Medical Assistance Provider Self-Audit Protocol
Below is the Department of Human Services' "Pennsylvania Medical Assistance (MA) Provider Self-Audit Protocol." While DHS has always encouraged providers to voluntarily come forward and disclose overpayments or improper payments of MA funds, there existed no formal mechanism or process for such voluntary disclosures. This protocol provides this formal mechanism.
Providers are reminded that this is a voluntary protocol and does not affect the requirements of the Single Audit Act. Further, the protocol suggests that managed care organizations under contract with DHS educate their network providers about the self-audit protocol and encourage the providers to use it.
We believe that this protocol will foster a unique partnership between DHS and MA providers, thereby serving our common interest to protect the financial integrity of the MA Program. As discussed in the "Introduction" section of this document, we believe that providers have an ethical and legal duty to promptly return inappropriate payments that they have received from the MA Program. Nonetheless, in order to encourage proactive efforts to identify and return inappropriate payments, DHS announces, through this protocol, that it will accept reimbursement for inappropriate payments without penalty in the event that such inappropriate payments are disclosed voluntarily and in good faith, and that the acts that led to the inappropriate payments were not the result of fraudulent conduct on the part of the provider, its employees, or agents.
It is hoped that this protocol will create an atmosphere that encourages voluntary compliance and self-disclosure by providers participating in the Pennsylvania Medical Assistance Program.
The Pennsylvania Medical Assistance Provider Self-Audit Protocol
The Department of Human Services (DHS) relies upon the health care industry to assist in the identification and resolution of matters that adversely affect the Medical Assistance (MA) Program, and believes that a cooperative effort in this area will serve our common interest of protecting the financial integrity of the MA Program and ensuring proper payments to providers. DHS encourages MA providers to implement necessary policies, processes, and procedures to ensure compliance with federal and state laws, regulations, and policies relating to the MA Program. As part of these policies and procedures, the DHS recommends that providers conduct periodic audits to identify instances where services reimbursed by the MA Program are not in compliance with Program requirements.
Over the years, DHS has encouraged all provider types to voluntarily come forward and disclose any overpayments or improper payments (herein referred to as inappropriate payments) of MA funds. DHS has had no formal mechanism or process for such self-audits, but rather, has considered and evaluated each disclosure on an individual basis. Upon review of recent disclosures and supporting audits, DHS has become concerned about the lack of uniformity of audits submitted for purposes of self-disclosure.
In light of these concerns, DHS decided to establish a protocol for self-audits by MA providers that participate in both the fee-for-service and managed care environments. While providers have a legal duty to promptly return inappropriate payments that they have received from the MA Program, the use of the protocol is voluntary. The protocol simply provides guidance to providers on the preferred methodology to return inappropriate payments to DHS. This voluntary protocol does not in any way affect the requirements of the Single Audit Act or other independent audit requirements.
In establishing this protocol, DHS recognizes that it must continue to encourage MA providers to conduct self-audits and to provide viable opportunities for disclosure. Toward that end, DHS renews its commitment to promote an environment of openness and cooperation. The flexibility built into this protocol reflects both our desire to encourage voluntary disclosure and our commitment to openness and cooperation.
DHS' Self-Audit Protocol is intended to facilitate the resolution of matters that, in the provider's reasonable assessment, potentially violate state administrative law, regulation, or policy governing the MA Program, or matters exclusively involving overpayments or errors that do not suggest violations of law. It is possible that the Department may, upon review of information submitted by the provider or upon further investigation, determine that the matter implicates state criminal or federal law. In such instances, the Department will refer the matter to the appropriate federal or state agency.
When, either in the course of regular business or by using one of the options specified below, providers believe that they have been inappropriately paid, they should promptly contact the Bureau of Program Integrity (BPI) to expedite the return of the inappropriate payment. Providers benefit from self-audits in several ways. By coming forward and identifying instances of possible noncompliance, the provider, rather than DHS, is conducting the review of his/her records. Further, and perhaps most importantly, when the provider properly identifies an inappropriate payment and reports it to DHS, and the acts underlying such conduct are not fraudulent, DHS will not seek double damages, but will accept repayment without penalty.
