[Federal Register Volume 63, Number 35 (Monday, February 23, 1998)]
[Notices]
[Pages 8987-8998]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 98-4399]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Office of Inspector General
Publication of the OIG Compliance Program Guidance for Hospitals
agency: Office of Inspector General (OIG), HHS.
action: Notice.
-----------------------------------------------------------------------
summary: This Federal Register notice sets forth the recently issued
compliance program guidance for hospitals developed by the Office of
Inspector General (OIG) in cooperation with, and with input from,
several provider groups and industry representatives. Many providers
and provider organizations have expressed an interest in better
protecting their operations from fraud and abuse through the adoption
of voluntary compliance programs. The first compliance guidance,
addressing clinical laboratories, was prepared by the OIG and published
in the Federal Register on March 3, 1997. We believe the development of
this second program guidance, for hospitals, will continue as a
positive step towards promoting a higher level of ethical and lawful
conduct throughout the health care industry.
for further information contact: Stephen Davis, Office of Counsel to
the Inspector General, (202) 619-0070.
supplementary information: The creation of compliance program guidances
has become a major initiative of the OIG in its efforts to engage the
private health care community in combating fraud and abuse. In
developing these compliance guidances, the OIG has agreed to work
closely with the Health Care Financing Administration, the Department
of Justice and various sectors of the health care industry. The first
of these compliance guidances focused on clinical laboratories, and was
intended to provide clear guidance to those segments of the health care
industry that were interested in reducing fraud and abuse within their
organizations. The compliance guidance was reprinted in an OIG Federal
Register notice published on March 3, 1997 (62 FR 9435). This second
compliance program guidance developed by the OIG continues to build
upon the basic elements contained in our initial compliance guidance,
and encompasses principles that are applicable to hospitals as well as
a wider variety of organizations that provide health care services to
beneficiaries of Medicare, Medicaid and all other Federal health care
programs.
Like the previously-issued compliance program guidance for clinical
laboratories and future compliance program guidances, adoption of the
hospital compliance program guidance set forth below will be voluntary.
Future compliance program guidances to be developed will be similarly
structured and based on substantive policy recommendations, the
elements of the Federal Sentencing Guidelines, and applicable statutes,
regulations and Federal health care program requirements.
A reprint of the OIG compliance program guidance follows.
Compliance Program Guidance for Hospitals
I. Introduction
The Office of Inspector General (OIG) of the Department of Health
and Human Services (HHS) continues in its efforts to promote
voluntarily developed and implemented compliance programs for the
health care industry. The following compliance program guidance is
intended to assist hospitals and their agents and subproviders
(referred to collectively in this document as ``hospitals'') develop
effective internal controls that promote adherence to applicable
Federal and State law, and the program requirements of Federal, State
and private health plans. The adoption and implementation of voluntary
compliance programs significantly advance the prevention of fraud,
abuse and waste in these health care plans while at the same time
furthering the fundamental mission of
[[Page 8988]]
all hospitals, which is to provide quality care to patients.
Within this document, the OIG intends to provide first, its general
views on the value and fundamental principles of hospital compliance
programs, and, second, specific elements that each hospital should
consider when developing and implementing an effective compliance
program. While this document presents basic procedural and structural
guidance for designing a compliance program, it is not in itself a
compliance program. Rather, it is a set of guidelines for a hospital
interested in implementing a compliance program to consider. The
recommendations and guidelines provided in this document must be
considered depending upon their applicability to each particular
hospital.
Fundamentally, compliance efforts are designed to establish a
culture within a hospital that promotes prevention, detection and
resolution of instances of conduct that do not conform to Federal and
State law, and Federal, State and private payor health care program
requirements, as well as the hospital's ethical and business policies.
In practice, the compliance program should effectively articulate and
demonstrate the organization's commitment to the compliance process.
The existence of benchmarks that demonstrate implementation and
achievements are essential to any effective compliance program.
Eventually, a compliance program should become part of the fabric of
routine hospital operations.
Specifically, compliance programs guide a hospital's governing body
(e.g., Boards of Directors or Trustees), Chief Executive Officer (CEO),
managers, other employees and physicians and other health care
professionals in the efficient management and operation of a hospital.
They are especially critical as an internal control in the
reimbursement and payment areas, where claims and billing operations
are often the source of fraud and abuse and, therefore, historically
have been the focus of government regulation, scrutiny and sanctions.
It is incumbent upon a hospital's corporate officers and managers
to provide ethical leadership to the organization and to assure that
adequate systems are in place to facilitate ethical and legal conduct.
Indeed, many hospitals and hospital organizations have adopted mission
statements articulating their commitment to high ethical standards. A
formal compliance program, as an additional element in this process,
offers a hospital a further concrete method that may improve quality of
care and reduce waste. Compliance programs also provide a central
coordinating mechanism for furnishing and disseminating information and
guidance on applicable Federal and State statutes, regulations and
other requirements.
Adopting and implementing an effective compliance program requires
a substantial commitment of time, energy and resources by senior
management and the hospital's governing body.\1\ Programs hastily
constructed and implemented without appropriate ongoing monitoring will
likely be ineffective and could result in greater harm or liability to
the hospital than no program at all. While it may require significant
additional resources or reallocation of existing resources to implement
an effective compliance program, the OIG believes that the long term
benefits of implementing the program outweigh the costs.
---------------------------------------------------------------------------
\1\ Indeed, recent case law suggests that the failure of a
corporate Director to attempt in good faith to institute a
compliance program in certain situations may be a breach of a
Director's fiduciary obligations. See, e.g., In re Caremark
International Inc. Derivative Litigation, 698 A.2d 959 (Ct. Chanc.
Del. 1996).
---------------------------------------------------------------------------
A. Benefits of a Compliance Program
In addition to fulfilling its legal duty to ensure that it is not
submitting false or inaccurate claims to government and private payors,
a hospital may gain numerous additional benefits by implementing an
effective compliance program. Such programs make good business sense in
that they help a hospital fulfill its fundamental care-giving mission
to patients and the community, and assist hospitals in identifying
weaknesses in internal systems and management.
Other important potential benefits include the ability to:
Concretely demonstrate to employees and the community at
large the hospital's strong commitment to honest and responsible
provider and corporate conduct;
Provide a more accurate view of employee and contractor
behavior relating to fraud and abuse;
Identify and prevent criminal and unethical conduct;
Tailor a compliance program to a hospital's specific
needs;
Improve the quality of patient care;
Create a centralized source for distributing information
on health care statutes, regulations and other program directives
related to fraud and abuse and related issues;
Develop a methodology that encourages employees to report
potential problems;
Develop procedures that allow the prompt, thorough
investigation of alleged misconduct by corporate officers, managers,
employees, independent contractors, physicians, other health care
professionals and consultants;
Initiate immediate and appropriate corrective action; and
Through early detection and reporting, minimize the loss
to the Government from false claims, and thereby reduce the hospital's
exposure to civil damages and penalties, criminal sanctions, and
administrative remedies, such as program exclusion.\2\
---------------------------------------------------------------------------
\2\ The OIG, for example, will consider the existence of an
effective compliance program that pre-dated any Governmental
investigation when addressing the appropriateness of administrative
penalties. Further, the False Claims Act, 31 U.S.C. 3729-3733,
provides that a person who has violated the Act, but who voluntarily
discloses the violation to the Government, in certain circumstances
will be subject to not less than double, as opposed to treble,
damages. See 31 U.S.C. 3729(a).
---------------------------------------------------------------------------
Overall, the OIG believes that an effective compliance program is a
sound investment on the part of a hospital.
The OIG recognizes that the implementation of a compliance program
may not entirely eliminate fraud, abuse and waste from the hospital
system. However, a sincere effort by hospitals to comply with
applicable Federal and State standards, as well as the requirements of
private health care programs, through the establishment of an effective
compliance program, significantly reduces the risk of unlawful or
improper conduct.
B. Application of Compliance Program Guidance
There is no single ``best'' hospital compliance program, given the
diversity within the industry. The OIG understands the variances and
complexities within the hospital industry and is sensitive to the
differences among large urban medical centers, community hospitals,
small, rural hospitals, specialty hospitals, and other types of
hospital organizations and systems. However, elements of this guidance
can be used by all hospitals, regardless of size, location or corporate
structure, to establish an effective compliance program. We recognize
that some hospitals may not be able to adopt certain elements to the
same comprehensive degree that others with more extensive resources may
achieve. This guidance represents the OIG's suggestions on how a
hospital can best establish internal controls and monitoring to correct
and prevent fraudulent activities. By no means should the contents of
this guidance be viewed as an exclusive discussion of the
[[Page 8989]]
advisable elements of a compliance program.
The OIG believes that input and support by representatives of the
major hospital trade associations is critical to the development and
success of this compliance program guidance. Therefore, in drafting
this guidance, the OIG received and considered input from various
hospital and medical associations, as well as professional practice
organizations. Further, we took into consideration previous OIG
publications, such as Special Fraud Alerts and Management Advisory
Reports, the recent findings and recommendations in reports issued by
OIG's Office of Audit Services and Office of Evaluation and
Inspections, as well as the experience of past and recent fraud
investigations related to hospitals conducted by OIG's Office of
Investigations and the Department of Justice.
