ohca can... · kitch drutchas wagner valitutti & sherbrook one woodward avenue suite 2400...
TRANSCRIPT
10/1/2019
1
John Paul HessburgPrincipal / Partner
Kitch Drutchas Wagner Valitutti & SherbrookOne Woodward Avenue
Suite 2400Detroit, MI 48226-5485
www.kitch.com
Angie Szumlinski, LNHA, RN-BC, RAC-CT, BSDirector Risk Management130 S 1st Street, Suite 400
Ann Arbor, MI 48104734-929-6411
HealthCap® | QA Reader®www.HealthCapUSA.com
www.QAReader.com
These materials have been prepared by HealthCap RMS and Kitch Drutchas Wagner Valitutti & Sherbrook PC, for informational purposes only and are not legal advice. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. Readers should not act upon this information without seeking professional counsel. Photographs, articles, records, pleadings, etc., are for dramatization purposes only.
10/1/2019
2
• There is no precise measure of health care fraud
• Those intent on abusing Federal health care programs have cost taxpayers billions of dollars
• The impact of these losses and risks magnifies as Medicare continues to serve a growing number of recipients
Typically includes any of the following:• Knowingly submitting, or causing to be
submitted, false claims or making misrepresentations of fact to obtain a Federal health care payment for which no entitlement would otherwise exist
• Knowingly soliciting, receiving, offering, and/or paying remuneration to induce or reward referrals for items or services reimbursed by Federal health care programs
• Making prohibited referrals for certain designated health services
• Billing Medicare for appointments the patient failed to keep
• Knowingly billing for services at a level of complexity higher than services actually provided or documented in the file
• Knowingly billing for services not furnished, supplies not provided, or both, including falsifying records to show delivery of such items
• Paying for referrals of Federal health care program beneficiaries
• Billing for unnecessary medical services• Charging excessively for services or
supplies• Misusing codes on a claim, such as up-
coding or unbundling codes• Medicare abuse can also expose
providers to criminal and civil liability.
10/1/2019
3
• False Claims Act (FCA)
• Anti-Kickback Statute (AKS)
• Physician Self-Referral Law (Stark Law)
• Social Security Act
• United States Criminal Code
Definition
Knowing and knowingly mean a person has actual knowledge of the information or acts in deliberate ignorance or reckless disregard of the truth or falsity of the information related to the claim
Example
Physician knowingly submits a claim to Medicare for a higher level of medical service than actually provided or higher than the medical record documentation supports
10/1/2019
4
Definition
It is a crime to knowingly and willfully offer, pay, solicit or receive any remuneration directly or indirectly to induce or reward referrals of items or services reimbursed by the health care program
When a provider offers, pays, solicits or receives unlawful remuneration, the provider violates the AKS.
Example
Provider receives cash or below fair market value rent for medical office space in exchange for referrals
• If certain types of arrangements satisfy regulatory safe harbor regulations they may not violate the AKS
• A safe harbor is a provision of a statute or a regulation that specifies that certain conduct will be deemed not to violate a given rule. It is usually found in connection with a vaguer, overall standard.
10/1/2019
5
• Often called the Stark Law
• Prohibits a physician from referring certain designated health services payable by Medicare or Medicaid to any entity in which the physician (or an immediate family member) has an ownership/investment interest or with which he or she has a compensation arrangement
Provider refers a beneficiary for a designated health service to a business in which the provider has an investment interest
10/1/2019
6
Prohibits knowingly and willfully executing or attempting to execute a scheme or artifice connected to the delivery of or payment for health care benefits, items or service to either:
• Defraud any health care benefit program
• Obtain (by means of false or fraudulent pretenses, representations or promises) any of the money or property owned by or under the control of any health care benefit program
Several doctors and medical clinics conspire in a coordinated scheme to defraud the Medicare Program by submitting medically unnecessary claims for power wheelchairs
10/1/2019
7
Penalties for violating the Criminal Health Care Fraud Statue may include fines, imprisonment or both
The OIG must exclude providers and suppliers convicted of any of the following from participation in all Federal health care programs• Medicare fraud as well as any other offenses related to the
delivery of items or services under Medicare• Patient abuse or neglect• Felony convictions for other health care-related fraud, theft or
other financial misconduct• Felony convictions for unlawful manufacture, distribution,
prescription or dispensing of controlled substances
10/1/2019
8
• Misdemeanor convictions related to health care fraud other than Medicare or Medicaid fraud
