patient during surgery), but others "are rather difficult to control," Vernaglia says, such as catheter-associated urinary tract infections. Making sure hospitals don't lose payments for the eight conditions that were POA and not hospital acquired will require frequent communication among coders, auditors, nurses and physicians, as well as better MD documentation. Hospitals also are going up the learning curve on the other new Medicare mandate around POA: reporting one of five POA indicators for virtually every principal and secondary diagnosis code.
   
   
6. Medicare-severity DRGs (MS-DRGs): "This is one area where there is material economic impact to the way DRGs are coded. Anything new and complicated will create mistakes," Vernaglia says. "It's a formula for a compliance problem, and compliance officers should be vigilant." As always, perhaps the biggest challenge is motivating physicians to adapt documentation to the new, more detailed coding required for CCs and major CCs.
   
   
7. Clinical trial billing, especially at community hospitals: With research expanding to community hospitals, compliance with CMS policy on billing Medicare for covered services provided during a clinical trial deserves more scrutiny, says Gonzalez Knavel. After trying to tinker with it, CMS left the fundamentals of the 2000 National Coverage Decision on clinical trial billing in place. When beneficiaries are enrolled in qualified clinical trials, hospitals can charge Medicare for routine services and treatment stemming from complications as long as trial sponsors aren't already paying for them (that's a simplified version of the coverage policy). Now that physicians at community hospitals increasingly participate in clinical trials sponsored by pharmaceutical and device manufacturers, she says, hospitals have to tackle very challenging compliance issues. For example, how does the hospital determine when a patient is part of a clinical trial? What goods and services get billed to Medicare versus to the sponsors? "Unless someone really oversees the process, things can get billed to Medicare [inappropriately]," Gonzalez Knavel maintains. Hospitals are trying to identify and monitor the research activities conducted in their facilities by implementing processes to ensure effective communications among the institutional review board, compliance department, billing department and medical staff office. The goal is to create red flags so a Medicare beneficiary enrolled in a clinical trial is identified, and an employee well-versed in clinical-trial billing policy can pull out services that can be billed to Medicare, she says.
   
   
8. Board involvement: "Awareness and attention to the oversight duties of the board have never been greater," Vernaglia says. "Boards will become more educated on compliance and be held accountable, and when they fail to do so, that will be held up as evidence of a failed compliance program. We are aware of a case where that was laid out as a factor for damages." Clearly OIG wants to get boards' attention; consider the number of guidance documents released in the past six months by OIG in cooperation with the American Health Lawyers Assn. and the Health Care Compliance Assn. Board members should ask managers the kinds of questions cited in the OIG documents.
   
   
9. Data mining: With CMS applying sophisticated analytic tools to huge claims databanks to track down billing aberrations, hospitals should consider data mining in their own compliance programs. "There is a ton of comparative data out there [that can be helpful] if you know how to crunch the numbers," Gonzalez Knavel says. Some is specific to hospitals, such as Program to Evaluate Payment Patterns Electronic Report (PEPPER) data provided by Medicare quality improvement organizations. Other data may be at only the state level (PERM) or contractor level (CERT), but it will give hospitals a sense of problems in their region and what their program-integrity contractors will focus on.
   
   
10. Quality: Harking back to Bill Clinton's presidential campaign, Vernaglia says, there's a feeling out there that "it's the quality, stupid," meaning quality is by far the dominant theme. "It's the buzzword in payment and compliance." CMS has made the connection between payment and quality by requiring hospitals to report data on certain clinical protocols in exchange for receiving the full marketbasket update. Now CMS wants to adopt value-based purchasing, which means hospitals start the year 5% down in DRG payments and have to earn it back through proof of quality of care. "Hospital compliance programs should have quality oversight under their umbrella," which includes performing quality audits, he says.

Copyright © 2008 by Atlantic Information Services, Inc. Reprinted with permission from Atlantic Information Services, Inc.,
1100 17th Street, NW, Suite 300, Washington, D.C. 20036, 202-775-9008, www.AISHealth.com