Avoid overpayments and penalties by auditing physician payments and arrangements

A previous version of this article was published online in the July issue of California Healthcare News.

Healthcare entities are at risk of noncompliance with Stark Law and the federal Anti-Kickback Statute when they provide remuneration for referring a patient.

The Office of Inspector General (OIG) and law enforcement agencies continue to focus on identifying improper physician arrangements and payments, which have resulted in the U.S. Department of Justice recovering over $17.1 billion since 2009 from fraud and false claims against federal healthcare programs.

This continued focus means healthcare organizations will need to stay extra vigilant to help ensure future compliance, prevent fraud, and avoid steep federal penalties.

Stark law and the anti-kickback statute

The two most problematic regulations for healthcare organizations in terms of penalties are Stark Law and the federal Anti-Kickback Statute. Civil monetary penalties may be levied for violations of Stark Law or the Anti-Kickback Statute, and entities that violate either may be excluded from participation in federal healthcare programs. The Anti-Kickback Statute is also punishable by up to five years of imprisonment and a $25,000 fine.

Best practices to avoid improper physician arrangements

“An ounce of prevention is worth a pound of cure.” Truer words were never spoken as it relates to healthcare entities protecting themselves against any potential Stark Law or Anti-Kickback Statute violation. Fortunately, there are some best practices to prevent inadvertent violations.

An easy culprit: Lacking physician arrangement policies and procedures

Organizations often have incomplete policies, procedures, and standards related to physician arrangements — making them susceptible to penalties under the above-mentioned regulations. In some instances, we’ve observed that the internal controls related to the initiation, approval, and implementation of a physician arrangement are lacking and payments are made without sufficient support.

Key questions to ask

There are some questions an organization should ask about physician payments and contracts as it considers its risk for overpayments and penalties:

• Who are the individuals responsible for physician arrangements and payments?Do they have access to the most recent agreements and amendments?
• Are key personnel aware of the regulations impacting physician contracting? How are these individuals trained on the requirements and risks associated with physician arrangements and payments?
• What controls are in place to ensure compliance with regulations for each type of physician arrangement and payment?
• Does the accounting system allow for the identification of 100% of payments to or from physicians?
• How is fair market value (FMV) determined? Where is supporting documentation for FMV stored, and is it readily available?
• Is there a policy or procedure related to contracting with physicians?
• Is there a procedure for contract approval, including legal review?
• Do documented policies and procedures exist for physician contracting? Are they comprehensive and are they followed?
• Is physician contracting centralized? Can all physician contracts be located?
• How does accounts payable or accounting validate physician payments? Do they have access to a centralized database or is the approver required to validate the contract requirements?
• Do medical directors submit monthly timesheets? If so, who approves timesheets and confirms that documentation supporting the time is sufficient?

Healthcare organizations that can’t answer these questions or that have misgivings about their information might want to consider having a compliance audit or internal audit performed.

Regulatory-compliance monitoring and internal audits

An internal audit or regulatory-compliance monitoring provides a comprehensive evaluation of an organization’s regulatory environment to confirm it’s adherence to the rules and regulations outlined by external agencies and authorities.

An internal audit is the examination, monitoring, and analysis of activities related to an organization’s operations. It tests:

• Compliance environment
• Information systems
• Various other controls and departments

An internal audit also confirms an organization is managing physician arrangements in accordance with policies and legal and regulatory requirements that control financial arrangements.

Recommended audit approach

The steps taken during an audit include:

• Obtaining data. Data includes general ledger accounts, a vendor master file, accounts payment and payroll information for physician payments, and accounts receivable for payments from physicians.
• Selecting a random sample of payments. The sample is taken from the list or lists that have been provided by the healthcare entity.
• Collecting materials and support Materials include contracts covering payment, legal contract request forms, documentation that required legal review occurred, evidence of sanction screenings for contracting parties, FMV analysis, request for payment documentation, and check requests or other documentation.
• Validating payments. This includes a review of time sheets or monthly call reports, invoices, check requests, and other documentation against the contract or arrangement.
• Conducting interviews. Controls are determined by completing interviews with key stakeholders.