As appropriate, this guidance may be modified and expanded as more
information and knowledge is obtained by the OIG, and as changes in the
law, and in the rules, policies and procedures of the Federal, State
and private health plans occur. The OIG understands that hospitals will
need adequate time to react to these modifications and expansions to
make any necessary changes to their voluntary compliance programs. We
recognize that hospitals are already accountable for complying with an
extensive set of statutory and other legal requirements, far more
specific and complex than what we have referenced in this document. We
also recognize that the development and implementation of compliance
programs in hospitals often raise sensitive and complex legal and
managerial issues.\3\ However, the OIG wishes to offer what it believes
is critical guidance for providers who are sincerely attempting to
comply with the relevant health care statutes and regulations.
---------------------------------------------------------------------------
\3\ Nothing stated herein should be substituted for, or used in
lieu of, competent legal advice from counsel.
---------------------------------------------------------------------------
II. Compliance Program Elements
The elements proposed by these guidelines are similar to those of
the clinical laboratory model compliance program published by the OIG
in February 1997 \4\ and our corporate integrity agreements.\5\ The
elements represent a guide--a process that can be used by hospitals,
large or small, urban or rural, for-profit or not for-profit. Moreover,
the elements can be incorporated into the managerial structure of
multi-hospital and integrated delivery systems. As we stated in our
clinical laboratory plan, these suggested guidelines can be tailored to
fit the needs and financial realities of a particular hospital. The OIG
is cognizant that with regard to compliance programs, one model is not
suitable to every hospital. Nonetheless, the OIG believes that every
hospital, regardless of size or structure, can benefit from the
principles espoused in this guidance.
---------------------------------------------------------------------------
\4\ See 62 FR 9435, March 3, 1997.
\5\ Corporate integrity agreements are executed as part of a
civil settlement between the health care provider and the Government
to resolve a case arising under the False Claims Act (FCA),
including the qui tam provisions of the FCA, based on allegations of
health care fraud or abuse. These OIG-imposed programs are in effect
for a period of three to five years and require many of the elements
included in this compliance guidance.
---------------------------------------------------------------------------
The OIG believes that every effective compliance program must begin
with a formal commitment by the hospital's governing body to include
all of the applicable elements listed below. These elements are based
on the seven steps of the Federal Sentencing Guidelines.\6\ Further, we
believe that every hospital can implement most of our recommended
elements that expand upon the seven steps of the Federal Sentencing
Guidelines.\7\ We recognize that full implementation of all elements
may not be immediately feasible for all hospitals. However, as a first
step, a good faith and meaningful commitment on the part of the
hospital administration, especially the governing body and the CEO,
will substantially contribute to a program's successful implementation.
---------------------------------------------------------------------------
\6\ See United States Sentencing Commission Guidelines,
Guidelines Manual, 8A1.2, comment. (n.3(k)).
\7\ Current HCFA reimbursement principles provide that certain
of the costs associated with the creation of a voluntarily
established compliance program may be allowable costs on certain
types of hospitals' cost reports. These allowable costs, of course,
must at a minimum be reasonable and related to patient care. See
generally 42 U.S.C. 1395x(v)(1)(A) (definition of reasonable cost);
42 CFR 413.9(a) and (b)(2) (costs related to patient care). In
contrast, however, costs specifically associated with the
implementation of a corporate integrity agreement in response to a
Government investigation resulting in a civil or criminal judgment
or settlement are unallowable, and are also made specifically and
expressly unallowable in corporate integrity agreements and civil
fraud settlements.
---------------------------------------------------------------------------
At a minimum, comprehensive compliance programs should include the
following seven elements:
(1) The development and distribution of written standards of
conduct, as well as written policies and procedures that promote the
hospital's commitment to compliance (e.g., by including adherence to
compliance as an element in evaluating managers and employees) and that
address specific areas of potential fraud, such as claims development
and submission processes, code gaming, and financial relationships with
physicians and other health care professionals;
(2) The designation of a chief compliance officer and other
appropriate bodies, e.g., a corporate compliance committee, charged
with the responsibility of operating and monitoring the compliance
program, and who report directly to the CEO and the governing body;
(3) The development and implementation of regular, effective
education and training programs for all affected employees;
(4) The maintenance of a process, such as a hotline, to receive
complaints, and the adoption of procedures to protect the anonymity of
complainants and to protect whistleblowers from retaliation;
(5) The development of a system to respond to allegations of
improper/illegal activities and the enforcement of appropriate
disciplinary action against employees who have violated internal
compliance policies, applicable statutes, regulations or Federal health
care program requirements;
(6) The use of audits and/or other evaluation techniques to monitor
compliance and assist in the reduction of identified problem area; and
(7) The investigation and remediation of identified systemic
problems and the development of policies addressing the non-employment
or retention of sanctioned individuals.
A. Written Polices and Procedures
Every compliance program should require the development and
distribution of written compliance policies that identify specific
areas of risk to the hospital. These policies should be developed under
the direction and supervision of the chief compliance officer and
compliance committee, and, at a minimum, should be provided to all
individuals who are affected by the particular policy at issue,
including the hospital's agents and independent contractors.
1. Standards of Conduct. Hospitals should develop standards of
conduct for all affected employees that include a clearly delineated
commitment to compliance by the hospital's senior management \8\ and
its divisions,
[[Page 8990]]
including affiliated providers operating under the hospital's
control,\9\ hospital-based physicians and other health care
professionals (e.g., utilization review managers, nurse anesthetists,
physician assistants and physical therapists). Standards should
articulate the hospital's commitment to comply with all Federal and
State standards, with an emphasis on preventing fraud and abuse. They
should state the organization's mission, goals, and ethical
requirements of compliance and reflect a carefully crafted, clear
expression of expectations for all hospital governing body members,
officers, managers, employees, physicians, and, where appropriate,
contractors and other agents. Standards should be distributed to, and
comprehensible by, all employees (e.g., translated into other languages
and written at appropriate reading levels, where appropriate). Further,
to assist in ensuring that employees continuously meet the expected
high standards set forth in the code of conduct, any employee handbook
delineating or expanding upon these standards of conduct should be
regularly updated as applicable statutes, regulations and Federal
health care program requirements are modified.\10\
---------------------------------------------------------------------------
\8\ The OIG strongly encourages high-level involvement by the
hospital's governing body, chief executive officer, chief operating
officer, general counsel, and chief financial officer, as well as
other medical personnel, as appropriate, in the development of
standards of conduct. Such involvement should help communicate a
strong and explicit statement of compliance goals and standards.
\9\ E.g., skilled nursing facilities, home health agencies,
psychiatric units, rehabilitation units, outpatient clinics,
clinical laboratories, dialysis facilities.
\10\ The OIG recognizes that not all standards, policies and
procedures need to be communicated to all employees. However, the
OIG believes that the bulk of the standards that relate to complying
with fraud and abuse laws and other ethical areas should be
addressed and made part of all affected employees' training. The
hospital must appropriately decide which additional educational
programs should be limited to the different levels of employees,
based on job functions and areas of responsibility.
---------------------------------------------------------------------------
2. Risk Areas. The OIG believes that a hospital's written policies
and procedures should take into consideration the regulatory exposure
for each function or department of the hospital. Consequently, we
recommend that the individual policies and procedures be coordinated
with the appropriate training and educational programs with an emphasis
on areas of special concern that have been identified by the OIG
through its investigative and audit functions.\11\ Some of the special
areas of OIG concern include.\12\
---------------------------------------------------------------------------
\11\ The OIG periodically issues Special Fraud Alters setting
forth activities believed to raise legal and enforcement issues.
Hospital compliance programs should require that the legal staff,
chief compliance officer, or other appropriate personnel, carefully
consider any and all Special Fraud Alerts issued by the OIG that
relate to hospitals. Moreover, the compliance programs should
address the ramifications of failing to cease and correct any
conduct criticized in such a Special Fraud Alert, if applicable to
hospitals, or to take reasonable action to prevent such conduct from
reoccurring in the future. If appropriate, a hospital should take
the steps described in Section G regarding investigations, reporting
and correction of identified problems.
\12\ The OIG's work plan is currently available on the Internet
at http://www.dhhs.gov/progorg/oig.
---------------------------------------------------------------------------
Billing for items or services not actually rendered; \13\
---------------------------------------------------------------------------
\13\ Billing for services not actually rendered involves
submitting a claim that represents that the provider performed a
service all or part of which was simply not performed. This form of
billing fraud occurs in many health care entities, including
hospitals and nursing homes, and represents a significant part of
the OIG's investigative caseload.
---------------------------------------------------------------------------
Providing medically unnecessary services;\14\
---------------------------------------------------------------------------
\14\ A claim requesting payment for medically unnecessary
services intentionally seeks reimbursement for a service that is not
warranted by the patient's current and documented medical condition.