While voluntary disclosures were traditionally made by providers operating under the fee-for-service system, this protocol is equally applicable to managed care providers. Inappropriate payments made by managed care organizations (MCOs) to providers within their networks inflate the costs of providing care to MA recipients, and DHS retains its right and responsibility to identify and recover payments or take any other action available under law. While DHS will return to the applicable MCO any payments identified through this protocol, providers must make the self-disclosure directly to DHS. We recommend that MCOs under contract with DHS educate their contracted providers on this protocol, and encourage them to use it. DHS will notify the respective MCO of the repayment and will work together with the MCO to expedite the return of the payment. Again, when a provider properly identifies an inappropriate payment and the acts underlying such conduct are not fraudulent, DHS will not seek double damages but will accept repayment without penalty.
2. Provider Options for Self Audits
Providers have several options for conducting the self-audits and expediting the return of inappropriate payments to the Department:
Option 1: 100 Percent Claim Review — A provider may identify actual inappropriate payments by performing a 100 percent review of claims. This option is recommended in instances where a case-by-case review of claims is administratively feasible and cost-effective.
To the extent that payments can be returned through the claim adjustment process, the provider should follow the claim adjustment instructions in the applicable provider manual. Otherwise, providers should send refund checks made payable to the "Commonwealth of Pennsylvania" to the following address:
Department of Human Services
Office of Administration
Director, Bureau of Program Integrity
P.O. Box 2675
Harrisburg, PA 17105-2675
Providers who wish to submit refund checks by overnight delivery, please have mail directed to the Bureau's building address:
Department of Human Services
Office of Administration
Bureau of Program Integrity
Commonwealth Tower, 4th Floor
303 Walnut Street
Harrisburg, PA 17101
Refund checks should be accompanied by a cover letter that provides an overview of the issues identified, the time period covered by the review, including the reason for the time period selected, and the actions that have been or will be taken to assure that these errors do not reoccur in the future. Note that providers may be asked to work with DHS to ensure that we maintain correct paid claims information. Acceptance of payment by the MA Program does not constitute agreement as to the amount of loss suffered.
Option 2: Provider-Developed Audit Work Plan for BPI Approval — When it is not administratively feasible or cost-effective for the provider to conduct a 100 percent claim review, a provider may identify and project inappropriate payments pursuant to a detailed work plan submitted to DHS for approval. A provider that wishes to use this option should submit his/her proposal in writing to BPI at the above address.
The proposed work plan should also include an overview of the issues identified, the proposed time period of the review, including the reason for the time period selected, and the corrective action is taken to ensure that the errors do not reoccur in the future. BPI will, as it has in the past, review the submission and advise the provider accordingly.
Once the proposed plan has been approved by DHS, the audit should be conducted and inappropriate payment(s) projected. Providers should send refund checks to the address specified in Option 1. Again, acceptance of payment by the MA Program does not constitute agreement as to the amount of loss suffered.
Option 3: DHS Pre-Approved Audit Work Plan with Statistically Valid Random Sample (SVRS) — A provider may identify and project inappropriate payment amounts by conducting a self-audit in accordance with the DHS pre-approved methodology as set forth in Attachment A (below). If a provider chooses this method, the provider need not obtain prior approval of the audit work plan.
- NOTE: DHS recognizes that the methodology set forth in Attachment A (below) does not lend itself to all circumstances or provider types. To the extent that the use of Attachment A is not feasible, a provider should notify DHS of the inappropriate payment and subsequently work with DHS to develop a pre-approved work plan.
Providers should send refund checks to the address specified in Option 1. Refund checks should be accompanied by a cover letter that provides an overview of the issues identified, the time period covered by the review, including the reason for the time period selected, and the actions that have or will be taken to assure that these errors do not reoccur in the future. Acceptance of payment by the MA Program does not constitute agreement as to the amount of loss suffered.
