Medicare Advantage Compliance

MO-10-11-NB

MEDICARE ADVANTAGE FROM A COMPLIANCE

PERSPECTIVEPresentation by: Cora Butler, JD, RN, CHC,

CCEP

Ty Hubbard, MBA, MHA

MEDICARE ADVANTAGE FROM A COMPLIANCE PERSPECTIVE

PRIMARISQuality Improvement Organization (QIO) for Missouri

Medicare Knowledge

Medicare Signals Direction Through Pilot Projects in Each Scope of Work:

▪Transitions of Care ▪Primary Care Provider Adoption of Electronic Health Records

Quality Improvement Projects

▪HEDIS ▪Core Measures ▪SNF Pressure Ulcer Reduction

Commercial Operations

• Medicare Risk Adjustment

• Core Measures Abstraction

• HEDIS

• Customized Medical Record Review

• Health Information Technology Assistance Center


TAKE AWAY MESSAGES

• Alignment of enterprise risk management and compliance through integration into business operations will drive decision-making and performance

• Strategies to incentivize and motivate desired behaviors are essential to reach strategic goals

• Vendors and business partners must share organizational goals

• Silos are only good for storing grain


HISTORY OF MEDICARE PART C

• 1997: BBA (Balanced Budget Act)

• 2000: Benefits Improvement Act (BIPA)

• 2003: Medicare Prescription Drug, Improvement, and Modernization Act

MEDICARE ADVANTAGE FROM A COMPLIANCE PERSPECTIVEPatient Protection and Affordable Care Act (PPACA) of 2010 as

Amended by the Health Care Education and Reconciliation Act (HCERA) of 2010 Collectively Known as “Health Care Reform”

Health Insurance Reform

– Expansion of Access to Healthcare Services

Medicare and Medicaid Part A & B Payment Reforms

Medicare Advantage (MA)

– Congressional Budget Office combined scoring estimate, MA payment changes will result in approximately $135B reduction in direct federal spending over the next 10 years

– One of the largest spending reduction line items in the Healthcare Reform Law.*

Medicare Part D

*Letter from Doulas W. Elmendorf, Director, CBO, to the Honorable Nancy Pelosi, Speaker, US House of Representatives. Table 5 (March 20, 2010), available at www.cbo.gov/doc.cfm?index=11379&type=1.

Source: American Health Lawyers Member Briefing June 2010.

http://www.cbo.gov/doc.cfm?index=11379&type=1

MEDICARE ADVANTAGE FROM A COMPLIANCE PERSPECTIVECommon Themes Running Through The Health Care Reform Law

The Secretary . . .

• Will adopt regulations . . .

• May alter payment . . .

• Will determine quality performance guidelines . . .

• Will determine how funds will be allocated . . .

• Will establish . . . that will provide for . . .

• Will establish measures . . .

Enhanced Medicare and Medicaid Program Integrity Provisions

Creating an environment of unknowns that makes ERM in healthcare extremely complicated

Phased in regulations will have ongoing impact on compliance plans and change risk

The Secretary (and her staff) will become among the most powerful

people in the country


“Better get ready for a big bunch of ugly followed by

a whole lot of stupid!”

– Queen Latifah


RISK ADJUSTMENT

• Purpose:

• Pays plans accurately/appropriately

• Diagnosis is measure of health status and demographic information

• Quality of Care

• Protection of Beneficiaries

• Reduction of adverse selection


RISK ADJUSTMENT MODEL COMMON CHARACTERISTICS

• Demographic Factors

• Age

• Sex

• Entitlement (original reason)

• Status (disabled)

• Medicaid Status (Part C)

• LIS and LTI Multipliers (Part D)


RISK ADJUSTMENT MODEL COMMON CHARACTERISTICS (cont.)

• Disease Factors

• Disease Groups

• Diagnosis Source

• Inpatient

• Outpatient (hospital)

• Physician setting


Enterprise Risk Management

“A process, affected by an entity’s board of directors, management & other personnel, applied in strategy setting & across the enterprise, designed to identify potential events that may affect the entity, and manage risks to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.”

Enterprise Risk Management-Integrated Framework

http://www.erm.coso.org/Coso/coserm.nsf/vwWebSources/PDF_Manuscript/$file/COSO_Manuscript.pdf


Enterprise Risk Management (ERM)

A discipline that engages professionals in the practice of identifying, managing, controlling, and monitoring all risks to an organization.

And….

American Health Lawyers Association. (2009) Enterprise Risk Management Handbook for Healthcare Entities, First Addition. Ellen L. Barton


Enterprise Risk Management (ERM)

Is an ongoing business decision making process implemented and supported by the board of directors, executive administration, and medical staff leadership.



ERM proactively identifies risks and recognizes the “synergistic” effects of risks across the continuum of business.

When considering areas of risk, ERM refers to each risk as “Risk Domains”.



RISK DOMAINS

• Operational

• Financial

• Human Capital

• Strategic

• Legal/Regulatory

• Technological

• Hazard


Operational Risk Domain

The strategy of healthcare emphasizes the delivery of care is safe, timely, and effective.