See 42 U.S.C. 1395y(a)(1)(A) (``no payment may be made under part A
or part B for any expenses incurred for items or services which . .
. are not reasonable and necessary for the diagnosis or treatment of
illness or injury or to improve the functioning of the malformed
body member''). On every HCFA claim form, a physician must certify
that the services were medically necessary for the health of the
beneficiary.
---------------------------------------------------------------------------
Upcoding;\15\
---------------------------------------------------------------------------
\15\ ``Upcoding'' reflects the practice of using a billing code
that provides a higher payment rate than the billing code that
actually reflects the service furnished to the patient. Upcoding has
been a major focus of the OIG's enforcement efforts. In fact, the
Health Insurance Portability and Accountability Act of 1996 added
another civil monetary penalty to the OIG's sanction authorities for
upcoding violations. See 42 U.S.C. 1320a-7a(a)(1)(A).
---------------------------------------------------------------------------
``DRG creep;''\16\
---------------------------------------------------------------------------
\16\ Like upcoding, ``DRG creep'' is the practice of billing
using a Diagnosis Related Group (DRG) code that provides a higher
payment rate than the DRG code that accurately reflects the service
furnished to the patient.
---------------------------------------------------------------------------
Outpatient services rendered in connection with inpatient
stays;\17\
---------------------------------------------------------------------------
\17\ Hospitals that submit claims for non-physician outpatient
services that were already included in the hospital's inpatient
payment under the Prospective Payment System (PPS) are in effect
submitting duplicate claims.
---------------------------------------------------------------------------
Teaching physician and resident requirements for teaching
hospitals;
Duplicate billing;\18\
---------------------------------------------------------------------------
\18\ Duplicate billing occurs when the hospital submits more
than one claim for the same service or the bill is submitted to more
than one primary payor at the same time. Although duplicate billing
can occur due to simple error, systematic or repeated double billing
may be viewed as a false claim, particularly if any overpayment is
not promptly refunded.
---------------------------------------------------------------------------
False cost reports;\19\
---------------------------------------------------------------------------
\19\ As another example of health care fraud, the submission of
false costs reports is usually limited to certain Part A providers,
such as hospitals, skilled nursing facilities and home health
agencies, which are reimbursed in part on the basis of their self-
reported operating costs. An OIG audit report on the misuse of
fringe benefits and general and administrative costs identified
millions of dollars in unallowable costs that resulted from
providers' lack of internal controls over costs included in their
Medicare cost reports. In addition, the OIG is aware of practices in
which hospitals inappropriately shift certain costs to cost centers
that are below their reimbursement cap and shift non-Medicare
related costs to Medicare cost centers.
---------------------------------------------------------------------------
Unbundling;\20\
---------------------------------------------------------------------------
\20\ ``Unbundling'' is the practice of submitting bills
piecemeal or in fragmented fashion to maximize the reimbursement for
various tests or procedures that are required to be billed together
and therefore at a reduced cost.
---------------------------------------------------------------------------
Billing for discharge in lieu of transfer;\21\
---------------------------------------------------------------------------
\21\ Under the Medicare regulations, when a prospective payment
system (PPS) hospital transfers a patient to another PPS hospital,
only the hospital to which the patient was transferred may charge
the full DRG; the transferring hospital should charge Medicare only
a per diem amount.
---------------------------------------------------------------------------
Patients' freedom of choice;\22\
---------------------------------------------------------------------------
\22\ This area of concern is particularly important for hospital
discharge planners referring patients to home health agencies, DME
suppliers or long term care and rehabilitation providers.
---------------------------------------------------------------------------
Credit balances--failure to refund;
Hospital incentives that violate the anti-kickback statute
or other similar Federal or State statute or regulation;\23\
---------------------------------------------------------------------------
\23\ Excessive payment for medical directorships, free or below
market rents or fees for administrative services, interest-free
loans and excessive payment for intangible assets in physician
practice acquisitions are examples of arrangements that may run
afoul of the anti-kickback statute. See 42 U.S.C. 1320a-7b(b) and 59
FR 65372 (12/19/94).
---------------------------------------------------------------------------
Joint ventures;\24\
---------------------------------------------------------------------------
\24\ Equally troubling to the OIG is the proliferation of
business arrangements that may violate the anti-kickback statute.
Such arrangements are generally established between those in a
position to refer business, such as physicians, and those providing
items or services for which a Federal health care program pays.
Sometimes established as ``joint ventures,'' these arrangements may
take a variety of forms. The OIG currently has a number of
investigations and audits underway that focus on such areas of
concern.
---------------------------------------------------------------------------
Financial arrangements between hospitals and hospital-
based physicians;\25\
---------------------------------------------------------------------------
\25\ Another OIG concern with respect to the anti-kickback
statute is hospital financial arrangements with hospital-based
physicians that compensate physicians for less than the fair market
value of services they provide to hospitals or require physicians to
pay more than market value for services provided by the hospital.
See OIG Management Advisory Report: ``Financial Arrangements Between
Hospitals and Hospital-Based Physicians.'' OEI-09-89-0030, October
1991. Examples of such arrangements that may violate the anti-
kickback statute are token or no payment for Part A supervision and
management services; requirements to donate equipment to hospitals;
and excessive charges for billing services.
---------------------------------------------------------------------------
Stark physician self-referral law;
Knowing failure to provide covered services or necessary
care to members of a health maintenance organization; and
Patient dumping.\26\
---------------------------------------------------------------------------
\26\ The patient anti-dumping statute, 42 U.S.C. 1395dd,
requires that all Medicare participating hospitals with an emergency
department: (1) Provide for an appropriate medical screening
examination to determine whether or not an individual requesting
such examination has an emergency medical condition; and (2) if the
person has such a condition, (a) stabilize that condition; or (b)
appropriately transfer the patient to another hospital.
---------------------------------------------------------------------------
[[Page 8991]]
Additional risk areas should be assessed as well by hospitals and
incorporated into the written policies and procedures and training
elements developed as part of their compliance programs.
3. Claim Development and Submission Process. A number of the risk
areas identified above, pertaining to the claim development and
submission process, have been the subject of administrative
proceedings, as well as investigations and prosecutions under the civil
False Claims Act and criminal statutes. Settlement of these cases often
has required the defendants to execute corporate integrity agreements,
in addition to paying significant civil damages and/or criminal fines
and penalties. These corporate integrity agreements have provided the
OIG with a mechanism to advise hospitals concerning what it feels are
acceptable practices to ensure compliance with applicable Federal and
State statutes, regulations, and program requirements. The following
recommendations include a number of provisions from various corporate
integrity agreements. While these recommendations include examples of
effective policies, each hospital should develop its own specific
policies tailored to fit its individual needs.
With respect to reimbursement claims, a hospital's written policies
and procedures should reflect and reinforce current Federal and State
statutes and regulations regarding the submission of claims and
Medicare cost reports. The policies must create a mechanism for the
billing or reimbursement staff to communicate effectively and
accurately with the clinical staff. Policies and procedures should:
Provide for proper and timely documentation of all
physician and other professional services prior to billing to ensure
that only accurate and properly documented services are billed;
Emphasize that claims should be submitted only when
appropriate documentation supports the claims and only when such
documentation is maintained and available for audit and review. The
documentation, which may include patient records, should record the
length of time spent in conducting the activity leading to the record
entry, and the identity of the individual providing the service. The
hospital should consult with its medical staff to establish other
appropriate documentation guidelines;
State that, consistent with appropriate guidance from
medical staff, physician and hospital records and medical notes used as
a basis for a claim submission should be appropriately organized in a
legible form so they can be audited and reviewed;
Indicate that the diagnosis and procedures reported on the
reimbursement claim should be based on the medical record and other
documentation, and that the documentation necessary for accurate code
assignment should be available to coding staff; and
Provide that the compensation for billing department
coders and billing consultants should not provide any financial
incentive to improperly upcode claims.
The written policies and procedures concerning proper coding should
reflect the current reimbursement principles set forth in applicable
regulations \27\ and should be developed in tandem with private payor
and organizational standards. Particular attention should be paid to
issues of medical necessity, appropriate diagnosis codes, DRG coding,
individual Medicare Part B claims (including evaluation and management
coding) and the use of patient discharge codes.\28\
---------------------------------------------------------------------------
\27\ The official coding guidelines are promulgated by HCFA, the
National Center for Health Statistics, the American Medical
Association and the American Health Information Management
Association. See International Classification of Diseases, 9th
Revision, Clinical Modification (ICD9-CM); 1998 Health Care
Financing Administration Common Procedure Coding System (HCPCS); and
Physicians' Current Procedural Terminology (CPT).
