Compliance Today - May 2020

Medicare fraud

Research billing compliance is a top priority for institutions that conduct human subject research. Since 2005, there have been several institutions that have been penalized by the government due to improper billing of Medicare for clinical research items and services, such as Rush University Medical Center, fined $1 million;^[1] Tenet USC Norris Cancer Hospital, fined $1.9 million;^[2] and Emory University, fined $1.5 million.^[3] Medicare’s National Coverage Determination (NCD) for Routine Costs in Clinical Trials (310.1),^[4] also known as The Clinical Trial Policy, defines what items and services rendered in a clinical trial can be billed to the federal government. The policy sets forth a three-part process for coverage of clinical research services:

1. Does the study qualify for coverage?

2. What items and services required by the protocol are considered routine costs?

3. Do Medicare rules allow coverage of specific routine costs within a qualifying clinical trial?

All research billing settlements with the government to date have been the result of voluntary self-disclosures after the institution identified overpayments for clinical research services. One of the high-risk areas resulting in overpayments is billing for services already funded by the research sponsor.

Clinical trial billing processes can be complex and require coordination of multiple entities across an institution. Many organizations have implemented clinical trials management systems and enhancements to the electronic medical record and billing systems to properly identify research patients and services so that research charges can be appropriately reviewed before being billed to Medicare and other third-party payers. A coverage analysis is a documented formal review of protocol-required services against Medicare billing rules that most organizations have adopted to ensure research billing compliance. It is critical that policies and procedures are developed to ensure that research patients and services are uniquely identified in the medical record and billing systems to ensure compliance with Medicare’s Clinical Trial Policy.

Federal grants

Research organizations that are awarded federal grants must be prepared for the regulatory oversight that comes with them. With stringent regulations, proper stewardship and accounting of funds is a requirement of federal grants. Furthermore, the fiduciary obligation is just as important as ensuring that research is conducted ethically. Oversight of federal grants requires a strategic design of financial management systems, auditing, and training of personnel to mitigate risk of improper use of funds.

The Office of Management and Budget bases its requirements on the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance). The foundation of these requirements is that costs charged to federal awards are:

• Allowable under both the provisions of federal guidance and the terms of a specific federal award;

• Allocable, meaning the expense can be associated to a project with a high degree of accuracy; and

• Reasonable, with the cost reflecting what a prudent person would pay in a similar circumstance.

Nevertheless, risk areas still exist in cost accounting, time and effort reporting, cost sharing, procurement of goods and services, and travel expenditures. Even with complex financial accounting systems, robust policies and procedures, and good understanding of the regulations, the government issues costly fines and penalties to institutions due to noncompliance. The following are recent examples of penalties paid by federal award recipients:

• Sanford Health Entities, $20.25 million, October 2019^[5]

• Beaver Medical Group, $5 million, August 2019^[6]

• Galichia Medical Group, $5.8 million, May 2019^[7]

• Duke University, $112.5 million, March 2019^[8]

• MedStar Health, $35 million, March 2019^[9]

• Texas A&M Research Foundation, $750,000, September 2018^[10]

• University of North Texas Health Science Center, $13 million, February 2018^[11]

• Telehealth Holdings LLC, $500,000, February 2016^[12]

• University of Florida, $19.875 million, November 2015^[13]

• University of Connecticut, $2.5 million, January, 2006^[14]

• Cornell University’s Weill Medical College, $4.38 million, June 2005^[15]

• Harvard University, $3.3 million, July 2004^[16]

As such, building a strong compliance work plan that includes consistent auditing of grants is essential to ensuring compliance of federal awards.

Financial conflicts of interest

Financial conflicts of interest (FCOI) represent an area of compliance risk in research when provider relationships influence (or appear to influence) their professional judgment, objectivity, and public trust or result in increased risk to participants. It is a common understanding that patient care—the ethical conduct of research—is always the primary motivator for any medical decision or the capture and analysis of data in the context of clinical research. However, many also understand that financial remuneration, ownership/equity interests, intellectual property rights, or even winning additional funding can at times cause undue influence, especially when provider relationships with industry prioritize personal/professional/institutional financial gain or notoriety over scientific epistemology and morality.

To ensure that the conduct of clinical research is objective, has scientific merit, and prioritizes participant safety, federal, state, and local authorities have developed laws, regulations, and policies to mitigate FCOI in research:

• Public Health Services (PHS) regulations at 42 C.F.R. § 50.601–50.607 ^[17] are conflict of interest regulations for each institution that is “applying for, or that receives, PHS research funding [e.g., National Institute of Health (NIH), Centers for Disease Control and Prevention (CDC), Centers for Medicare & Medicaid Services (CMS), or Food and Drug Administration (FDA)] by means of a grant or cooperative agreement and, through the implementation of this subpart by the Institution, to each Investigator who is planning to participate in, or is participating in, such research.”

• The FDA has its own FCOI requirements for “any applicant who submits a marketing application for a human drug, biological product, or device and who submits covered clinical studies.”^[18]

• The Office of Human Research Protections (OHRP) Regulations at 45 C.F.R. § 46.107(d) address conflicts of interest in the review and approval of human subjects research, “No IRB may have a member participate in the IRB's [institutional review board] initial or continuing review of any project in which the member has a conflicting interest, except to provide information requested by the IRB.”

• CMS regulations at 42 C.F.R. §§ 402, 403 (Affordable Care Act) mandate that manufacturers must report any payment or transfer of value to providers of $10 or more and any ownership or investment interest held by a physician or their immediate family member.