3. Examples of Inappropriate Payments Suitable for Self Audits
Over the years, DHS' Bureau of Program Integrity has identified hundreds of situations involving inappropriate payments to MA providers. Many involve failing to maintain records in accordance with applicable regulations (55 Pa. Code §1101.51), performing or providing inappropriate or unnecessary services, or billing for services that were not rendered. A few of the more specific violations identified include the following:
- A provider (e.g., pharmacy, medical supplier, laboratory, home health agency, EPSDT service provider) bills MA with an incorrect prescriber's license number. This, in effect, misrepresents the prescriber of the service.
- A behavioral health rehabilitation services provider bills for more units of service, e.g. Therapeutic Staff Support (TSS), Behavioral Specialist Consultant (BSC), and/or Mobile Therapist (MT), than were prescribed in the Psychiatric/ Psychological evaluation for the client.
- A behavioral health rehabilitation services provider discovers that an employee providing TSS, BSC, and/or MT services was not qualified to provide the services billed.
- An inpatient hospital provider (provider type 11) includes outpatient services in the inpatient billings, resulting in an incorrect DRG payment.
- A psychiatric inpatient hospital provider (provider type 01) bills and received payment for primary Drug and Alcohol services not payable to a psychiatric hospital or hospital psychiatric unit.
- A hospital outpatient laboratory provider (provider type 01) bills both CPT Codes #87040 (aerobic and anaerobic) and #8076 (anaerobic) when CPT Code #87040 should have been the only code billed because it includes both the aerobic and anaerobic components.
- Two or more physicians (provider type 31) involved in rendering an inpatient service bill different procedure codes for the same service.
- A methadone maintenance provider (provider type 08, specialty 084) bills for services provided prior to the clinic supervisory physician's examination/evaluation and/or treatment plan.
- A hospital outpatient radiology provider (provider type 01) bills individual diagnostic radiology codes separately for hand-wrist procedures when appropriate combination codes were available.
- An inpatient physician provider bills Procedure Code 99233 without meeting at least two of the three required components.
- A pharmacy provider (provider type 24) identifies claim adjustments that have not been made when the recipient(s) have not picked up their prescriptions.
- An inpatient psychiatric and rehabilitation hospital or unit (provider type 01) bills and receives payments for more than two therapeutic leave days per calendar month.
- An inpatient residential treatment facility (provider type 56) bills and receives full per diem reimbursement for days when residents were hospitalized at acute care facilities, private psychiatric hospitals, or psychiatric units (provider type 01). These days should be billed as hospital reserved bed days and paid one-third the facility's per diem rate up to the maximum fifteen days per calendar year.
- A psychiatric partial hospitalization program (provider type 11, specialty 113 and 114) bills for time spent transporting the client to and/or from the partial program or for time spent in activities away from the licensed site.
- A psychiatric outpatient clinic (provider type 08, specialty 110) bills for a medication administration visit when no medication was administered, or bills for services provided away from the licensed site (e.g. services provided in the schools).
- A laboratory provider (provider type 28) bills for drug screens of clients at drug and alcohol clinics (provider type 08). Diagnostic laboratory services used to detect the clinic patient's use of drugs are included in the Drug and Alcohol clinic visit fee.
- A hospice provider (provider type 06) incorrectly billed the Department without the required Certification of Terminal Illness.
- An inpatient hospital provider (provider type 01) incorrectly uses ICD-9-CM V30 codes and receives improper DRG cost outlier payments.
4. Provider Inquiries
DHS recognizes that the application of this protocol to all of the various inappropriate payment situations may raise numerous questions and concerns. DHS is determined, however, to make this process work and will work closely with providers to answer any questions that they may have.
Providers or their representatives that have questions regarding this protocol may contact the Department's Bureau of Program Integrity at (717) 772-4606 to discuss this protocol with the Provider Self-Audit Protocol Coordinator.
**** Attachment A IS TO BE USED BY PROVIDERS WHO SELECT OPTION 3 ONLY ****
Statistically Valid Random Sample (SVRS) Projected Inappropriate Payment(s)
under the Pennsylvania Medical Assistance Provider Self-Audit Protocol
I. Initial Notification to DHS and Request for Universe of Claims to be Reviewed
The provider should include a statement identifying the reason for its decision to perform a self-audit, including at a minimum the following information:
- A description of the events that prompted the provider to decide that a self-audit would be conducted.
