Urgent message: The escalating pressure on the industry to decrease health care costs has resulted in an increase in audit activity from government and private payors for everything from billing and coding to HIPAA and kickbacks. Therefore, it’s more important than ever for urgent care centers to build a culture of compliance.
DAMARIS L. MEDINA
The health care industry is in the throes of a dynamic regulatory enforcement climate. Federal and state regulators and third-party payors continue to closely examine the books and operations of health care providers. This high level of scrutiny will only increase with the continuing roll-out of health care reform, which is expected to accelerate the current boom in urgent care.
As the popularity of urgent care centers continues to rise, the industry will find itself at the center of a massive regulatory enforcement storm. A comprehensive compliance program will be more essential than ever.
Each urgent care center has a unique culture. As a result, it is important for centers to identify their risk areas and structure their compliance programs to address their particular needs.
Identifying your center’s risk areas The first step to becoming compliant is to identify the areas of risk for your urgent care center. These will typically include coding and billing, reasonable and necessary services, documentation, kickbacks and self-referrals, and HIPAA violations.
Coding and Billing. Potential problems in your coding and billing may include:
- Billing for items or services not rendered or not provided as claimed;
- Double billing resulting in duplicate payment;
- Billing for non-covered services as if covered;
- Knowing misuse of provider identification numbers, which results in improper billing;
- Unbundling (billing for each component of the service instead of billing or using an all-inclusive code);
- Failure to properly use coding modifiers;
- Clustering; and
- Up-coding the level of service provided.
Reasonable and Necessary. An urgent care center must evaluate itself to determine whether claims are being submitted only for services that the center finds to be reasonable and necessary in a particular case. If not, additional training is called for. Medicare and insurance plans may deny payment for a service that is not reasonable and necessary according to the Medicare reimbursement rules. The denial of one claim may provide the impetus for a full audit.
A determination of “reasonable and necessary” is based on evidence-based standards of care for professionals working in an urgent care center environment. As an example, a center should critically evaluate whether a particular medical test is reasonable and necessary under the particular circumstances arising from a specific patient’s visit. A large number of claims related to tests and ancillary services are denied when diagnosis codes do not match procedure codes. An urgent care center’s compliance program should provide guidance that claims are to be submitted only for services that are reasonable and necessary in a particular case to address this.
Poor Documentation. One of the most visible risk areas is the appropriate documentation of diagnosis and treatment. An urgent care center must evaluate its documentation practices. Proper documentation verifies that a bill is accurate as submitted. Potential problems may include:
- Illegible or incomplete medical records;
- Documentation of each patient encounter that does not include or is deficient in providing the reason for the encounter; relevant history; physical examination findings; prior diagnostic test results; assessment, clinical impression or diagnosis; plan of care; and date and legible identity of the observer;
- Medical records that lack documentation from which an independent reviewer or third party who has appropriate medical training could easily infer the rationale for ordering diagnostic and other ancillary services;
- Lack of documentation and medical records to support the CPT and ICD-9-CM codes used for claim submission; and
- Failure to identify appropriate health risk factors and patient progress, response to treatment, and any revisions in patient diagnosis.
An urgent care center must also examine its policies for corrections or amendments to medical records because it is unlawful to make false entries or to delete any entries from these records. Any additions, corrections or amendments must be made in accordance with accepted standards and principles and law. Records must never be destroyed, altered or removed from the premises unless authorized and consistent with office policy.
Kickbacks and Referrals. An urgent care center must also evaluate its standards and procedures for compliance with the anti-kickback statute and the physician self-referral law (also known as the Stark Law). It should determine whether it has policies in place that address:
- Financial arrangements with outside entities to which the practice may refer business;
- Joint ventures with entities supplying goods or services to the urgent care practice or its patients;
- Consulting contracts or medical directorships;
- Office and equipment leases with entities to which the center refers; and
- Soliciting, accepting or offering any gift or gratuity of more than nominal value to or from those who may benefit from referral of business.