\28\ The failure of hospital staff to: (i) document items and
services rendered; and (ii) properly submit them for reimbursement
is a major area of potential fraud and abuse in Federal health care
programs. The OIG has undertaken numerous audits, investigations,
inspections and national enforcement initiatives aimed at reducing
potential and actual fraud, abuse and waste. Recent OIG audit
reports, which have focused on issues such as hospital patient
transfers incorrectly paid as discharges, and hospitals' general and
administrative costs, continue to reveal abusive, wasteful or
fraudulent behavior by some hospitals. Our inspection report
entitled ``Financial Arrangements between Hospitals and Hospital-
Based Physicians,'' see fn. 25, supra, and our Special Fraud Alerts
on Hospital Incentives to Physicians and Joint Venture Arrangements,
further illustrate how certain business practices may result in
fraudulent and abusive behavior.
---------------------------------------------------------------------------
a. Outpatient services rendered in connection with an inpatient
stay. Hospitals should implement measures designed to demonstrate their
good faith efforts to comply with the Medicare billing rules for
outpatient services rendered in connection with an inpatient stay.
Although not a guard against intentional wrongdoing, the adoption of
the following measures are advisable:
Installing and maintaining computer software that will
identify those outpatient services that may not be billed separately
from an inpatient stay; or
Implementing a periodic manual review to determine the
appropriateness of billing each outpatient service claim, to be
conducted by one or more appropriately trained individuals familiar
with applicable billing rules; or
With regard to each inpatient stay, scrutinizing the
propriety of any potential bills for outpatient services rendered to
that patient at the hospital, within the applicable time period.
In addition to the pre-submission undertakings described above, the
hospital may implement a post-submission testing process, as follows:
Implement and maintain a periodic post-submission random
testing process that examines or re-examines previously submitted
claims for accuracy;
Inform the fiscal intermediary and any other appropriate
government fiscal agents of the hospital's testing process; and
Advise the fiscal intermediary and any other appropriate
government fiscal agents in accordance with current regulations or
program instructions with respect to return of overpayments of any
incorrectly submitted or paid claims and, if the claim has already been
paid, promptly reimburse the fiscal intermediary and the beneficiary
for the amount of the claim paid by the government payor and any
applicable deductibles or copayments, as appropriate.
b. Submission of claims for laboratory services. A hospital's
policies should take reasonable steps to ensure that all claims for
clinical and diagnostic laboratory testing services are accurate and
correctly identify the services ordered by the physician (or other
authorized requestor) and performed by the laboratory. The hospital's
written policies and procedures should require, at a minimum,\29\ that:
---------------------------------------------------------------------------
\29\ The OIG's February 1997 Model Compliance Plan for Clinical
Laboratories provides more specific and detailed information than is
contained in this section, and hospitals that have clinical
laboratories should extract the relevant guidance from both
documents.
---------------------------------------------------------------------------
The hospital bills for laboratory services only after they
are performed;
The hospital bills only for medically necessary services;
The hospital bills only for those tests actually ordered
by a physician and provided by the hospital laboratory;
The CPT or HCPCS code used by the billing staff accurately
describes the service that was ordered by the
[[Page 8992]]
physician and performed by the hospital laboratory;
The coding staff: (1) Only submit diagnostic information
obtained from qualified personnel; and (2) contact the appropriate
personnel to obtain diagnostic information in the event that the
individual who ordered the test has failed to provide such information;
and
Where diagnostic information is obtained from a physician
or the physician's staff after receipt of the specimen and request for
services, the receipt of such information is documented and maintained.
c. Physicians at teaching hospitals. Hospitals should ensure the
following with respect to all claims submitted on behalf of teaching
physicians:
Only services actually provided may be billed;
Every physician who provides or supervises the provision
of services to a patient should be responsible for the correct
documentation of the services that were rendered;
The appropriate documentation must be placed in the
patient record and signed by the physician who provided or supervised
the provision of services to the patient;
Every physician is responsible for assuring that in cases
where that physician provides evaluation and management (E&M) services,
a patient's medical record includes appropriate documentation of the
applicable key components of the E&M service provided or supervised by
the physician (e.g., patient history, physician examination, and
medical decision making), as well as documentation to adequately
reflect the procedure or portion of the service performed by the
physician; and
Every physician should document his or her presence during
the key portion of any service or procedure for which payment is
sought.
d. Cost reports. With regard to cost report issues, the written
policies should include procedures that seek to ensure full compliance
with applicable statutes, regulations and program requirements and
private payor plans. Among other things, the hospital's procedures
should ensure that:
Costs are not claimed unless based on appropriate and
accurate documentation;
Allocations of costs to various cost centers are
accurately made and supportable by verifiable and auditable data;
Unallowable costs are not claimed for reimbursement;
Accounts containing both allowable and unallowable costs
are analyzed to determine the unallowable amount that should not be
claimed for reimbursement;
Costs are properly classified;
Fiscal intermediary prior year audit adjustments are
implemented and are either not claimed for reimbursement or claimed for
reimbursement and clearly identified as protested amounts on the cost
report;
All related parties are identified on Form 339 submitted
with the cost report and all related party charges are reduced to cost;
Requests for exceptions to TEFRA (Tax Equity and Fiscal
Responsibility Act of 1982) limits and the Routine Cost Limits are
properly documented and supported by verifiable and auditable data;
The hospital's procedures for reporting of bad debts on
the cost report are in accordance with Federal statutes, regulations,
guidelines and policies;
Allocations from a hospital chain's home office cost
statement to individual hospital cost reports are accurately made and
supportable by verifiable and auditable data; and
Procedures are in place and documented for notifying
promptly the Medicare fiscal intermediary (or any other applicable
payor, e.g., TRICARE (formerly CHAMPUS) and Medicaid) of errors
discovered after the submission of the hospital cost report, and where
applicable, after the submission of a hospital chain's home office cost
statement.
With regard to bad debts claimed on the Medicare cost report, see
also section six, below, on Bad Debts.
4. Medical Necessity--Reasonable and Necessary Services. A
hospital's compliance program should provide that claims should only be
submitted for services that the hospital has reason to believe are
medically necessary and that were ordered by a physician \30\ or other
appropriately licensed individual.
---------------------------------------------------------------------------
\30\ For Medicare reimbursement purposes, a physician is defined
as: (1) a doctor of medicine or osteopathy; (2) a doctor of dental
surgery or of dental medicine; (3) a podiatrist; (4) an optometrist;
and (5) a chiropractor, all of whom must be appropriately licensed
by the state. 42 U.S.C. 1395x(r).
---------------------------------------------------------------------------
As a preliminary matter, the OIG recognizes that licensed health
care professionals must be able to order any services that are
appropriate for the treatment of their patients. However, Medicare and
other government and private health care plans will only pay for those
services that meet appropriate medical necessity standards (in the case
of Medicare, i.e., ``reasonable and necessary'' services). Providers
may not bill for services that do not meet the applicable standards.
The hospital is in a unique position to deliver this information to the
health care professionals on its staff. Upon request, a hospital should
be able to provide documentation, such as patients' medical records and
physicians' orders, to support the medical necessity of a service that
the hospital has provided. The compliance officer should ensure that a
clear, comprehensive summary of the ``medical necessity'' definitions
and rules of the various government and private plans is prepared and
disseminated appropriately.
5. Anti-Kickback and Self-Referral Concerns. The hospital should
have policies and procedures in place with respect to compliance with
Federal and State anti-kickback statutes, as well as the Stark
physician self-referral law.\31\ Such policies should provide that:
---------------------------------------------------------------------------
\31\ Towards this end, the hospital's in-house counsel or
compliance officer should, inter alia, obtain copies of all OIG
regulations, special fraud alerts and advisory opinions concerning
the anti-kickback statute, Civil Monetary Penalties Law (CMPL) and
Stark physician self-referral law (the fraud alerts and anti-
kickback or CMPL advisory opinions are published on HHS OIG's home
page on the Internet), and ensure that the hospital's policies
reflect the guidance provided by the OIG.
---------------------------------------------------------------------------
All of the hospital's contracts and arrangements with
referral sources comply with all applicable statutes and regulations;
The hospital does not submit or cause to be submitted to
the Federal health care programs claims for patients who were referred
to the hospital pursuant to contracts and financial arrangements that
were designed to induce such referrals in violation of the anti-
kickback statute, Stark physician self-referral law or similar Federal
or State statute or regulation; and
The hospital does not enter into financial arrangements
with hospital-based physicians that are designed to provide
inappropriate remuneration to the hospital in return for the
physician's ability to provide services to Federal health care program
beneficiaries at that hospital.\32\
---------------------------------------------------------------------------
\32\ See fn. 25, supra.
---------------------------------------------------------------------------
Further, the policies and procedures should reference the OIG's
safe harbor regulations, clarifying those payment practices that would
be immune from prosecution under the anti-kickback statute. See 42 CFR
1001.952.