Risks associated with the business operation result from inadequate or failed internal processes, people, or systems.



THE BOTTOM LINE

Make sure the right care is provided in the right setting by the right provider type with the right documentation and that there are the right incentives to influence physician behavior.


Financial Risk Domain

Risks that affect the economic standpoint of an entity through business relationships or the timing & recognition of revenue expenses. Risks include:

• Corporate compliance (fraud and abuse)


MEDICARE ADVANTAGE FROM A COMPLIANCE PERSPECTIVEFinancial/Regulatory Risk Domain(s)

Medicare Risk Adjustment – Upcoding – RADV Audit. RAC Audit. False Claims Act. FERA. Civil Monetary Penalties.

Medicare will pay Medicare Advantage plans 14% more per beneficiary than the cost of coverage in traditional Medicare.*

Overpayments average > $1100/beneficiary enrolled in a private plan.**

Increased Medicare costs drive up premiums for beneficiaries in traditional Medicare even though those beneficiaries receive no additional coverage. The CMS Chief Actuary estimated the overpayments now raise premiums by $3.60/month per person or $86/year for a couple.***

Overpayments weaken Medicare’s long term finances by advancing by 17 months the date upon which the Medicare Hospital Trust Fund will be insolvent.*

*Medicare Payment Advisory Commission, “Report to Congress: Medicare Payment Policy,” March 2009.

** Brian Biles, Jonah Pozen, and Stuart Guterman, “The Continuing Cost of Privatization: Extra Payments to Medicare Advantage Plans jump to

$11.4 Billion in 2009.” The Commonwealth Fund, May 4, 2009.

*** Rick Foster, “ Letter to Pete Stark on Medicare Advantage and the Hospital Trust Fund Solvency,” Centers for Medicare and

Medicaid Services, Office of the Actuary. June 2009


April 15, 2010 CMS released the final rule related to MA and Part D Plan Sponsors. Requires Establishment of a Compliance Program*

Goal: Control of Fraud, Waste and Abuse in Medicare, currently the nation’s largest federally funded health insurance program.

Fraud: An intentional deception or misrepresentation made by an individual or entity, where they know the deception or misrepresentation could result in a benefit to which the individual or entity are not entitled.

Waste: Failure to control costs or regulate payments associated with Federal program monies.

Abuse: Any practice that is inconsistent with sound fiscal, business, or medical practices, and result in unnecessary cost to the health insurance payer, or in reimbursement for services that are not medically necessary, or that fail to meet professionally recognized standards or contractual obligations. There is no intent to deceive or misrepresent.

*Summarized in the Prescription Drug Benefit Manual, Chapter 9 – Part D Program to Control Fraud, Waste and Abuse. Plan providers can access CMS regulations and guidance about fraud, waste, and abuse on the CMS website at www.cms.hhs.gov

http://www.cms.hhs.gov/


Human Capital Domain

Risks related to the organizational workforce; associated with the recruitment, retention, and termination of health plan employees. Risks would include:

• Cultural and environment risks

• Sexual Harassment

• Discrimination

• Safety/Ergonomics



Strategic Domain

Risks associated with brand, reputation, and business strategies. Strategic risks would include:

• Failure to adapt to market changes. (i.e. healthcare environment, changing customer needs, & competition)

• Mergers, acquisitions, and divestitures

• Managed care relationships

• AntitrustAmerican Health Lawyers Association. (2009) Enterprise Risk Management Handbook for Healthcare

Entities, First Addition. Ellen L. Barton


Legal & Regulatory Domain

Analyzes risks arising from licensure, accreditation, statutes, standards, and regulations. These risks include:

• HIPAA

• ARRA

• DRA

• FERA (Fraud Enforcement and Recovery Act)

• False Claims Act

• HITECH

• Healthcare Reform (PPACA, HCERA)

• Fraud, Waste, and Abuse



Technology Domain

Risks associated with the use of medical hardware or software. Examples include:

• Privacy & Security

• Record Retention

• Disaster Recovery



Hazard Domain

Risks related to the physical loss of assets or a reduction in their value. Such as:

• Facility management

• Natural disasters



Risk Assessment & Evaluation

What do you do once organizational risks have been identified?

Understand & attempt to quantify the potential magnitude.

Consider the positive & negative consequences of events underlying those risks across the organization.

Incorporate at least two dimensions of risk “likelihood and severity”

Be aware of the different ranges of results associated with an event.