- The reasons that separate analyses should be performed for different subsets (strata) of billing codes or for different time periods. For example, based upon a hospital's internal audit review, there could be a concern that bundling/unbundling issues might be relevant for laboratory billings during a two year period while there might be a concern that upcoding may have occurred for emergency room billings during a one year time period. This would suggest two sample strata for review (a two-year analysis for relevant laboratory codes and a one-year analysis for relevant emergency room codes).
- Basic Information:
The disclosure should be sent to:
- The name, address, and Medical Assistance Identification Number(s) (MAID) of the disclosing MA provider. Additionally, provide the name, address, title, and phone number of the disclosing entity's designated representative for purposes of the self-audit.
- A statement of whether the provider has knowledge that the matter is under current inquiry by a government agency or contractor.
- A full description of the nature of the matter being disclosed, including the type of claim, transaction or other conduct giving rise to the matter, and the relevant periods involved.
- The type of health care provider and any provider billing numbers associated with the matter disclosed.
- The reasons why the disclosing provider believes that a violation of state, civil, or administrative law may have occurred.
- A certification by the health care provider, or in the case of an entity, an authorized representative on behalf of the disclosing entity stating that, to the best of the individual's knowledge, the submission contains truthful information and is based on a good faith effort to bring the matter to the state's attention for the purpose of resolving any potential liabilities to the state.
Commonwealth of PA
Department of Human Services
Director, Bureau of Program Integrity
P.O. Box 2675
Harrisburg, PA 17105-2675
II. Information to be Used by Provider
There are two options for providers to obtain data to complete their SVRS.
A. DHS Generated Data
- DHS can, upon request, generate electronic paid claims file(s), which will then be sent to the provider. The paid claims file(s) will be in a format specified by DHS. If the audit involves a network provider for a MCO under contract with the Department, the Department will work with the relevant MCO to obtain the specific claim information. Discussions will be conducted between DHS and providers to determine the format of the paid claims file and the fields of information required for each claim in the file.
- DHS will generate summary data related to the paid claims file(s). For each stratum of paid claims, DHS will report the total number of paid claims and the total amount paid by DHS to the provider. For example, depending on the information requested by the provider, DHS might generate specific paid claims and summary information such as: 10,000 claims totaling $300,000 were paid for procedure codes 80000-89999 for the period 7/1/97 to 6/30/98, and 5,000 claims totaling $500,000 were paid for procedure codes 70000-79999 for the period 7/1/96 to 6/30/99.
- Providers must assign a sequence number to each claim provided by DHS and generate a random number sequence that must be used in sampling the paid claims files. For each stratum of claims under investigation, the provider will generate a sequence of 600 random numbers, which will determine the items to be reviewed as part of each sample. If, in the course of the analysis, it is determined that more than 600 items must be included in a stratum sample, provider must supplement the initial 600 random numbers with additional random numbers.
B. Provider Generated Data
If the provider generates the data, it must meet the SVRS criteria established in II.A. and be compatible with DHS systems.
III. The Review Process to be Used
A. For each sample stratum, an initial "probe" sample will be identified by selecting claims with sequence numbers matching the random numbers generated by the provider. Claims will be added to the probe sample in the order of the random numbers.
- The number of claims to be included in the probe sample will be the greater of:
- 50 claims
- For each claim in the probe sample, beginning with the claim whose sequence number corresponds to the first random number, the provider will determine whether available documentation supports the claim as paid.
- After a review of relevant documentation, a determination will be made as to the amount, which should have been paid for each claim analyzed.
- For each claim, an "overpayment" amount will be calculated. The overpayment amount is equal to either:
If documentation to support the claim cannot be located for a sampled claim, all payments made by DHS for the claim will be treated as overpayments. There can be no substitution of a different claim because documentation of the selected claim is not available.At this point, the results from the probe sample can be reviewed to assess whether it may be appropriate to modify the stratum under analysis. For example, if the original stratum selected for analysis was all billings for CPT codes between 80000-89999 and the analysis of the probe sample showed that all errors were associated with only one of those CPT codes, it might be appropriate to narrow the focus of the review to only that one CPT code.