6. Bad Debts. A hospital should develop a mechanism \33\ to review,
at least annually: (1) whether it is properly reporting bad debts to
Medicare; and (2) all Medicare bad debt expenses claimed, to ensure
that the hospital's procedures are in accordance with applicable
[[Page 8993]]
Federal and State statutes, regulations, guidelines and policies. In
addition, such a review should ensure that the hospital has appropriate
and reasonable mechanisms in place regarding beneficiary deductible or
copayment collection efforts and has not claimed as bad debts any
routinely waived Medicare copayments and deductibles, which waiver also
constitutes a violation of the anti-kickback statute. Further, the
hospital may consult with the appropriate fiscal intermediary as to bad
debt reporting requirements, if questions arise.
---------------------------------------------------------------------------
\33\ E.g., assigning in-house counsel or contracting with an
independent professional organization, such as an accounting, law or
consulting firm.
---------------------------------------------------------------------------
7. Credit Balances. The hospital should institute procedures to
provide for the timely and accurate reporting of Medicare and other
Federal health care program credit balances. For example, a hospital
may redesignate segments of its information system to allow for the
segregation of patient accounts reflecting credit balances. The
hospital could remove these accounts from the active accounts and place
them in a holding account pending the processing of a reimbursement
claim to the appropriate program. A hospital's information system
should have the ability to print out the individual patient accounts
that reflect a credit balance in order to permit simplified tracking of
credit balances.
In addition, a hospital should designate at least one person (e.g.,
in the Patient Accounts Department or reasonable equivalent thereof) as
having the responsibility for the tracking, recording and reporting of
credit balances. Further, a comptroller or an accountant in the
hospital's Accounting Department (or reasonable equivalent thereof) may
review reports of credit balances and reimbursements or adjustments on
a monthly basis as an additional safeguard.
8. Retention of Records. Hospital compliance programs should
provide for the implementation of a records system. This system should
establish policies and procedures regarding the creation, distribution,
retention, storage, retrieval and destruction of documents. The two
types of documents developed under this system should include: (1) all
records and documentation, e.g., clinical and medical records and
claims documentation, required either by Federal or State law for
participation in Federal health care programs (e.g., Medicare's
conditions of participation requirement that hospital records regarding
Medicare claims be retained for a minimum of five years, see 42 CFR
482.24(b)(1) and HCFA Hospital Manual section 413(C)(12-91)); and (2)
all records necessary to protect the integrity of the hospital's
compliance process and confirm the effectiveness of the program, e.g.,
documentation that employees were adequately trained; reports from the
hospital's hotline, including the nature and results of any
investigation that was conducted; modifications to the compliance
program; self-disclosure; and the results of the hospital's auditing
and monitoring efforts.\34\
---------------------------------------------------------------------------
\34\ The creation and retention of such documents and reports
may raise a variety of legal issues, such as patient privacy and
confidentiality. These issues are best discussed with legal counsel.
---------------------------------------------------------------------------
9. Compliance as an Element of a Performance Plan. Compliance
programs should require that the promotion of, and adherence to, the
elements of the compliance program be a factor in evaluating the
performance of managers and supervisors. They, along with other
employees, should be periodically trained in new compliance policies
and procedures. In addition, all managers and supervisors involved in
the coding, claims and cost report development and submission processes
should:
Discuss with all supervised employees the compliance
policies and legal requirements applicable to their function;
Inform all supervised personnel that strict compliance
with these policies and requirements is a condition of employment; and
Disclose to all supervised personnel that the hospital
will take disciplinary action up to and including termination or
revocation of privileges for violation of these policies or
requirements.
In addition to making performance of these duties an element in
evaluations, the compliance officer or hospital management should
include in the hospital's compliance program a policy that managers and
supervisors will be sanctioned for failure to instruct adequately their
subordinates or for failing to detect noncompliance with applicable
policies and legal requirements, where reasonable diligence on the part
of the manager or supervisor would have led to the discovery of any
problems or violations and given the hospital the opportunity to
correct them earlier.
B. Designation of a Compliance Officer and a Compliance Committee
1. Compliance Officer. Every hospital should designate a compliance
officer to serve as the focal point for compliance activities. This
responsibility may be the individual's sole duty or added to other
management responsibilities, depending upon the size and resources of
the hospital and the complexity of the task. Designating a compliance
officer with the appropriate authority is critical to the success of
the program, necessitating the appointment of a high-level official in
the hospital with direct access to the hospital's governing body and
the CEO.\35\ The officer should have sufficient funding and staff to
perform his or her responsibilities fully. Coordination and
communication are the key functions of the compliance officer with
regard to planning, implementing, and monitoring the compliance
program.
---------------------------------------------------------------------------
\35\ The OIG believes that there is some risk to establishing an
independent compliance function if that function is subordinance to
the hospital's general counsel, or comptroller or similar hospital
financial officer. Free standing compliance functions help to ensure
independent and objective legal reviews and financial analyses of
the institution's compliance efforts and activities. By separating
the compliance function from the key management positions of general
counsel or chief hospital financial officer (where the size and
structure of the hospital make this a feasible option), a system of
checks and balances is established to more effectively achieve the
goals of the compliance program.
---------------------------------------------------------------------------
The compliance officer's primary responsibilities should include:
Overseeing and monitoring the implementation of the
compliance program; \36\
---------------------------------------------------------------------------
\36\ For multi-hospital organizations, the OIG encourages
coordination with each hospital owned by the corporation or
foundation through the use of a headquarter's compliance officer,
communicating with parallel positions in each facility, or regional
office, as appropriate.
---------------------------------------------------------------------------
Reporting on a regular basis to the hospital's governing
body, CEO and compliance committee on the progress of implementation,
and assisting these components in establishing methods to improve the
hospital's efficiency and quality of services, and to reduce the
hospital's vulnerability to fraud, abuse and waste;
Periodically revising the program in light of changes in
the needs of the organization, and in the law and policies and
procedures of government and private payor health plans;
Developing, coordinating, and participating in a
multifaceted educational and training program that focuses on the
elements of the compliance program, and seeks to ensure that all
appropriate employees and management are knowledgeable of, and comply
with, pertinent Federal and State standards;
Ensuring that independent contractors and agents who
furnish medical services to the hospital are aware of the requirements
of the hospital's compliance program with respect to coding, billing,
and marketing, among other things;
Coordinating personnel issues with the hospital's Human
Resources office
[[Page 8994]]
(or its equivalent) to ensure that the National Practitioner Data Bank
and Cumulative Sanction Report \37\ have been checked with respect to
all employees, medical staff and independent contractors;
---------------------------------------------------------------------------
\37\ The Cumulative Sanction Report is an OIG-produced report
available on the Internet at http://www.dhhs.gov/progorg/oig. It is
updated on a regular basis to reflect the status of health care
providers who have been excluded from participation in the Medicare
and Medicaid programs. In addition, the General Services
Administration maintains a monthly listing of debarred contractors
on the Internet at http://www.arnet.gov/epls. Also, once the data
base established by the Health Care Fraud and Abuse Data Collection
Act of 1996 is fully operational, the hospital should regularly
request information from this data bank as part of its employee
screening process.
---------------------------------------------------------------------------
Assisting the hospital's financial management in
coordinating internal compliance review and monitoring activities,
including annual or periodic reviews of departments;
Independently investigating and acting on matters related
to compliance, including the flexibility to design and coordinate
internal investigations (e.g., responding to reports of problems or
suspected violations) and any resulting corrective action with all
hospital departments, providers and sub-providers,\38\ agents and, if
appropriate, independent contractors; and
---------------------------------------------------------------------------
\38\ E.g., skilled nursing facilities and home health agencies.
---------------------------------------------------------------------------
Developing policies and programs that encourage managers
and employees to report suspected fraud and other improprieties without
fear of retaliation.
The compliance officer must have the authority to review all
documents and other information that are relevant to compliance
activities, including, but not limited to, patient records, billing
records, and records concerning the marketing efforts of the facility
and the hospital's arrangements with other parties, including
employees, professionals on staff, independent contractors, suppliers,
agents, and hospital-based physicians, etc. This policy enables the
compliance officer to review contracts and obligations (seeking the
advice of legal counsel, where appropriate) that may contain referral
and payment issues that could violate the anti-kickback statute, as
well as the physician self-referral prohibition and other legal or
regulatory requirements.
2. Compliance Committee. The OIG recommends that a compliance
committee be established to advise the compliance officer and assist in
the implementation of the compliance program.\39\ The committee's
functions should include:
---------------------------------------------------------------------------
\39\ The compliance committee benefits from having the
perspectives of individuals with varying responsibilities in the
organization, such as operations, finance, audit, human resources,
utilization review, social work, discharge planning, medicine,
coding and legal, as well as employees and managers of key operating
units.
---------------------------------------------------------------------------
Analyzing the organization's industry environment, the
legal requirements with which it must comply, and specific risk areas;
Assessing existing policies and procedures that address
these areas for possible incorporation into the compliance program;
Working with appropriate hospital departments to develop
standards of conduct and policies and procedures to promote compliance
with the institution's program;
Recommending and monitoring, in conjunction with the
relevant departments, the development of internal systems and controls
to carry out the organization's standards, policies and procedures as
part of its daily operations;
Determining the appropriate strategy/approach to promote
compliance with the program and detection of any potential violations,
such as through hotlines and other fraud reporting mechanisms; and
Developing a system to solicit, evaluate and respond to
complaints and problems.