Research compliance personnel should audit and monitor clinical research to ensure that it is conducted in accordance with applicable regulations for FCOI.

Research misconduct

The Office of Research Integrity oversees the regulatory requirements for allegations of research misconduct. Research misconduct includes fabrication of results, falsification of data, manipulating research materials, changing or omitting data or results so that the research is not accurately represented, and plagiarism and/or performing research in a manner that is not consistent with standards in the relevant industry. Research integrity is supported using honest and verifiable methods in proposing, performing, and evaluating research; reporting research results with particular attention to adherence to rules, regulations, and guidelines; and following commonly accepted professional codes or norms. Maintaining the highest ethical standards in conducting research and promoting research integrity is critical to any academic research organization. While the federal government dictates policies for research integrity,^[19] the research organizations are responsible for detecting and preventing research misconduct. Research sites must have policies and procedures for addressing these regulations as well as conduct inquiries and investigations into allegations of research fraud.

Human subject protections

The safety and welfare of research participants is at the center of ethical conduct of human subject research. This area represents a compliance risk when the ethical review committee, IRB, or principal investigator (PI) fail to:

• Determine whether the risks to participants outweigh the benefits of the research;

• Ensure that participation in research is voluntary, and that participants are fully informed of what they are getting into; and

• Ensure that the potential for both benefits and risks from the research is equitable.

Throughout the history of the practice of medicine, there have been abuses in the context of research that have resulted in physical and emotional harm, including death, in the pursuit of data. To ensure that these atrocities do not happen again, federal, state, and local laws and regulations—in particular those for OHRP at 45 C.F.R. § 46 ^[20] and the FDA at 21 C.F.R. § 50 — provide instructions on the review, approval, and conduct of clinical research. Research compliance personnel should audit and monitor IRBs and PIs to ensure that it is conducted in accordance with applicable human subjects regulations, and to ensure the safety and welfare of the patients who participate in clinical research.

Good clinical practice

Good clinical practice (GCP) is an international ethical and scientific quality standard for the conduct of human subjects research originally published in 1996 by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH). The Integrated Addendum to ICH E6 (R1): Guideline for Good Clinical Practice E6 (R2) was published in 2016 to reflect the implications that advancements in technology and electronic data capture have had on clinical trials.^[21] GCP guidelines ensure that the rights, safety, and well-being of human subjects are protected, and that the clinical trial data are credible.

The FDA has adopted GCP standards for clinical studies of investigational drugs and devices it regulates. Clinical investigators who conduct studies regulated by the FDA are required to comply with the following US GCP regulations:

• Electronic Records; Electronic Signatures^[22]

• Regulatory Hearing Before the Food and Drug Administration^[23]

• Protection of Human Subjects (Informed Consent)^[24]

• Financial Disclosure by Clinical Investigators^[25]

• Institutional Review Boards^[26]

• Good Laboratory Practice for Nonclinical Laboratory Studies^[27]

• Investigational New Drug Application^[28]

• Applications for FDA Approval to Market a New Drug^[29]

• Bioavailability and Bioequivalence Requirements^[30]

• New Animal Drugs for Investigational Use^[31]

• New Animal Drug Applications^[32]

• Applications for FDA Approval of a Biologic License^[33]

• Investigational Device Exemptions^[34]

• Premarket Approval of Medical Devices^[35]

Clinical investigators and staff engaged in human subjects research must be educated on GCP requirements and maintain proof of training documentation. Although non-FDA regulated clinical studies may not be required by US law to adhere to GCP requirements, it is the industry best practice to apply GCP standards across all human subjects research.

Clinical research financial accounting: Audits and monitoring

Research financial accounting has become increasingly important as the National Institutes of Health and the Office of Management and Budget continue to scrutinize the use of its award and grant funding. Annually, grant recipients are audited whereby a sample of federal awards and the costs charged to those awards are audited to determine if they are, as described earlier, allowable, allocable, and reasonable. Institutions must confirm that expenditures comply with the award contract’s terms and conditions and the Uniform Guidance. The areas where audits are usually focused in research accounting are effort reporting, cost transfers, subrecipient monitoring, direct and indirect cost accounting (which includes research items and services), and financial monitoring. However, even with advancements in technology and robust software solutions to assist with research accounting and monitoring, many institutions are penalized for noncompliance. Audit findings are reported and become public record. These findings affect an institution’s ability to receive subsequent government funding, can damage an institution’s reputation and ranking, and ultimately can lead to hefty financial penalties.

GCP audits

GCP audits test whether the conduct of the research is in accordance with globally recognized standards accepted by FDA and many drug and device manufacturers. By auditing GCP, compliance personnel can gain insight into multiple compliance risk areas for clinical research in one shot. For example, as part of a GCP review, auditors ensure whether consent documents have the required signatures, whether the approved consent document was used, and whether the consent document was signed before research commenced. These items would also be part of a human subjects research audit. GCP audits also involve examining the completeness and accuracy of data collection on the case report forms. This component would also be part of a review for fabrication, falsification, or plagiarism (research misconduct). It would also be a component to test whether the institution completed the research in accordance with the clinical trial agreement (research finance). Although a GCP audit cannot be used to fully substitute an audit of other research risk areas, it is an effective method for identifying whether there are material compliance risks in multiple areas. With the information gleaned from a GCP audit, compliance personnel can better prioritize their research compliance work plans and better allocate auditing and monitoring resources, while at the same time focusing on a significant area of research compliance risk.