As the government turns up the heat on Medicare Advantage (MA) plans, they’re expected to do the same to providers—with lawsuits, audits and new contract terms, experts say.
Some of the dollars MA plans may lose in False Claims Act (FCA) settlements and/or risk adjustment data validation (RADV) audits will be recovered, one way or another, from providers because they’re the ones who diagnose patients and code and document their conditions—all of which drives CMS payments to MA plans, said attorney Barak Bassman, with Blank Rome in Philadelphia. Providers are required to sign standard contract language promising they will submit true, accurate and complete risk assessment data, making them vulnerable to recoupment if it’s not perfect, he noted.
“It’s the quake that may be coming,” Bassman said.
Providers should brace for Targeted Probe and Educate, MA style, said attorney Stephen Bittinger, with K&L Gates in Charleston, South Carolina. “Plans will go back to the provider, who is the originator.”
CMS is nudging MA plans in this direction, said Amy Bailey, a principal with HBE Advisors LLC in Idaho. When CMS finalized the MA RADV audit rule in the Feb. 1 Federal Register, “it said the biggest goal of this rule was to incentivize managed care organizations to take meaningful steps to reduce improper risk adjustment payments in the future,” she said.[1] “What they mean by that is we have known a lot of these improper payments are occurring because managed care organizations accept ICD-10 codes providers have submitted and they report them to CMS without doing validation or auditing and monitoring and improper payments flow back through. CMS wants that to stop. They want MA plans to actively and aggressively audit their providers to make certain the ICD-10 codes reported up to CMS are accurate.”
The rule gives CMS the authority to extrapolate overpayments to MA plans going back to 2018 and recover actual overpayments back to 2011.
“Medicare wants to incentivize these MA plans to start coming after the providers, which they feel are the root of the issue,” Bailey said at an Oct. 24 webinar sponsored by the HCCA.
CMS pays MA plans under a risk-adjustment system, which relies on them to get ICD-10 diagnosis codes from providers. Certain ICD-10 codes are considered hierarchical condition categories (HCCs) conditions and may yield higher risk adjustment payments, she said. MA plans are generally paid more for beneficiaries with more severe diagnoses, and providers are paid more for more complex encounters.
Risk adjustment is at the heart of OIG audits of MA plans and U.S. Department of Justice (DOJ) enforcement actions, which have already led to multiple high-dollar FCA settlements. The latest: Cigna Group and its MA organizations agreed to pay $172 million to settle false claims allegations they submitted false and invalid patient diagnosis codes to inflate payments.[2] The HHS Office of Inspector General (OIG) has identified certain HCCs as high risk for reporting errors, including embolism, acute stroke, major depressive disorder and vascular claudication.
“If the health plan is audited by the government and it comes from information received from the providers, they will certainly file claims against the providers,” said attorney Daron Tooch, with King & Spalding in Los Angeles.
It May Be a Difficult Strategy
But it may be a difficult strategy, said attorney Max Voldman, with Constantine Cannon in Washington, D.C. With exceptions, MA plan contracts with providers fall into three categories: fee-for-service (FFS), capitated and owned by the MA plan or its parent and capitated and outside of the MA plan’s corporate family, he said. The contracts between providers and MA plans probably condition payment on accurate diagnostic data in the FFS world, “but the provider would have arguments about that being a material term,” Voldman explained. In the scenario where a capitated provider is in the corporate family of the plan, an MA plan’s lawsuit against the provider seems like “it would be a waste of resources.” But it would make sense “in scenarios where capitated providers are outside of the plan’s corporate family—and I bet some capitation agreements even have a provision that would adjust reimbursement retroactively in the case of CMS taking money back in a RADV.”
The problem is, it’s unclear how “the line of liability will run,” Bittinger noted. A patient would see both a primary care physician and specialists for a high-risk diagnosis. “How do they quantify and divide this among multiple providers with direct-line financial responsibility for a capitated payment structure? I think they will ask for money back on incentive plans rather than attribute direct liability,” he said. “The carrot will go away and turn into a stick because MA plans will get crunched financially.” The stick could take the form of auditing for accuracy and completeness; threatening termination of a network contractor; and moving lives away from big medical groups or health systems that don’t comply with their new standards. “In the next five years, we will see a lot of mandatory compliance tests added to MA network contracts,” Bittinger predicted.
Bassman sees the potential for a “perverse situation.” He said, “The more the payer does to ensure accuracy through audits and chart reviews, the less recourse they have against providers. The less they do, the bigger risk they run with CMS.” He also noted that “diagnosis coding is not some sort of objective true north lodestar. It’s incredibly variable. You have human error and different providers acting in good faith code the same patient differently.”
Other Twists and Turns
Other pieces are moving on the chessboard. RADV audits will set in motion an MA version of the sppeal backlog and outcry that happened on the FFS side of the house with the Office of Medicare Hearings and Appeals, Bittinger said. “RADV audits will throw big ugly numbers at these plans, they’ll all appeal, and it will get backlogged,” he said. The hearing officers will explain they don’t have enough people or money to move faster and the MA plans will sue in federal court because they’re being denied due process and eventually they will get more money to expedite the administrative appeals process. In the meantime, CMS will recoup these funds and pass along the costs to providers—“by auditing and driving down reimbursement rates,” Bittinger said.