• Misdemeanor convictions for unlawfully manufacturing, distributing, prescribing or dispensing controlled substances
• Suspension, revocation or surrender of a license to provide health care for reasons bearing on professional competence, professional performance or financial integrity
• Providing unnecessary or substandard services
• Submitting false or fraudulent claims to a Federal health care program
• Engaging in unlawful kickback arrangements
• Defaulting on health education loan or scholarship obligation
• May not participate in Federal health care program for period of time
• May not bill Federal health care programs including Medicare, Medicaid and State Children’s Health Insurance Program
• An employer or group practice may not bill for an excluded provider’s services
• Reinstatement is not automatic
10/1/2019
9
• Authorizes CMP’s for a variety of health care fraud violations
• Different amounts of penalties and assessments may be authorized based on the type of violation
• CMP’s also may include an assessment of up to three times the amount claimed for each item or service
• Or up to three times the amount of remuneration offered, paid, solicited or received
• Presenting a claim you know, or should know, is for an item or service not provided as claimed or that is false and fraudulent
• Presenting a claim you know, or should know, is for an item or service for which Medicare will not pay
• Violating the AKS
10/1/2019
10
• Protects the integrity of HHS programs including Medicare and the health and welfare of its beneficiaries
• Operates through a nationwide network of audits, investigations, inspections, and other related functions
• Authorized to exclude individuals and entities who engage in fraud or abuse from participation in Medicare, Medicaid and other Federal health care programs
• Authorized to impose CMPs for certain violations related to Federal health care programs
• The DOJ, OIG and HHS established HEAT to build and strengthen existing programs combatting Medicare fraud while investing new resources and technology to prevent fraud and abuse
• Targets emerging or migrating fraud schemes, including fraud by criminals masquerading as health care providers or suppliers
10/1/2019
11
If a FCA is Pursued Against Your Community, Would Your Compliance
Program Help You or Hurt You?
Does the DOJ Pursue Every FCA Claim?
“In general, a compliance program is the internal set of policies, processes, and procedures that a provider organization implements to help it prevent and detect violations of Medicare laws and regulations. In addition, providers and members of the enforcement community agree that an effective compliance program can demonstrate a provider’s intent to comply with Medicare’s rules and requirements.” (Emphasis added)
GAO Report to Congress
April, 1999
10/1/2019
12
• Established compliance standards and procedures;
• A senior-level compliance officer with sufficient resources and authority;
• Due care not to delegate discretionary authority to individuals with a propensity for wrongdoing;
• Communicating standards and procedures to employee via training, publications, etc.;
• Reasonable steps to achieve compliance by monitoring and auditing systems as well as a reporting system for employees;
• Consistent enforcement/discipline, including employee discipline for failing to detect offenses;
• Reasonable responses to detected misconduct, including program modifications to prevent further similar offenses; and
• Periodic reassessment of the compliance program.
It is generally recognized that an effective corporate compliance program is one of the best ways to preclude the conduct that leads to such liability and therefore, minimize the risk of prosecution. It is critical to recognize, however, that the mere establishment of a “paper program” will not satisfy either the spirit or intent of the U.S. Sentencing Guidelines. Corporate compliance programs must be “effective” as defined by the guidelines and should be “…reasonably designed, implemented and enforced so that it generally will be effective in preventing and detecting criminal conduct.”
This will require the serious manager to give considerable thought to program design, implementation and ultimately, to the designation of a Corporate Compliance Officer to monitor the program, investigate alleged cases of wrong-doing and report to management and the governance authority.
10/1/2019
13
• The False Claims Act
Statute: 31 U.S.C. §§ 3729–3733
• The Anti-Kickback
Statute: 42 U.S.C. § 1320a–7b(b)
Safe Harbor Regulations: 42 C.F.R. §1001.952
• The Physician Self-Referral Law
Statute: 42 U.S.C. § 1395nn
Regulations: 42 C.F.R. §§ 411.350–.389
• The Exclusion Authorities Statutes: 42 U.S.C. §§ 1320a–7, 1320c–5 Regulations: 42 C.F.R. pts. 1001 (OIG) and
1002 (State agencies)
• The Civil Monetary Penalties Law Statute: 42 U.S.C. § 1320a–7a Regulations: 42 C.F.R. pt. 1003
• Criminal Health Care Fraud Statute Statute: 18 U.S.C. §§ 1347, 1349
• The U.S. Department of Justice published its "Evaluation of Corporate Compliance Programs," which outlines how it assesses the effectiveness of a corporate compliance program.