The committee may also address other functions as the compliance
concept becomes part of the overall hospital operating structure and
daily routine.
C. Conducting Effective Training and Education
The proper education and training of corporate officers, managers,
employees, physicians and other health care professionals, and the
continual retraining of current personnel at all levels, are
significant elements of an effective compliance program. As part of
their compliance programs, hospitals should require personnel to attend
specific training on a periodic basis, including appropriate training
in Federal and State statutes, regulations and guidelines, and the
policies of private payors, and training in corporate ethics, which
emphasizes the organization's commitment to compliance with these legal
requirements and policies.
These training programs should include sessions highlighting the
organization's compliance program, summarizing fraud and abuse laws,
coding requirements, claim development and submission processes and
marketing practices that reflect current legal and program standards.
The organization must take steps to communicate effectively its
standards and procedures to all affected employees, physicians,
independent contractors and other significant agents, e.g., by
requiring participation in training programs and disseminating
publications that explain in a practical manner specific
requirements.\40\ Managers of specific departments or groups can assist
in identifying areas that require training and in carrying out such
training. Training instructors may come from outside or inside the
organization. New employees should be targeted for training early in
their employment.\41\ Any formal training undertaken by the hospital as
part of the compliance program should be documented by the compliance
officer.
---------------------------------------------------------------------------
\40\ Some publications, such as OIG's Management Advisory Report
entitled ``Financial Arrangements between Hospitals and Hospital-
Based Physicians,'' Special Fraud Alerts, audit and inspection
reports, and advisory opinions, as well as the annual OIG work plan,
are readily available from the OIG and could be the basis for
standards, educational courses and programs for appropriate hospital
employees.
\41\ Certain positions, such as those involving the coding of
medical services, create a greater organizational legal exposure,
and therefore require specialized training. One recommendation would
be for a hospital to attempt to fill such positions with individuals
who have the appropriate educational background and training.
---------------------------------------------------------------------------
A variety of teaching methods, such as interactive training, and
training in several different languages, particularly where a hospital
has a culturally diverse staff, should be implemented so that all
affected employees are knowledgeable of the institution's standards of
conduct and procedures for alerting senior management to problems and
concerns. Targeted training should be provided to corporate officers,
managers and other employees whose actions affect the accuracy of the
claims submitted to the Government, such as employees involved in the
coding, billing, cost reporting and marketing processes. Given the
complexity and interdependent relationships of many departments, proper
coordination and supervision of this process by the compliance officer
is important. In addition to specific training in the risk areas
identified in section II.A.2, above, primary training to appropriate
corporate officers, managers and other hospital staff should include
such topics as:
Government and private payor reimbursement principles;
General prohibitions on paying or receiving remuneration
to induce referrals;
Proper confirmation of diagnoses;
[[Page 8995]]
Submitting a claim for physician services when rendered by
a non-physician (i.e., the ``incident to'' rule and the physician
physical presence requirement);
Signing a form for a physician without the physician's
authorization;
Alterations to medical records;
Prescribing medications and procedures without proper
authorization;
Proper documentation of services rendered; and
Duty to report misconduct.
Clarifying and emphasizing these areas of concern through training
and educational programs are particularly relevant to a hospital's
marketing and financial personnel, in that the pressure to meet
business goals may render these employees vulnerable to engaging in
prohibited practices.
The OIG suggests that all relevant levels of personnel be made part
of various educational and training programs of the hospital. Employees
should be required to have a minimum number of educational hours per
year, as appropriate, as part of their employment responsibilities.\42\
For example, for certain employees involved in the billing and coding
functions, periodic training in proper DRG coding and documentation of
medical records should be required.\43\ In hospitals with high employee
turnover, periodic training updates are critical.
---------------------------------------------------------------------------
\42\ Currently, the OIG is monitoring approximately 165
corporate integrity agreements that require many of these training
elements. The OIG usually requires a minimum of one to three hours
annually for basic training in compliance areas. More is required
for speciality fields such as billing and coding.
\43\ Accurate coding depends upon the quality and completeness
of the physician's documentation. Therefore, the OIG believes that
active staff physician participation in educational programs
focusing on coding and documentation should be emphasized by the
hospital.
---------------------------------------------------------------------------
The OIG recommends that attendance and participation in training
programs be made a condition of continued employment and that failure
to comply with training requirements should result in disciplinary
action, including possible termination, when such failure is serious.
Adherence to the provisions of the compliance program, such as training
requirements, should be a factor in the annual evaluation of each
employee.\44\ The hospital should retain adequate records of its
training of employees, including attendance logs and material
distributed at training sessions.
---------------------------------------------------------------------------
\44\ In addition, where feasible, the OIG believes that a
hospital's outside contractors, including physician corporations,
should be afforded the opportunity to participate in, or develop
their own, compliance training and educational programs, which
complement the hospital's standards of conduct, compliance
requirements, and other rules and regulations.
---------------------------------------------------------------------------
Finally, the OIG recommends that hospital compliance programs
address the need for periodic professional education courses that may
be required by statute and regulation for certain hospital personnel.
D. Developing Effective Lines of Communication
1. Access to the Compliance Officer. An open line of communication
between the compliance officer and hospital personnel is equally
important to the successful implementation of a compliance program and
the reduction of any potential for fraud, abuse and waste. Written
confidentiality and non-retaliation policies should be developed and
distributed to all employees to encourage communication and the
reporting of incidents of potential fraud.\45\ The compliance committee
should also develop several independent reporting paths for an employee
to report fraud, waste or abuse so that such reports cannot be diverted
by supervisors or other personnel.
---------------------------------------------------------------------------
\45\ The OIG believes that whistleblowers should be protected
against retaliation, a concept embodied in the provisions of the
False Claims Act. In many cases, employees sue their employers under
the False Claims Act's qui tam provisions out of frustration because
of the company's failure to take action when a questionable,
fraudulent or abusive situation was brought to the attention of
senior corporate officials.
---------------------------------------------------------------------------
The OIG encourages the establishment of a procedure so that
hospital personnel may seek clarification from the compliance officer
or members of the compliance committee in the event of any confusion or
question with regard to a hospital policy or procedure. Questions and
responses should be documented and dated and, if appropriate, shared
with other staff so that standards, policies and procedures can be
updated and improved to reflect any necessary changes or
clarifications. The compliance officer may want to solicit employee
input in developing these communication and reporting systems.
2. Hotlines and Other Forms of Communication. The OIG encourages
the use of hotlines (including anonymous hotlines), e-mails, written
memoranda, newsletters, and other forms of information exchange to
maintain these open lines of communication. If the hospital establishes
a hotline, the telephone number should be made readily available to all
employees and independent contractors, possibly by conspicuously
posting the telephone number in common work areas.\46\ Employees should
be permitted to report matters on an anonymous basis. Matters reported
through the hotline or other communication sources that suggest
substantial violations of compliance policies, regulations or statutes
should be documented and investigated promptly to determine their
veracity. A log should be maintained by the compliance officer that
records such calls, including the nature of any investigation and its
results. Such information should be included in reports to the
governing body, the CEO and compliance committee. Further, while the
hospital should always strive to maintain the confidentiality of an
employee's identity, it should also explicitly communicate that there
may be a point where the individual's identity may become known or may
have to be revealed in certain instances when governmental authorities
become involved.
---------------------------------------------------------------------------
\46\ Hospitals should also post in a prominent, available area
the HHS OIG Hotline telephone number, 1-800-HHS-TIPS (447-8477), in
addition to any company hotline number that may be posted.
---------------------------------------------------------------------------
The OIG recognizes that assertions of fraud and abuse by employees
who may have participated in illegal conduct or committed other
malfeasance raise numerous complex legal and management issues that
should be examined on a case-by-case basis. The compliance officer
should work closely with legal counsel, who can provide guidance
regarding such issues.
E. Enforcing Standards Through Well-Publicized Disciplinary Guidelines
1. Discipline Policy and Actions. An effective compliance program
should include guidance regarding disciplinary action for corporate
officers, managers, employees, physicians and other health care
professionals who have failed to comply with the hospital's standards
of conduct, policies and procedures, or Federal and State laws, or
those who have otherwise engaged in wrongdoing, which have the
potential to impair the hospital's status as a reliable, honest and
trustworthy health care provider.
The OIG believes that the compliance program should include a
written policy statement setting forth the degrees of disciplinary
actions that may be imposed upon corporate officers, managers,
employees, physicians and other health care professionals for failing
to comply with the hospital's standards and policies and applicable
statutes and regulations. Intentional or reckless noncompliance should
subject transgressors to significant sanctions. Such sanctions could
range from oral
[[Page 8996]]
warnings to suspension, privilege revocation (subject to any applicable
peer review procedures), termination or financial penalties, as
appropriate. The written standards of conduct should elaborate on the
procedures for handling disciplinary problems and those who will be
responsible for taking appropriate action. Some disciplinary actions
can be handled by department managers, while others may have to be
resolved by a senior hospital administrator. Disciplinary action may be
appropriate where a responsible employee's failure to detect a
violation is attributable to his or her negligence or reckless conduct.