He also expects litigation on where the buck stops in terms of adequate documentation of risk adjustment in the contractual relationship. “There are certain duties a provider has for adequate documentation and then the MA plan takes over and does their calculation, so we will have litigation about the sufficiency of performance,” Bittinger said. “Where it will get really messy is with provider-owned plans and plans that own providers.” For example, Optum is now the largest owner of physician practices and is itself a subsidiary of UnitedHealth Group, he noted.
Meanwhile, Humana on Sept. 1 sued CMS under the Administrative Procedure Act, arguing the RADV rule violated notice and comment rulemaking, Bittinger said.[3] Humana is primarily arguing that CMS’s new audit methodology for MA plans is an improper application of the law.
An even more consequential fight may be looming, Bittinger said. The RADV rule allows MA plans to appeal audit findings to hearing officers and the CMS administrator, not federal courts. He thinks that’s ripe for a challenge because of an April 14, 2023, decision from the U.S. Supreme Court in Axon Enterprise, Inc. v. Federal Trade Commission et al.[4] In a case about two companies challenging administrative law judge reviews at the Federal Trade Commission and Securities and Exchange Commission, the Supremes ruled that “The question presented is whether the district courts have jurisdiction to hear those suits—and so to resolve the parties’ constitutional challenges to the Commissions’ structure. The answer is yes. The ordinary statutory review scheme does not preclude a district court from entertaining these extraordinary claims.”
Understanding the ICD-10, HCC Risks
Tying together the MA plans and the providers are CMS and OIG, which have identified risk adjustment as a “compliance risk and fraud focus,” Bailey said. She cited two themes running through the audits and FCA cases: inadequate oversight of providers by MA plans and provider reporting of ICD-10 codes that weren’t supported by the MEAT criteria.
To ensure they’ve addressed HCCs, providers must document they’ve done one or more of the following (this is known as MEAT because it’s an acronym):
-
Monitoring the condition.
-
Evaluation of the condition.
-
Assessment of the condition.
-
Treatment the condition.
“If you don’t meet one of those, you may not report a diagnosis code categorized as an HCC,” Bailey said.
Calling risk adjustment “arguably the highest risk area out there right now in terms of compliance,” Bailey said providers should be thinking about “where the points of failure may be and how we might reduce that on a go-forward basis.” Here are some of them:
A patient’s medical conditions are typically included in an active problem list. Many electronic health record (EHR) systems read active problem lists and flag conditions tied to HCC categories, she said. In many organizations, providers may be prompted by the EHR or the staff to address HCC conditions at every encounter and claims may be submitted to the payer without coder review. The problem lists are often inaccurate and the clinical staff may not do a great job reviewing or updating them in detail. They often contain conditions the patient no longer has and that should be classified as past medical history or removed, Bailey said. “We are hearing on an increasingly frequent basis” that providers are pushed to pull in conditions from the problem list to their assessment even if the provider is not managing the conditions. Suppose a patient visits the physician for a sore throat and runny nose. Although the patient also has congestive heart failure, that’s not what he’s there for. “What we’re hearing is the primary care physician is being pressured to pull congestive heart failure into their assessment even though they’re not managing the patient for congestive heart failure because cardiology is,” Bailey said. If the physician is pressed to make it look like they’re managing, treating or assessing the condition to allow capture of the HCC, “that’s a problem.”
Bailey added that it amplifies the risk to rely on physicians to assign their own ICD-10 codes when they’re not coders and there are 70,000 possible codes and code combinations. “Even if you have certified coders, they may not have HCC expertise and while a lot of basic guidelines for ICD-10 assignment apply to HCCs, they have their own unique set of nuances and rules that the coder needs to be attuned to,” she said. Even with certified coders, encounter volumes—especially in clinic settings—may exceed coding resources, and coders are unable to review all codes assigned at encounters before they’re sent to payers.
There also are competing priorities and risks inside organizations. For example, if you’re asking physicians to pull HCCs into their assessments and address conditions they aren’t managing, you’re creating quality of care and malpractice concerns for them, she said. “We have to balance that with the risk of underreporting our HCCs and not capturing all the work the providers are doing and then trying to make sure we are also limiting our risk and exposure to overpayments.”
Here are some of Bailey’s auditing tips:
-
Do routine audits of risk adjustment. “We have to be looking at documentation and coding specific for our MA beneficiary encounters,” she said.
-
Conduct documentation and coding reviews of beneficiary encounters with at least one reportable HCC.
-
Consider larger, more focused audits of conditions identified as high risk by OIG (e.g., acute strokes, acute heart attacks, major depressive disorders).
-
Review whether ICD-10 codes were assigned to the highest level of specificity and whether MEAT criteria support the ICD-10 (HCC) reported.
-
Determine whether all conditions were managed/treated during the encounter captured.
-
Decide how to define an error and how to communicate results to providers.
Contact Bittinger at stephen.bittinger@klgates.com, Bassman at barak.bassman@blankrome.com, Voldman at mvoldman@constantinecannon.com, Tooch at dtooch@kslaw.com and Bailey at abailey@hbeadvisors.com.