- The amount actually paid minus the amount that "should have been" paid.
- If it is determined that the stratum should be modified, the provider must document that decision process for inclusion in the self-disclosure report. The provider must then return to outline step II.A.3 (above) and proceed with a new analysis (including a new probe sample) of only the more focused universe of claims now under review.
- If it is determined that the stratum does not need to be modified, the probe sample will be used to determine the number of claims to be included in the full sample for each stratum using the process illustrated in Exhibit 1 (below).
B. Once the number of claims to be reviewed as part of the full sample has been determined, enough claims should be added to the probe sample to yield the necessary full sample size. Claims will continue to be added to the probe sample in the order of the random numbers until the full sample size is obtained.
- Claims should be added to the probe sample based upon the random numbers generated by the provider and the sequence numbers, which were assigned to the paid claims by the provider.
- For each claim in the full sample, the provider will determine whether available documentation supports the claim as paid. Inappropriate payments will be determined for each claim in the full sample by the same method as was used to determine overpayments or inappropriate payments for each claim in the probe sample. The full sample will be used to determine the estimated repayment amount for each stratum using the process illustrated in Exhibit 2 (below).
IV. The Self-Disclosure Report
A. The report must include the identification of the provider and the Provider MA Identification Number that is the subject of the self-disclosure.
B. The report must include the identification of the entity that performed the review and provides the following:
- Identify whether the review was performed by an outside firm or by internal personnel.
- If the review was performed by an outside firm, indicate whether the outside firm performed all aspects of the review. If not, indicate other parties (such as internal personnel) that performed some components of the review (such as determinations of medical necessity).
C. The report must identify the issues which were reviewed on each claim/procedure, and specifically identify whether the following issues were reviewed:
Although providers may submit a claim adjustment during the required time frames for inappropriate payments, the following list of violations is the primary focus of a self-audit process.
- Billing for services not rendered. This includes the obvious and failure to submit a claim adjustment when returning medication to stock or billing for canceled appointments or no shows.
- Billing for misrepresented service in which a provider received inappropriate payments. This violation includes upcoding of procedures, billing brand drugs for generics, services provided by unqualified staff, incorrect dates of service, upcoding inpatient ICD-9-CM diagnosis(es) and procedures and, reporting incorrect discharge status codes for inpatient admissions.
- Billing for duplicate services. This could also include billing two different sources for the same service.
- Billing contrary to DHS payment conditions such as unbundling laboratory and radiology services to receive higher compensation and billing for non-covered services.
- Serious record-keeping violations. This includes falsified records, or no medical or fiscal records available.
- It would be appropriate for the self-disclosure to include a copy of the work program review process to document exactly what was (and therefore what was not) reviewed for each claim.
D. The report must disclose, for each stratum analyzed, the following information:
- The time period under analysis.
- The procedure codes under analysis.
- The total amount of payments received from DHS and the number of claims paid by DHS (this is the summary data report generated by DHS as a result of the providers' initial request for information for the self-disclosure audit).
- The total number of claims included in the probe sample.
- The total number of claims included in the full sample. If the full sample includes probe samples, specifying the number of claims obtained from the probe sample.
- The repayment amount calculated based on the analysis of the full sample (with the associated precision interval at a 90 percent confidence level). An example of this calculation is given in Exhibit 2 (below).
E. For each stratum analyzed, the following information should be included as appendices or additional schedules to the report.
- A list of all claims analyzed as part of the probe sample. For each claim in the probe sample, the information is shown in Exhibit 3 (below) should be provided.
- A schedule detailing the calculations performed to determine the appropriate number of claims to be included in the full sample based on information obtained through analysis of the probe sample.
- A list of all claims analyzed as part of the full sample. For each claim in the full sample, the information is shown in Exhibit 3 (below) should be provided.
- A schedule detailing the calculations performed to determine the appropriate repayment amount and associated precision interval (at a 90 percent confidence level) based on information obtained through analysis of the full sample. An example of this calculation is given in Exhibit 2 (below).