Personnel should be advised by the hospital that disciplinary action
will be taken on a fair and equitable basis. Managers and supervisors
should be made aware that they have a responsibility to discipline
employees in an appropriate and consistent manner.
It is vital to publish and disseminate the range of disciplinary
standards for improper conduct and to educate officers and other
hospital staff regarding these standards. The consequences of
noncompliance should be consistently applied and enforced, in order for
the disciplinary policy to have the required deterrent effect. All
levels of employees should be subject to the same disciplinary action
for the commission of similar offenses. The commitment to compliance
applies to all personnel levels within a hospital. The OIG believes
that corporate officers, managers, supervisors, medical staff and other
health care professionals should be held accountable for failing to
comply with, or for the foreseeable failure of their subordinates to
adhere to, the applicable standards, laws, and procedures.
2. New Employee Policy. For all new employees who have
discretionary authority to make decisions that may involve compliance
with the law or compliance oversight, hospitals should conduct a
reasonable and prudent background investigation, including a reference
check, as part of every such employment application.\47\ The
application should specifically require the applicant to disclose any
criminal conviction, as defined by 42 U.S.C. 1320a-7(i), or exclusion
action. Pursuant to the compliance program, hospital policies should
prohibit the employment of individuals who have been recently convicted
of a criminal offense related to health care or who are listed as
debarred, excluded or otherwise ineligible for participation in Federal
health care programs (as defined in 42 U.S.C. 1320a-7b(f)).\48\ In
addition, pending the resolution of any criminal charges or proposed
debarment or exclusion, the OIG recommends that such individuals should
be removed from direct responsibility for or involvement in any Federal
health care program.\49\ With regard to current employees or
independent contractors, if resolution of the matter results in
conviction, debarment or exclusion, the hospital should terminate its
employment or other contract arrangement with the individual or
contractor.
---------------------------------------------------------------------------
\47\ See fn. 37, supra.
\48\ Likewise, hospital compliance programs should establish
standards prohibiting the execution of contracts with companies that
have been recently convicted of a criminal offense related to health
care or that are listed by a Federal agency as debarred, excluded,
or otherwise ineligible for participation in Federal health care
programs.
\49\ Prospective employees who have been officially reinstated
into the Medicare and Medicaid programs by the OIG may be considered
for employment upon proof of such reinstatement.
---------------------------------------------------------------------------
F. Auditing and Monitoring
An ongoing evaluation process is critical to a successful
compliance program. The OIG believes that an effective program should
incorporate thorough monitoring of its implementation and regular
reporting to senior hospital or corporate officers.\50\ Compliance
reports created by this ongoing monitoring, including reports of
suspected noncompliance, should be maintained by the compliance officer
and shared with the hospital's senior management and the compliance
committee.
---------------------------------------------------------------------------
\50\ Even when a hospital is owned by a larger corporate entity,
the regular auditing and monitoring of the compliance activities of
an individual hospital must be a key feature in any annual review.
Appropriate reports on audit findings should be periodically
provided and explained to a parent-organization's senior staff and
officers.
---------------------------------------------------------------------------
Although many monitoring techniques are available, one effective
tool to promote and ensure compliance is the performance of regular,
periodic compliance audits by internal or external auditors who have
expertise in Federal and State health care statutes, regulations and
Federal health care program requirements. The audits should focus on
the hospital's programs or divisions, including external relationships
with third-party contractors, specifically those with substantive
exposure to government enforcement actions. At a minimum, these audits
should be designed to address the hospital's compliance with laws
governing kickback arrangements, the physician self-referral
prohibition, CPT/HCPSC ICD-9 coding, claim development and submission,
reimbursement, cost reporting and marketing. In addition, the audits
and reviews should inquire into the hospital's compliance with specific
rules and polices that have been the focus of particular attention on
the part of the Medicare fiscal intermediaries or carriers, and law
enforcement, as evidenced by OIG Special Fraud Alerts, OIG audits and
evaluations, and law enforcement's initiatives. See section II.A.2,
supra. In addition, the hospital should focus on any areas of concern
that have been identified by any entity, i.e., Federal, State, or
internally, specific to the individual hospital.
Monitoring techniques may include sampling protocols that permit
the compliance officer to identify and review variations from an
established baseline.\51\ Significant variations from the baseline
should trigger a reasonable inquiry to determine the cause of the
deviation. If the inquiry determines that the deviation occurred for
legitimate, explainable reasons, the compliance officer, hospital
administrator or manager may want to limit any corrective action or
take no action. If it is determined that the deviation was caused by
improper procedures, misunderstanding of rules, including fraud and
systemic problems, the hospital should take prompt steps to correct the
problem. Any overpayments discovered as a result of such deviations
should be returned promptly to the affected payor, with appropriate
documentation and a thorough explanation of the reason for the
refund.\52\
---------------------------------------------------------------------------
\51\ The OIG recommends that when a compliance program is
established in a hospital, the compliance officer, with the
assistance of department managers, should take a ``snapshot'' of
their operations from a compliance perspective. This assessment can
be undertaken by outside consultants, law or accounting firms, or
internal staff, with authoritative knowledge of health care
compliance requirements. This ``snapshot,'' often used as part of
benchmarking analyses, becomes a baseline for the compliance officer
and other managers to judge the hospital's progress in reducing or
eliminating potential areas of vulnerability. For example, it has
been suggested that a baseline level include the frequency and
percentile levels of various diagnosis codes and the increased
billing of complications and co-morbidities.
\52\ In addition, when appropriate, as referenced in section G.2
reports of fraud or systemic problems should also be made to the
appropriate governmental authority.
---------------------------------------------------------------------------
Monitoring techniques may also include a review of any reserves the
hospital has established for payments that it may owe to Medicare,
Medicaid, TRICARE or other Federal health care programs. Any reserves
discovered that include funds that should have been paid to Medicare or
another government program should be paid promptly,
[[Page 8997]]
regardless of whether demand has been made for such payment.
An effective compliance program should also incorporate periodic
(at least annual) reviews of whether the program's compliance elements
have been satisfied, e.g., whether there has been appropriate
dissemination of the program's standards, training, ongoing educational
programs and disciplinary actions, among others. This process will
verify actual conformance by all departments with the compliance
program. Such reviews could support a determination that appropriate
records have been created and maintained to document the implementation
of an effective program. However, when monitoring discloses that
deviations were not detected in a timely manner due to program
deficiencies, appropriate modifications must be implemented. Such
evaluations, when developed with the support of management, can help
ensure compliance with the hospital's policies and procedures.
As part of the review process, the compliance officer or reviewers
should consider techniques such as:
On-site visits;
Interviews with personnel involved in management,
operations, coding, claim development and submission, patient care, and
other related activities;
Questionnaires developed to solicit impressions of a broad
cross-section of the hospital's employees and staff;
Reviews of medical and financial records and other source
documents that support claims for reimbursement and Medicare cost
reports;
Reviews of written materials and documentation prepared by
the different divisions of a hospital; and
Trend analysis, or longitudinal studies, that seek
deviations, positive or negative, in specific areas over a given
period.
The reviewers should:
Be independent of physicians and line management;
Have access to existing audit and health care resources,
relevant personnel and all relevant areas of operation;
Present written evaluative reports on compliance
activities to the CEO, governing body and members of the compliance
committee on a regular basis, but no less than annually; and
Specifically identify areas where corrective actions are
needed.
With these reports, hospital management can take whatever steps are
necessary to correct past problems and prevent them from reoccurring.
In certain cases, subsequent reviews or studies would be advisable to
ensure that the recommended corrective actions have been implemented
successfully.
The hospital should document its efforts to comply with applicable
statutes, regulations and Federal health care program requirements. For
example, where a hospital, in its efforts to comply with a particular
statute, regulation or program requirement, requests advice from a
government agency (including a Medicare fiscal intermediary or carrier)
charged with administering a Federal health care program, the hospital
should document and retain a record of the request and any written or
oral response. This step is extremely important if the hospital intends
to rely on that response to guide it in future decisions, actions or
claim reimbursement requests or appeals. Maintaining a log of oral
inquiries between the hospital and third parties represents an
additional basis for establishing documentation on which the
organization may rely to demonstrate attempts at compliance. Records
should be maintained demonstrating reasonable reliance and due
diligence in developing procedures that implement such advice.
