November 2011 Newsletter
HHS Announces 2012 Work Plan
Each fall, the Department of Health and Human Services (HHS) Office of Inspector General (OIG) publishes its Work Plan for the upcoming fiscal year. This Plan includes various activities and reviews that the OIG hopes to address in 2012. The Plan focuses on audits and evaluations since the OIG’s mission is to protect HHS programs from fraud, waste, and abuse. Here are some excerpts from the Centers for Medicare & Medicaid Services (CMS) portion of the Plan:
Hospitals
- Accuracy of Present-on-Admission (POA) Indicators Submitted on Medicare Claims. The OIG will review the accuracy of POA indicators submitted on inpatient claims submitted by hospitals nationally in October 2008. Hospitals do not receive additional payment for certain conditions that were not present when the patient was admitted. Beginning in FY 2008, CMS required hospitals to submit POA indicators with each diagnosis code on Medicare hospital inpatient claims. These indicators identify which diagnoses were present at the time of admission and those conditions that developed during the hospital stay. Recent law provides that hospitals with high rates of hospital-acquired conditions will receive reduced payments. They will use certified coders to review medical records and Medicare claims.
- Medicare Inpatient and Outpatient Payments to Acute Care Hospitals. They will review Medicare payments to hospitals to determine compliance with selected billing requirements. The OIG will use the results of these reviews to recommend recovery of overpayments and identify providers that routinely submit improper claims. Prior OIG audits, investigations, and inspections have identified areas that are at risk for noncompliance with Medicare billing requirements. Based on computer matching and data mining techniques, they will select hospitals for focused reviews of claims that may be at risk for overpayments.
Other Providers and Suppliers
- Part B Payments for Glycated Hemoglobin A1C Tests. The OIG will review Medicare contractors’ procedures for screening the frequency of clinical laboratory claims for glycated hemoglobin A1C tests and determine the appropriateness of Medicare payments for these tests. Preliminary OIG work at two Medicare contractors showed variations in the contractors’ procedures for screening the frequency of these tests. It is not considered reasonable and necessary to perform a glycated hemoglobin test more often than every 3 months on a controlled diabetic patient unless documentation supports the medical necessity of testing in excess of national coverage determinations guidelines.
- Medicare Payments for Part B Claims with G Modifiers. They will review Medicare payments made from 2002 to 2010 for claims on which providers used certain modifier codes indicating that Medicare denial was expected and will determine the extent to which Medicare paid claims having such modifiers. The OIG will also identify providers and suppliers with atypically high billing related to the modifiers. Providers may use GA or GZ modifiers on claims they expect Medicare to deny as not reasonable and necessary. They may use GX or GY modifiers for items or services that are statutorily excluded.
Recovery Act Reviews: Medicare and Medicaid Information Systems and Data Security
- OCR Oversight of the HIPAA Privacy Rule. The OIG will review Office for Civil Rights (OCR) oversight of the HIPAA Privacy Rule. The Recovery Act requires that OCR investigate all privacy complaints filed against covered entities if a preliminary investigation indicates willful neglect of the Privacy Rule. Covered entities include health plans, health care clearinghouses, and health care providers that electronically transmit health information in connection with certain HIPAA transactions and technical standards. The Recovery Act also strengthened OCR’s enforcement of the HIPAA Privacy Rule by increasing the civil monetary penalties for covered entities’ noncompliance. They will review OCR’s investigation policies and assess OCR’s oversight to ensure that covered entities are complying with the Privacy Rule.
- OCR Oversight of the HITECH Breach Notification Rule. They will review OCR’s oversight of the Heath Information Technology for Economic and Clinical Health Act (HITECH) Breach Notification Rule, which requires that covered entities, as defined by HIPAA, notify affected individuals, the Secretary of HHS, and when required, the media, following the discovery of a breach in unsecured PHI. A breach is the unauthorized acquisition, access, use, or disclosure of PHI that compromises the security or privacy of such information. Unsecured PHI is individually identifiable health information that is unencrypted or not destroyed in a way that renders the PHI unusable or unreadable by unauthorized individuals. The Secretary of HHS delegated oversight responsibility to OCR. The OIG will review OCR’s policies for investigating breaches reported by covered entities and determine whether Medicare Part B-covered entities have policies or plans in place to mitigate breaches.