HIPAA. In addition to evaluating the usual HIPAA risk areas, such as protection of patient health information, destruction and transmission procedures, and notification procedures in the event of a breach, an urgent care center must evaluate its practices to make sure that it is compliant with the additional requirements put in place by the HIPAA Rule that became effective on March 26, 2013. That includes, among other things, the need to amend all business associate agreements with contractors, vendors and service providers, such as billing companies.
Finding shelter in your compliance program
A well-crafted compliance program is a thorough set of documents, policies, and practices that ensures that an urgent care center complies fully with all federal, state, and local laws that apply to its operations; the conditions of health care programs funded by the government; and the conditions imposed by third-party payors.
Compliance programs promote early detection, reporting, and remediation of fraudulent conduct, as well as efficient staff communication and training. They demonstrate a clear commitment by an organization to abide by professional, legal, and ethical standards of practice.
All employees and physicians should make reasonable good faith efforts to closely engage with a compliance program, maintaining a high level of integrity and honesty in their dealings within the urgent care center and with outside third parties. Employees and physicians should avoid any conduct that could adversely reflect the integrity of the urgent care center.
Even if an urgent care center already has a compliance program in place, it must be periodically reviewed by counsel to make sure that it is updated to reflect changes in the law, or changes to the center’s operations.
Centralized Compliance Efforts. A successful compliance program should be centralized under the control of a specific individual with authority and sufficient resources to address its design, operation and monitoring. In a larger organization, that person can be a chief compliance officer who reports directly to the CEO and enjoys the support of a compliance committee. A compliance committee can be composed of physicians in different specialty groups and staff working in different facets of the center’s operations. In a smaller urgent care center, the person charged with oversight of compliance can be a qualified physician director, a business manager, or an operations manager. All three could form an ad hoc compliance committee. This function could also be assigned to the center’s outside counsel.
The responsibilities of the person in charge of compliance include:
- Development and monitoring of the compliance program;
- Ensuring that all staff members are trained in fraud prevention;
- Ensuring that physicians and vendors are trained in fraud prevention;
- Investigation of any issues regarding quality of care, vendor relationships, employee screening, patient rights, billing, and record-keeping and retention;
- Investigation of possible fraudulent activity;
- Reporting any potential illegal activity or ethical violations to the appropriate person or entity; and
- Development and implementation of any policies and procedures with respect to ongoing program enhancement.
The urgent care center must take the proper steps to make sure that the authority for fraud and abuse prevention is delegated to an individual with no criminal, civil, or administrative violations.
- Essential education and training. Education and training are an important part of any compliance program. This process involves three basic steps: Determining who needs training. Everyone will need some training in the general concept of compliance with regulations and the duty to report. Individual physicians and staff will need additional training depending on their responsibilities within the urgent care center.
- Determining the type of training that best suits the urgent care center’s needs, such as seminars, in service training, self-study or other programs; and
- Determining when and how often education is needed and how much each person should receive. Formal training upon hire and annually thereafter is a good idea.
Training in compliance should focus on the importance of complying with all applicable statutes, rules, regulations, and policies. Additional training should address documentation, coding and billing requirements.
Outside of official training sessions, standards of conduct, policies and procedures should be published and well-publicized via the employee handbook, newsletters and materials posted within the center. They should be available in the organization’s business and human resources offices.
Guidelines can be posted on the center’s website – either on the main site where they can be viewed by patients and vendors (often a good idea in terms of demonstrating commitment to regulatory compliance) or on the intranet strictly for internal access.
To prove that these efforts took place, records should be maintained for all education and training programs.
Encouraging and facilitating reporting. A compliance program will be successful only in an environment in which employees and physicians feel comfortable reporting potential fraud and abuse or any violations of the program. There should be an “open door” policy between these individuals and the chief compliance officer. As part of education and training, all employees and physicians should understand their obligation to report perceived violations.
Failure to report perceived violations of the program or related policies can result in consequences for the employee or physician, including various levels of corrective action or other disciplinary action, including termination of employment or independent contractor relationships.
A successful compliance program includes creation and maintenance of a process to receive complaints, and the adoption of procedures to protect the anonymity of those making complaints. In a few circumstances, revelation of a reporting individual’s identity might be mandated by law or government authority.