• The publication covers 11 topics and includes questions that prosecutors may consider when conducting an investigation of a corporate entity to determine whether to bring charges or in negotiating plea or other agreements.
• These factors include “the existence and effectiveness of the corporation’s pre-existing compliance program” and the corporation’s remedial efforts “to implement an effective corporate compliance program or to improve an existing one.”
10/1/2019
14
• Companies can use this information to evaluate the effectiveness of, and if needed improve, their existing compliance programs.
• The topics and questions are not a checklist nor a formula.
• Corporate compliance program are evaluated in the specific context of a criminal investigation.
• In any particular case, the topics and questions may not all be relevant, and others may be more significant given the particular facts at issue.
Areas of Focus1. Analysis and Remediation of Underlying Misconduct2. Senior and Middle Management3. Autonomy and Resources4. Policies and Procedures5. Risk Assessment6. Training and Communications7. Confidential Reporting and Investigation8. Incentives and Disciplinary Measures 9. Continuous Improvement, Periodic Testing and Review10. Third Party Management11. Mergers and Acquisitions (M&A)
10/1/2019
15
Root Cause Analysis
What is the company’s root cause analysis of the misconduct at issue? What systemic issues were identified? Who in the company was involved in making the analysis?
Prior Indications
Were there prior opportunities to detect the misconduct in question, such as audit reports identifying relevant control failures or allegations, complaints, or investigations involving similar issues? What is the company’s analysis of why such opportunities were missed?
Remediation
What specific changes has the company made to reduce the risk that the same or similar issues will not occur in the future? What specific remediation has addressed the issues identified in the root cause and missed opportunity analysis?
Conduct at the Top
How have senior leaders, through their words and actions, encouraged or discouraged the type of misconduct in question? What concrete actions have they taken to demonstrate leadership in the company’s compliance and remediation efforts? How does the company monitor its senior leadership’s behavior? How has senior leadership modelled proper behavior to subordinates?
Shared Commitment
What specific actions have senior leaders and other stakeholders (e.g., business and operational managers, Finance, Procurement, Legal, Human Resources) taken to demonstrate their commitment to compliance, including their remediation efforts? How is information shared among different components of the company?
Oversight
What compliance expertise has been available on the board of directors? Have the board of directors and/or external auditors held executive or private sessions with the compliance and control functions? What types of information have the board of directors and senior management examined in their exercise of oversight in the area in which the misconduct occurred?
10/1/2019
16
Compliance Role
Was compliance involved in training and decisions relevant to the misconduct? Did the compliance or relevant control functions (e.g., Legal, Finance, or Audit) ever raise a concern in the area where the misconduct occurred?
Stature
How has the compliance function compared with other strategic functions in the company in terms of stature, compensation levels, rank/title, reporting line, resources, and access to key decision-makers? What has been the turnover rate for compliance and relevant control function personnel? What role has compliance played in the company’s strategic and operational decisions?
Experience and Qualifications
Have the compliance and control personnel had the appropriate experience and qualifications for their roles and responsibilities?
Autonomy
Have the compliance and relevant control functions had direct reporting lines to anyone on the BOD? How often do they meet with the BOD? Are members of the senior management present for these meetings? Who reviewed the performance of the compliance function and what was the review process? Who has determined compensation/bonuses/ raises/hiring/termination of compliance officers? Do the compliance and relevant control personnel in the field have reporting lines to headquarters? If not, how has the company ensured their independence?
Empowerment
Have there been specific instances where compliance raised concerns or objections in the area in which the wrongdoing occurred? How has the company responded to such compliance concerns? Have there been specific transactions or deals that were stopped, modified, or more closely examined as a result of compliance concerns?
Funding and Resources
How have decisions been made about the allocation of personnel and resources for the compliance and relevant control functions in light of the company’s risk profile? Have there been times when requests for resources by the compliance and relevant control functions have been denied? If so, how have those decisions been made?
Outsourced Compliance Functions
Has the company outsourced all or parts of its compliance functions to an external firm or consultant? What has been the rationale for doing so? Who has been involved in the decision to outsource? How has that process been managed (including who oversaw and/or liaised with the external firm/consultant)? What access level does the external firm or consultant have to company information? How has the effectiveness of the outsourced process been assessed?
10/1/2019
17
Compliance Role
Was compliance involved in training and decisions relevant to the misconduct? Did the compliance or relevant control functions (e.g., Legal, Finance, or Audit) ever raise a concern in the area where the misconduct occurred?