G. Responding to Detected Offenses and Developing Corrective Action
Initiatives
1. Violations and Investigations. Violations of a hospital's
compliance program, failures to comply with applicable Federal or State
law, and other types of misconduct threaten a hospital's status as a
reliable, honest and trustworthy provider capable of participating in
Federal health care programs. Detected but uncorrected misconduct can
seriously endanger the mission, reputation, and legal status of the
hospital. Consequently, upon reports or reasonable indications of
suspected noncompliance, it is important that the chief compliance
officer or other management officials initiate prompt steps to
investigate the conduct in question to determine whether a material
violation of applicable law or the requirements of the compliance
program has occurred, and if so, take steps to correct the problem.\53\
As appropriate, such steps may include an immediate referral to
criminal and/or civil law enforcement authorities, a corrective action
plan,\54\ a report to the Government,\55\ and the submission of any
overpayments, if applicable.
---------------------------------------------------------------------------
\53\ Instances of non-compliance must be determined on a case-
by-case basis. The existence, or amount, of a monetary loss to a
health care program is not solely determinative of whether or not
the conduct should be investigated and reported to governmental
authorities. In fact, there may be instances where there is no
monetary loss at all, but corrective action and reporting are still
necessary to protect the integrity of the applicable program and its
beneficiaries.
\54\ Advice from the hospital's in-house counsel or an outside
law firm may be sought to determine the extent of the hospital's
liability and to plan the appropriate course of action.
\55\ The OIG currently maintains a voluntary disclosure program
that encourages providers to report suspected fraud. The concept of
voluntary self-disclosure is premised on a recognition that the
Government alone cannot protect the integrity of the Medicare and
other Federal health care programs. Health care providers must be
willing to police themselves, correct underlying problems and work
with the Government to resolve these matters. The OIG's voluntary
self-disclosure program has four prerequisites: (1) the disclosure
must be on behalf of an entity and not an individual; (2) the
disclosure must be truly voluntary (i.e., no pending proceeding or
investigation); (3) the entity must disclose the nature of the
wrongdoing and the harm to the Federal programs; and (4) the entity
must not be the subject of a bankruptcy proceeding before or after
the self-disclosure.
---------------------------------------------------------------------------
Where potential fraud or False Claims Act liability is not
involved, the OIG recognizes that HCFA regulations and contractor
guidelines already include procedures for returning overpayments to the
Government as they are discovered. However, even if the overpayment
detection and return process is working and is being monitored by the
hospital's audit or coding divisions, the OIG still believes that the
compliance officer needs to be made aware of these overpayments,
violations or deviations and look for trends or patterns that may
demonstrate a systemic problem.
Depending upon the nature of the alleged violations, an internal
investigation will probably include interviews and a review of relevant
documents. Some hospitals should consider engaging outside counsel,
auditors, or health care experts to assist in an investigation. Records
of the investigation should contain documentation of the alleged
violation, a description of the investigative process, copies of
interview notes and key documents, a log of the witnesses interviewed
and the documents reviewed, the results of the investigation, e.g., any
disciplinary action taken, and the corrective action implemented. While
any action taken as the result of an investigation will necessarily
vary depending upon the hospital and the situation, hospitals should
strive for some consistency by utilizing sound practices and
disciplinary protocols. Further, after a reasonable period, the
compliance officer should review the circumstances that formed the
basis for the investigation to determine whether similar problems have
been uncovered.
[[Page 8998]]
If an investigation of an alleged violation is undertaken and the
compliance officer believes the integrity of the investigation may be
at stake because of the presence of employees under investigation,
those subjects should be removed from their current work activity until
the investigation is completed (unless an internal or Government-led
undercover operation is in effect). In addition, the compliance officer
should take appropriate steps to secure or prevent the destruction of
documents or other evidence relevant to the investigation. If the
hospital determines that disciplinary action is warranted, if should be
prompt and imposed in accordance with the hospital's written standards
of disciplinary action.
2. Reporting. If the compliance officer, compliance committee or
management official discovers credible evidence of misconduct from any
source and, after a reasonable inquiry, has reason to believe that the
misconduct may violate criminal, civil or administrative law, then the
hospital promptly should report the existence of misconduct to the
appropriate governmental authority \56\ within a reasonable period, but
not more than sixty (60) days \57\ after determining that there is
credible evidence of a violation.\58\ Prompt reporting will demonstrate
the hospital's good faith and willingness to work with governmental
authorities to correct and remedy the problem. In addition, reporting
such conduct will be considered a mitigating factor by the OIG in
determining administrative sanctions (e.g., penalties, assessments, and
exclusion), if the reporting provider becomes the target of an OIG
investigation.\59\
---------------------------------------------------------------------------
\56\ I.e., Federal and/or State law enforcement having
jurisdiction over such matter. Such governmental authority would
include DOJ and OIG with respect to Medicare and Medicaid violations
giving rise to causes of actions under various criminal, civil and
administrative false claims statutes.
\57\ To qualify for the ``not less than double damages''
provision of the False Claims Act, the report must be provided to
the Government within thirty (30) days after the date when the
hospital first obtained the information. 31 U.S.C. 3729(a).
\58\ The OIG believes that some violations may be so serious
that they warrant immediate notification to governmental
authorities, prior to, or simultaneous with, commencing an internal
investigation, e.g., if the conduct: (1) is a clear violation of
criminal law; (2) has a significant adverse effect on the quality of
care provided to program beneficiaries (in addition to any other
legal obligations regarding quality of care); or (3) indicates
evidence of a systemic failure to comply with applicable laws, an
existing corporate integrity agreement, or other standards of
conduct, regardless of the financial impact on Federal health care
programs.
\59\ The OIG has published criteria setting forth those factors
that the OIG takes into consideration in determining whether it is
appropriate to exclude a health care provider from program
participation pursuant to 42 U.S.C. 1320a-7(b)(7) for violations of
various fraud and abuse laws. See 62 FR 67392, December 24, 1997.
---------------------------------------------------------------------------
When reporting misconduct to the Government, a hospital should
provide all evidence relevant to the alleged violation of applicable
Federal or State law(s) and potential cost impact. The compliance
officer, under advice of counsel, and with guidance from the
governmental authorities, could be requested to continue to investigate
the reported violation. Once the investigation is completed, the
compliance officer should be required to notify the appropriate
governmental authority of the outcome of the investigation, including a
description of the impact of the alleged violation on the operation of
the applicable health care programs or their beneficiaries. If the
investigation ultimately reveals that criminal or civil violations have
occurred, the appropriate Federal and State officials \60\ should be
notified immediately.
---------------------------------------------------------------------------
\60\ Appropriate Federal and State authorities include the
Criminal and Civil Divisions of the Department of Justice, the U.S.
Attorney in the hospital's district, and the investigative arms for
the agencies administering the affected Federal or State health care
programs, such as the State Medicaid Fraud Control Unit, the Defense
Criminal Investigative Service, and the Offices of Inspector General
of the Department of Health and Human Services, the Department of
Veterans Affairs and the Office of Personnel Management (which
administers the Federal Employee Health Benefits Program).
---------------------------------------------------------------------------
As previously stated, the hospital should take appropriate
corrective action, including prompt identification and restitution of
any overpayment to the affected payor and the imposition of proper
disciplinary action. Failure to repay overpayments within a reasonable
period of time could be interpreted as an intentional attempt to
conceal the overpayment from the Government, thereby establishing an
independent basis for a criminal violation with respect to the
hospital, as well as any individuals who may have been involved.\61\
For this reason, hospital compliance programs should emphasize that
overpayment obtained from Medicare or other Federal health care
programs should be promptly returned to the payor that made the
erroneous payment.\62\
---------------------------------------------------------------------------
\61\ See 42 U.S.C. 1320a-7b(a)(3).
\62\ Normal repayment channels as described in HCFA's manuals
and guidances are the appropriate vehicle for repaying identified
overpayments. Hospitals should consult with its fiscal intermediary
or HCFA for any further guidance regarding these repayment channels.
Interest will be assessed, when appropriate. See 42 CFR 405.376.
---------------------------------------------------------------------------
III. Conclusion
Through this document, the OIG has attempted to provide a
foundation to the process necessary to develop an effective and cost-
efficient hospital compliance program. As previously stated, however,
each program must be tailored to fit the needs and resources of an
individual hospital, depending upon its particular corporate structure,
mission, and employee composition. The statutes, regulations and
guidelines of the Federal and State health insurance programs, as well
as the policies and procedures of the private health plans, should be
integrated into every hospital's compliance program.
The OIG recognizes that the health care industry in this country,
which reaches millions of beneficiaries and expends about a trillion
dollars, is constantly evolving. However, the time is right for
hospitals to implement a strong voluntary compliance program concept in
health care. As stated throughout this guidance, compliance is a
dynamic process that helps to ensure that hospitals and other health
care providers are better able to fulfill their commitment to ethical
behavior, as well as meet the changes and challenges being imposed upon
them by Congress and private insurers. Ultimately, it is the OIG's hope
that a voluntarily created compliance program will enable hospitals to
meet their goals, improve the quality of patient care, and
substantially reduce fraud, waste and abuse, as well as the cost of
health care to Federal, State and private health insurers.
Dated: February 11, 1998.
June Gibbs Brown,
Inspector General.
[FR Doc. 98-4399 Filed 2-20-98; 8:45 am]
BILLING CODE 4150-04-M
