Tribal health facilities that provide critical services and high-quality care are also responsible for processing and submitting proper claims for payment.
There’s a reliance on internal staff to be up to date on regulatory requirements and other information in order to submit accurate claims to third-party payers. This includes identifying coverage that’s deemed medically necessary based on Indian Health Services (IHS) requirements. In addition, there’s an assumption that internal staff won’t circumvent controls and alter the coding of services charged by the provider or the fees submitted to payers.
Some Tribal members don’t have alternative resources for health coverage so it’s important that facilities which receive funding from the IHS protect themselves from penalties.
An auditing and monitoring program can help your Tribal health facility:
Produce documentation that supports medical necessity and is properly coded and submitted to the payers
Demonstrate the effectiveness of your organization’s compliance program with a high level of audit accuracy rates.
Train providers and employees on requirements for maintaining integrity and knowing how to prevent, detect, and correct in order to avoid penalties
An overview of key considerations for an auditing and monitoring program follows.
Background
In the late 1990s and early 2000s, the Office of Inspector General (OIG) for the U.S. Department of Health and Human Services developed recommended guidance for compliance programs for healthcare entities.
The OIG sought to engage the healthcare community in the combat of fraud, waste, and abuse by providing tools that could assist in prevention, detection, and correction. They released two important sets of guidelines for Tribal health facilities — specifically individual and small group physician practices and third-party medical billing companies — when developing a compliance program.
The guidance recommends that an organization implement key elements, also referred to as the seven elements, to demonstrate an effective compliance program.
Program elements
Implement policies and procedures
Designate a compliance officer and compliance committee
Conduct effective training and education
Develop effective lines of communication
Conduct internal monitoring and auditing
Enforce standards through disciplinary guidelines
Respond to detected problems and undertake corrective action
Element five calls for internal monitoring and auditing, which the OIG recommends be completed periodically. The OIG and other agencies expect an organization to implement a formal audit and monitoring program with oversight by management and the compliance officer. Many smaller organizations may not be able to hire one person for the compliance officer role but the OIG recommends either a person or group of individuals be designated as responsible for compliance and program oversight. This group would be responsible for developing, implementing, and monitoring the audit and monitoring program.
Purpose of an audit and monitoring program
An audit and monitoring program should assist with the ongoing evaluation of the organization’s compliance program and demonstrate effectiveness of internal controls.
This includes:
Adherence to policies and procedures
Information supporting the services is documented and available
Services meet requirements and support medical necessity as expected by IHS and third-party payers
Identification of risks
Measurement of the compliance program’s effectiveness by tracking improvement over time and
Ensures the compliance program does not become stale and outdated.
An organization should also consider if the program provides a mechanism for proactively assessing regulation changes and identifying issues relevant to misconduct. This requires continuous improvement, periodic testing, and review.
Identify risks in your organization
Ideally, an organization would regularly complete a risk assessment that helps define the work plan for the audits or monitoring. Without a work plan, an organization might not demonstrate it’s aware of the risks impacting it and focus attention on lower-risk areas.
The OIG recommends an organization develop a set of monitors or warning indicators to alert it to risks that require mitigation. This may be in the form of data mining or reported concerns from employees or patients. These indicators can assist in identifying a risk when it occurs instead of years after the incident.
If a Tribal health facility uses a third-party billing agency, then management should require access or delivery of a report that details what the agency monitors for risk areas as well as auditing of the records and billing.
It’s important to note that even if an organization doesn’t complete a risk assessment, various government agencies are actively monitoring the data by using internally developed tools to identify areas of risk and providers that are outliers.
How would you know if your organization is being monitored? If your organization frequently receives requests for documentation from state and federal agencies, these requests could be an indicator that those agencies are looking at your organization. These requests can look like an agency is looking for support of a determination of medical necessity of a denied service. But the requests could instead be because data mining flagged an outlier. Many organizations don’t have a formalized process to track or monitor types of documentation or service for these requests. An organization should establish a method for tracking these requests and then review the trends.
Risk areas
The OIG identified four potential risk areas within recommended guidance:
Coding and billing
Reasonable and necessary services
Documentation
Improper inducements
Consider establishing an audit and monitoring program that regularly reviews and identifies your organization’s greatest risks.
Questions to consider
What are the most common services provided in your organization?
Do you routinely receive denials for a particular service?
What are high-risk issues specific to your organization?
When should annual OIG work plan reviews take place to identify high-risk areas?
Auditing versus monitoring
An organization should be aware of the differences between auditing and monitoring.
Definition of auditing
Auditing consists of reviewing documentation retrospectively to determine if the organization followed procedure and performed and documented a service correctly. A component of an auditing and monitoring program is helping an organization spend resources on proactive steps to mitigate risk instead of correcting an error by refunding money.
Auditing
Is based on risk areas identified in a risk assessment or prior audits
Checks whether a service was provided and documented correctly
Evaluates and improves the effectiveness of processes and controls
Uses sampling techniques and considers key attributes when auditing the risk area
Definition of monitoring
Monitoring is meant to set up a mechanism to prevent transmitting inaccurate information or data to payers or agencies.
Monitoring
Involves ongoing checking and measuring
Continuously checks whether processes work as intended
Includes internal data integrity checks or monitoring of staff
Uses system edits or work queues to validate risk areas
Design your audit and monitoring program
An audit and monitoring program will vary between organizations due to size, type of entity, and complexity of the organization.
Keep in mind that the design of the audit and methods for sample selection can impact the audit results. The audit should be designed in a manner that will drill down to the risk.
Based on results, action plans can be formulated related to special investigations, operational changes, and overpayment refunds. Corrective action plans may include discussion of how to score or evaluate the results.
Audit and monitoring program elements
An audit and monitoring program will vary between organizations due to size, type of entity, and complexity of the organization. But an effective audit and monitoring program includes follow-up, completion of training of employees, accountability, and monitoring of corrective action plans.
A continuous audit and monitoring program should include planning or a work plan, tools for sample selection, a review of charts or documents, and delivery of concise audit results that provides training and also corrective action monitoring.
Key elements
Design a work plan
Create a work plan around areas of risk with a risk assessment, but be sure to include the actions to be completed related to monitoring, including:
Regular audits of each provider in order to train and educate
Audits related to billing and documentation of internal controls as defined by policy and procedure
Monitoring already established or requiring review by a compliance team or officer
Plan
For each audit, develop an audit work plan that establishes guidance related to the risk, scoring of audit results, and background materials. Identify tools needed for audits, including an approach to selecting a sample that focuses on the risk and how to document the testing.
Sample selection
Each audit may vary in how a sample is selected based upon the data, allegations, or type of concern. For example, if there is concern that a provider is copying and pasting their notes from one visit to the next, then an audit of a random set of claims might not uncover this issue. Instead, consider selecting a sample of patients and review all visits during a designated period.
Review
Once the sample is selected, the team must track the results of the testing of key attributes. Ideally an organization has audit software to assist in the testing. Prior to the review and in the planning stage, there should be development of attributes to test related to the risk, concern, or allegation.
For example, if the concern is the presence of an order for a test, then attributes should include presence of order, date of order as compared to date of test, and authentication by the provider of the order or intent documented in the progress note.
Deliver and educate
Audit and monitoring program effectiveness is often measured by the results as well as the demonstrated improvement. Track results of the audit centrally and monitor follow-up actions until complete. Conduct regular audits of each provider for training and education.
Monitor corrective action
Effectiveness can be measured by the corrective action plan (CAP) follow-up, completion, and prevention of repeated problems. We have seen organizations implement metrics that measure the number of CAPs and the average length of time to finalize a CAP.