Stature
How has the compliance function compared with other strategic functions in the company in terms of stature, compensation levels, rank/title, reporting line, resources, and access to key decision-makers? What has been the turnover rate for compliance and relevant control function personnel? What role has compliance played in the company’s strategic and operational decisions?
Experience and Qualifications
Have the compliance and control personnel had the appropriate experience and qualifications for their roles and responsibilities?
Designing Compliance Policies and Procedures
What has been the company’s process for designing and implementing new policies and procedures? Who has been involved in the design of policies and procedures? Have business units/divisions been consulted prior to rolling them out?
Applicable Policies and Procedures
Has the company had policies and procedures that prohibited the misconduct? How has the company assessed whether these policies and procedures have been effectively implemented? How have the functions that had ownership of these policies and procedures been held accountable for supervisory oversight?
Gatekeepers
Has there been clear guidance and/or training for the key gatekeepers (e.g., the persons who issue payments or review approvals) in the control processes relevant to the misconduct? What has been the process for them to raise concerns?
Accessibility
How has the company communicated the policies and procedures relevant to the misconduct to relevant employees and third parties? How has the company evaluated the usefulness of these policies and procedures?
DESIGN AND ACCESSIBILITY
10/1/2019
18
Responsibility for Integration
Who has been responsible for integrating policies and procedures? With whom have they consulted (e.g., officers, business segments)? How have they been rolled out (e.g., do compliance personnel assess whether employees understand the policies)?
Controls
What controls failed or were absent that would have detected or prevented the misconduct? Are they there now?
Payment Systems
How was the misconduct in question funded (e.g., purchase orders, employee reimbursements, discounts, petty cash)? What processes could have prevented or detected improper access to these funds? Have those processes been improved?
Approval/Certification Process
How have those with approval authority or certification responsibilities in the processes relevant to the misconduct known what to look for, and when and how to escalate concerns? What steps have been taken to remedy any failures identified in this process?
Vendor Management
If vendors had been involved in the misconduct, what was the process for vendor selection and did the vendor in question go through that process?
OPERATIONAL INTEGRATION
Risk Management Process
What methodology has the company used to identify, analyze, and address the particular risks it faced?
Information Gathering and Analysis
What information or metrics has the company collected and used to help detect the type of misconduct in question? How has the information or metrics informed the company’s compliance program?
Manifested Risks
How has the company’s risk assessment process accounted for manifested risks?
10/1/2019
19
Risk-Based Training
What training have employees in relevant control functions received? Has the company provided tailored training for high-risk and control employees that addressed the risks in the area where the misconduct occurred? What analysis has the company undertaken to determine who should be trained and on what subjects?
Form/Content/Effectiveness of Training
Has the training been offered in the form and language appropriate for the intended audience? How has the company measured the effectiveness of the training?
Communications about Misconduct
What has senior management done to let employees know the company’s position on the misconduct that occurred? What communications have there been generally when an employee is terminated for failure to comply with the company’s policies, procedures, and controls (e.g., anonymized descriptions of the type of misconduct that leads to discipline)?
Availability of Guidance
What resources have been available to employees to provide guidance relating to compliance policies? How has the company assessed whether its employees know when to seek advice and whether they would be willing to do so?
Effectiveness of the Reporting Mechanism
How has the company collected, analyzed, and used information from its reporting mechanisms? How has the company assessed the seriousness of the allegations it received? Has the compliance function had full access to reporting and investigative information?
Properly Scoped Investigation by Qualified Personnel
How has the company ensured that the investigations have been properly scoped, and were independent, objective, appropriately conducted, and properly documented?
Response to Investigations
Has the company’s investigation been used to identify root causes, system vulnerabilities, and accountability lapses, including among supervisory manager and senior executives? What has been the process for responding to investigative findings? How high up in the company do investigative findings go?
10/1/2019
20
AccountabilityWhat disciplinary actions did the company take in response to the misconduct and when did they occur? Were managers held accountable for misconduct that occurred under their supervision? Did the company’s response consider disciplinary actions for supervisors’ failure in oversight? What is the company’s record (e.g., number and types of disciplinary actions) on employee discipline relating to the type(s) of conduct at issue? Has the company ever terminated or otherwise disciplined anyone (reduced or eliminated bonuses, issued a warning letter, etc.) for the type of misconduct at issue?
Human Resources Process Who participated in making disciplinary decisions for the type of misconduct at issue?