Under the law, employees can be compensated for “blowing the whistle” on non-compliant practices – which just might prompt them to report their employers to regulatory authorities. A compliance program provides alternative avenues for reporting to employees concerned with perceived violations in the center. A culture of compliance within the organization may serve as a deterrent for whistleblowers.
One excellent way for larger entities to encourage anonymous reporting is through the use of a hotline that is available 24 hours a day, 7 days a week and 365 days a year to facilitate reporting of violations or seek clarification of compliance issues. A more practical alternative for most smaller centers is an anonymous “drop box.” Use of these processes should be emphasized in training and reinforced on a regular basis.
It is essential that individuals reporting fraud or abuse be protected from retaliation by the urgent care center or any of its employees or physicians. No one who makes a report in good faith should be subjected to retaliation, retribution or harassment because he or she made a report.
Audits and monitoring to reveal problems. Another way to uncover instances of fraud and abuse is through auditing and monitoring. An urgent care center should conduct periodic internal audits of a sampling of claims to determine compliance with applicable documentation, coding and billing requirements. This should be supplemented with an annual audit by an external agency.
There are a number of ways to identify the claims and services from which to draw a random sample of claims to be audited. One way is to choose a random sample from all of the claims and services for which a physician has been reimbursed. Another is to choose those from a particular payor. Another is to identify risk areas or potential billing vulnerabilities (see the areas listed at the start of this article), and choose the sample by this billing code.
Even urgent care centers that use outside billing companies should have their own compliance program, separate and apart from the billing company’s. Use of an outside billing company does not transfer liability for coding errors away from an urgent care center.
Enforcing standards. If a report or an audit reveals inaccurate billing, insufficient documentation or other problems at an urgent care center, appropriate corrective action must be taken. To protect against liability, an organization must respond promptly and appropriately to prevent similar offenses.
A successful compliance program includes a system to respond to allegations of improper or illegal activities and the enforcement of appropriate disciplinary actions against employees who have violated internal compliance policies, applicable statutes, regulations or federal healthcare program requirements.
Disciplinary actions could include warnings (oral), reprimands (written), probation, demotion, temporary suspension, termination, restitution of damages, and referral for criminal prosecution.
Corrective actions may require changes in documentation, coding and billing policies or procedures; additional training for physicians, billing or administrative personnel; the repayment of any overbilling, or disclosure to the third-party payor. A plan of correction should detail methods to prevent the violation from happening again.
Even when no problems are revealed, an urgent care center should periodically reassess its compliance program and make changes that reflect changes within the organization.
When the auditor comes knocking. In spite of an urgent care center’s best efforts, it may become embroiled in a government or third-party payor investigation or audit. In response to these actions, an urgent care center should cooperate, while protecting its legal rights and those of its employees and physicians. Legal counsel should be informed.
If an employee or physician receives an inquiry, subpoena or other legal document relating to the urgent care center or its business, that person should immediately notify the chief compliance officer or the urgent care center’s legal counsel. If an employee or physician is visited at home, that person should ask the agent to return at a later date and immediately contact the chief compliance officer.
Requests dealing with multiple claims call for an entirely different response. Legal counsel might engage an outside coding expert to do a separate analysis to determine if there are coding discrepancies.
Skilled legal counsel will ensure that there is an analysis and review of the subpoena and the requested materials, that the response timeline is being met, that litigation hold letters are in place, that insurance coverage is addressed (if applicable), and that protective internal and external communication strategies are in place.
Getting started with a compliance program
A sample compliance program for individual and small group physician practices is available at https://oig.hhs.gov/authorities/docs/physician.pdf. This sample was created by the Office of Inspector General within the U.S. Department of Health and Human Services. While this sample provides a starting point, urgent care centers must make sure to work with legal counsel that has extensive experience in their particular industry. Experienced legal counsel will be able to craft a well-structured and complete compliance program tailored to address those issues which are specific to the urgent care industry and to those issues that are particular to your urgent care center.