Tools to Evaluate Risk

• Failure Mode and Effects Analysis (FMEA)

• Vulnerability Analysis

• Quantitative Risk Modeling

• Cost Benefit Analysis

• Risk Scoring

• Risk Maps/Heat Maps


• Evaluating the importance of risk vs. risk

• (Probability + Time to Impact) X Severity =Risk Score

“RISKY BUSINESS”


Risk Appetite / Risk Tolerance

Risk Adverse Low Tolerance

Risk Adverse Low Tolerance

First Dollar Coverage

Dividend & Cash Programs Flow

Programs

Self-insurance Captives



Qualitative Measure of Risk Frequency

LEVEL DESCRIPTOR Example Detail Description

1 Extremely Rare May occur in exceptional circumstances

2 Rare Could occur at some time

3 Periodic Will occur at some time

4 Recurrent Will probably occur in most circumstances

5 Occurs Frequently Is expected to occur in most circumstances



Measure of Time to Impact

LEVEL DESCRIPTOR

1 Warning occurs over a long period of time (months/years) providing an opportunity to adjust or react.

2 Warning occurs over a shorted period of time (days/weeks) providing some opportunity to adjust.

3 No warning – Impact is felt immediately



Measure of Risk Severity

LEVEL DESCRIPTOR DESCRIPTOR FINANCIAL IMPACT

1 Minor Less then $ X

2 Moderate $ X - $X

3 Major $ X - $ X

4 Severe $ X - $ X

5 Catastrophic Over $ X



Summary

RISK CAUSE (RISK FACTOR)

IMPACT INTERNAL CONTROLS

RECOMMENDED ACTIONS

Financial MRA only RevenuesQuality

Clinical documentationevaluation

HRAHEDIS AuditEducation

Financial Inaccurate coding

RevenuesRegulatoryenforcement

Audit Codingcompliance


“Somebody has to do something, its just incredibly pathetic that it has to be us!”

–Jerry Garcia


KEY:

COMPLIANCE PROGRAM


Elements of a Compliance Program

Written Standards of Conduct – policies, procedures and other operating guidelines.

High Level Oversight –Designate a leader responsible for implementing and monitoring the Compliance Program.

Effective Compliance Training –development and implementation of regular and effective training, such as this one.

Monitoring and Auditing –use of risk evaluation and audits to monitor compliance.

Disciplinary Mechanisms – policies to consistently enforce standards.

Effective Lines of Communication – including a system to receive, record and respond to compliance questions or reports of potential non‐compliance.

Procedures for Responding to Detected Offenses – policies to respond and initiate corrective action including a timely and reasonable inquiry.


Compliance Plan Element: High Level Oversight Required

Compliance officer must be an employee of the sponsoring/parent organization, or corporate affiliate.

Compliance officer must be accountable to the governing body of the sponsor organization.

Compliance officer may not be an employee of a first-tier, downstream, or related entity.

• First Tier Entity: A first tier entity is any party that enters into a written arrangement acceptable to CMS with a Sponsor or applicant to provide administrative services

• Downstream Entity: Downstream entity means any party that enters into a written arrangement, acceptable to CMS, below the level of the arrangement between a Sponsor and a first tier entity.

• Related Entity: Any entity that is related to the Sponsor by common ownership or control and:

• Performs some of the Sponsor’s management functions under contract or delegation;

• Furnishes services to Medicare enrollees under an oral or written agreement; or

• Leases real property or sells materials to the Sponsor at a cost of more than $2,500 during a contract period.


Structured Program

• Integrated Team Coordinating Effort Throughout the Plan:

• Compliance

• Risk Adjustment Staff

• Provider Community (Provider Relations)

• Medical Management

• Legal

• Analytics/Informatics

• Quality Improvement


Effective Lines of Communication

• System to:

• Retrieve

• Record

• Respond to compliance questions or reports of potential non-compliance


Compliance Plan Element

Written Standards of Conduct

• Policies

• Procedures

• Other operating guidelines



Policies and Procedures Documenting:• Processes and Communications

• Defined Roles and Responsibilities (Internal/External)

• Training/Communication

• Provider/Provider Staff• Medical Management/Clinical Documentation Requirements• Plan Staff• Adherence to CMS Contract Requirements

• Provider/Vendor Data

• Formal/Informal

• Selection Criteria

• Contract Compliance


Protecting EPHI

Accessing EPHI

• Covered entities must develop and implement policies and procedures for authorizing EPHI access in accordance with the HIPAA Security Rule at §164.308(a)(4) and the HIPAA Privacy Rule at §164.508.


Protecting EPHI

Storing EPHI

• Covered entities must develop and implement policies and procedures to protect EPHI that is stored on remote or portable devices, or on potentially transportable media.


Protecting EPHI

Transmitting EPHI

• Covered entities must develop and implement policies and procedures to secure EPHI that is being transmitted over an electronic communications network.



HERE COMES TROUBLE!



• CMS

• OIG

• FBI

• MFCU

• Office of Consumer Information and Insurance Oversight

• Audits (ie. RADV, RAC)

• State insurance regulators

• Sudden delays in reimbursement


ISSUES/CONCERNS

Marketing Misconduct

Look to state/federal laws

Complaints

Develop a plan for a response

Determine what depts./roles will be involved

Timelines

Records (identification/location)

Establish a process/resource identification

Denials

Appeals

Quality of Care

Medicare Advantage Compliance

Documents

Transcript of Medicare Advantage Compliance