Consistent ApplicationHave the disciplinary actions and incentives been fairly and consistently applied across the organization?
Incentive SystemHow has the company incentivized compliance and ethical behavior? How has the company considered the potential negative compliance implications of its incentives and rewards? Have there been specific examples of actions taken (e.g., promotions or awards denied) as a result of compliance and ethics considerations?
Internal AuditWhat types of audits would have identified issues relevant to the misconduct? Did those audits occur and what were the findings? What types of relevant audit findings and remediation progress have been reported to management and the board on a regular basis? How have management and the board followed up? How often has internal audit generally conducted assessments in high-risk areas?
Control TestingHas the company reviewed and audited its compliance program in the area relating to the misconduct, including testing of relevant controls, collection and analysis of compliance data, and interviews of employees and third-parties? How are the results reported and action items tracked? What control testing has the company generally undertaken?
Evolving UpdatesHow often has the company updated its risk assessments and reviewed its compliance policies, procedures, and practices? What steps has the company taken to determine whether policies/procedures/practices make sense for particular business segments/subsidiaries?
10/1/2019
21
Risk-Based and Integrated ProcessesHow has the company’s third-party management process corresponded to the nature and level of the enterprise risk identified by the company? How has this process been integrated into the relevant procurement and vendor management processes?Appropriate Controls What was the business rationale for the use of the third parties in question? What mechanisms have existed to ensure that the contract terms specifically described the services to be performed, that the payment terms are appropriate, that the described contractual work is performed, and that compensation is commensurate with the services rendered?Management of RelationshipsHow has the company considered and analyzed the third party’s incentive model against compliance risks? How has the company monitored the third parties in question? How has the company trained the relationship managers about what the compliance risks are and how to manage them? How has the company incentivized compliance and ethical behavior by third parties?Real Actions and ConsequencesWere red flags identified from the due diligence of the third parties involved in the misconduct and how were they resolved? Has a similar third party been suspended, terminated, or audited as a result of compliance issues? How has the company monitored these actions (e.g., ensuring that the vendor is not used again in case of termination)?
Due Diligence ProcessWas the misconduct or the risk of misconduct identified during due diligence? Who conducted the risk review for the acquired/merged entities and how was it done? What has been the M&A due diligence process generally?Integration in the M&A ProcessHow has the compliance function been integrated into the merger, acquisition, and integration process?Process Connecting Due Diligence to ImplementationWhat has been the company’s process for tracking and remediating misconduct or misconduct risks identified during the due diligence process? What has been the company’s process for implementing compliance policies and procedures at new entities?
10/1/2019
22
Questions?
• 1. Consent Order, UNITED STATES OF AMERICA, Plaintiff, v. GMS MANAGEMENT-TUCKER, INC., Tucker House II, Inc., Defendants., 1996 WL 33576536 (E.D.Pa.)
• 2. Complaint, UNITED STATES OF AMERICA, Plaintiff, v. GMS MANAGEMENT-TUCKER, INC., Tucker House II, Inc., Defendants., 1996 WL 33576536 (E.D.Pa.)
• 3. Complaint, UNITED STATES OF AMERICA, Plaintiff, v. CHESTER CARE et al, Defendants., case number 98-cv-139(E.D.Pa.)
• 4. Consent Order, , UNITED STATES OF AMERICA, Plaintiff, v. CHESTER CARE et al, Defendants., case number 98-cv-139(E.D.Pa.)
• 5. Individual Accountability for Corporate Wrongdoing, Office of the Deputy Attorney General, U.S. Department of Justice, September 15, 2015
• 6. U.S. Internal Memorandum from Michael D. Grantson, Commercial Litigation Branch, Fraud Division, U.S. Dept. of Justice, “Factors for Evaluating Dismissal Pursuant to 31 U.S.C. 3730(c)(2)(a)”( January 10, 2018)
• 7. "Evaluation of Corporate Compliance Programs“, The U.S. Department of Justice
10/1/2019
23
John Paul HessburgPrincipal / Partner
Kitch Drutchas Wagner Valitutti & SherbrookOne Woodward Avenue
Suite 2400Detroit, MI 48226-5485
www.kitch.com
Angie Szumlinski, LNHA, RN-BC, RAC-CT, BSDirector Risk Management130 S 1st Street, Suite 400
Ann Arbor, MI 48104734-929-6411
HealthCap® | QA Reader®www.HealthCapUSA.com
www.QAReader.com