F. The report must be signed and dated and should include a statement that all information included in the report is true and accurate and, the self-disclosure audit was conducted in accordance with the Pennsylvania Medical Assistance Provider Self-Audit Protocol.
Draft Protocol For Self-Audit Reporting - Analysis of Probe Sample
|Claim No||Amount That|
Paid by DHS
Should Have Been
Paid by DHS
Standard Deviation $22.54
Determine the number of claims to be in the full sample based upon the following:
- The standard deviation of overpayments in probe sample is 22.54 (from previous page)
- Assume that the total number of provider's claims at issue which were paid by DHS is: 11,500
- The desired confidence level for estimated overpayment is equal to 90 percent. The factor for a confidence level of 90 percent is 1.645.
- Assume that the total payments by DHS to the provider for the claims at issue are: $500,000
- Desired preclusion interval for estimated overpayment is equal to 5 percent of DHS payments: 5 percent of $500,000 = $25,000
The formula for determining the full sample size is:
Draft Protocol For Self-Audit Reporting
Analysis of Full Sample
Continuing the example from Exhibit 1.
- Since 40 claims had already been analyzed as part of the probe sample and since the full sample size was determined to be 291, an additional 251 claims must be selected (251=291-40). If the full sample size calculated from Exhibit 1 had been less than the number of claims in the "probe" sample, then no additional claims would need to be selected and the "probe" sample could be used as the "full" sample.
- Calculate overpayments for each of the claims in the full sample.
- Determine the average overpayment amount for the claims in the full sample (equals the total of all 291 claims' overpayment amounts divided by 291). Assume, for this example, that the total overpayment amount for all 291 claims was $5,336. Then the average overpayment amount for the claims in the full sample would be $18.34 ($18.34 = 5,336 / 291).
- Determine the estimated amount for repayment to DHS (equals the average overpayment amount from Step 3 above times the total number of claims paid by DHS). For this example, the calculation would be $18.34 (per claim overpayment amount) times 11,500 (number of claims paid by DHS from paid claims file generated by DHS). The example calculation would yield a repayment amount of $210,910.
- Determine the actual precision interval obtained by the full sample. Although the full sample was designed to result in a confidence level of 90 percent and a precision interval of plus or minus 5 percent of the total DHS payments under analysis, the actual results of the full sample might be somewhat different. To determine the actual precision interval obtained at a 90 percent confidence level, perform the following calculations:
- Standard Deviation of Full Sample Overpayments times
- Total Number of Claims Paid By DHS times
- Factor Related to Desired Confidence Level times
- Square Root of Number of Claims in Full Sample
For the example, assume that the standard deviation of the full sample's overpayments was 23, then the calculated precision interval for the $290,910 overpayment at a 90% confidence level would be:
(23) times (11,500) times (1.645) divided by (square root of 291) = 23 x 11,500 x 1.645 / 17.06 =$25,504
This means that statistical analysis indicates that we can be 90 percent certain that the provider's actual overpayment is $210,910 plus or minus $25,504 (or somewhere between $236,414 and $185,406).
Draft Protocol For Self-Audit Reporting
Information To Be Included In Audit Report For Each Claim Reviewed
- The sequence number assigned to the claim as part of the electronic paid claims file generated by DHS for the self-audit process.
- The claim's ICN number (Internal Control Number) or adjusted ICN, if applicable, including the ICN Line Number.
- The Medical Assistance Identification Number (MAID) of the provider who billed and received the inappropriate payment, if other than the provider conducting the self-audit.
- The Date of Service (DOS).
- The procedure code actually billed to DHS for the service.
- The selected diagnosis(es) or Diagnosis Related Group (DRG), if applicable to the self-audit.
- The amount the provider charged/billed DHS for the service.
- The amount actually paid by DHS for the service.
- The procedure code which should have been billed based on the review of the claim performed as part of the self-audit process.
- The amount which should have been paid by DHS based on the review of the claim performed as part of the self-audit process.
- The amount of inappropriate payment associated with the claim for each procedure code identified.
- The specific individual(s) that performed the review of the claim.