Recovery Audit Contractors: A New Breed of Medicare Auditors

With the gradual rollout of Medicare's Recovery Audit Contractor (RAC) program, hospitals, physicians and other health care providers across the United States are being introduced this year to a new breed of auditors, who seek to identify under- and overpayments to providers in return for a portion of the money they recover. RACs will earn a contingency fee of between 9 and 12.5 percent for identifying improper Medicare payments. To nobody's surprise, the vast majority of improper payments will be overpayments recouped from providers.

To mitigate audit-related risk, providers need to examine their processes and make changes now.

RAC Demonstration Offers Insights

Providers should consider the RAC audits an open-book test. Looking at the results of the three-year demonstration of the RAC program, which ended in March 2008, offers insights into the questions they will face.

Medicare's national payment error rate in 2003 was 9.8 percent. Given this relatively high error rate, Congress gave the Centers for Medicare & Medicaid Services (CMS) authority to conduct a three-year demonstration using contractors to detect and correct improper payments in Medicare's fee-for-service program. And to give contractors an incentive to find errors, Congress authorized CMS to pay them on a contingency-fee basis.

Working in just a handful of states from March of 2005 to March 2008, RACs identified more than $1.03 billion in improper payments and earned contingency fees of $187 million. The RACs first reviewed claims in New York, California and Florida. They expanded the audits in 2007 to Massachusetts, South Carolina and Arizona.

Approximately 96 percent of the improper payments identified by auditors were overpayments. Of that amount, approximately 89 percent of overpayments were recovered from hospitals. About half of the roughly 500,000 claims containing improper payments were Part A claims, and half were Part B claims. Nearly $20 million in overpayments was recovered from physicians.

RACs conducted complex reviews on nearly 490,000 medical records during the demonstration, identifying overpayments on approximately 33 percent of all the records they reviewed. The average value of an overpayment varied among contractors, from $4,000 per claim to $12,000 per claim.

As CMS noted in its June 2008 report on the demonstration, because RACs are incentivized by a contingency fee, they start with the highest dollar claims. During the demonstration, RACs established strategies to focus on high-dollar improper payments, such as inpatient hospital claims, which gave them the highest return compared to the expense of reviewing the claim and/or medical record. CMS anticipates that permanent RACs will adopt a similar strategy at first.

Reviews Flag Both Clear and Likely Errors

RACs perform two types of reviews: automated and complex.

Automated reviews, which are conducted through data mining, use proprietary techniques to detect clear errors. During the demonstration, automated reviews identified, for example, entities billing for multiple units of Neulasta, a drug used in conjunction with chemotherapy to boost white blood cell production. Providers used to bill Medicare for one unit for each milligram of Neulasta, but several years ago CMS changed the definition of unit and directed providers to bill one unit for each vial of drug delivered. More than half of all errors associated with physician claims related to excessive/multiple units of Neulasta.

This type of review also found multiple colonoscopies being billed for the same patient in the same day. CMS says it would never be medically necessary to perform two colonoscopies on one patient the same day.

A complex review is undertaken if an error is likely, but a review of the medical record is required in order to identify the problem. The contractor for New York, Connolly Consulting Inc., collected $88 million in overpayments for surgical procedures performed in an inpatient setting—claiming they should have been performed in an outpatient setting.

Permanent Program Will Limit Record Requests

After a year of the demonstration, Congress required CMS to expand the RAC program to all states by January 1, 2010. Contractors were announced in October 2008, and an ensuing bid protest, which temporarily put the national rollout on hold, was resolved in February of this year. RAC contractors have begun conducting outreach sessions with providers, and record requests should be sent in the near future.

Meanwhile, CMS has made some changes to the permanent program to address criticisms of the demonstration. Most significantly, it announced a limit to the number of records RACs could request to perform complex reviews.

For inpatient hospitals, RACs cannot, within a 45-day period, request more than 10 percent of the hospital's average monthly Medicare claims, with the total number requested not to exceed 200. For outpatient hospitals, RACs cannot, within a 45-day period, request more than 1 percent of the average monthly Medicare services, again with the total requests not to exceed 200. The American Hospital Association (AHA) understands that the intent of the record request limit is that no more than 200 records will be requested from a hospital every 45 days, whether the records relate to inpatients or outpatients. What is not clear is whether the 200-record limit will apply to hospitals with multiple national provider identifier (NPI) numbers, since the limits are per NPI. The AHA continues to work with CMS to clarify the limits, particularly for hospitals with multiple NPIs.

RAC Appeals Process Involves Multiple Levels

According to the most recent data from the RAC demonstration, providers appealed roughly 22.5 percent of all RAC-initiated claims of overpayment and were successful on 34 percent of all appeals. This relatively high number shows that, at least in the demonstration, it paid to closely scrutinize RAC-initiated overpayments and adopt a vigorous appeals strategy.

In the permanent program, providers can avoid recoupment by filing timely appeals to the first and second level. RACs will be required to refund any contingency fees related to a recoupment that is overturned at any level of appeal.

The American Hospital Association is encouraging providers to closely track appeal information and associated costs so it can report the impact of the RAC program on providers. Clearly, it is in a provider's best interest to carefully manage and track appeals, particularly at the outset, since RACs will be targeting the highest dollar claims first.

The structure of the appeals process is similar to the normal appeals process for denied Medicare claims, although CMS has added a "discussion period" to the normal levels of appeal.

Rebuttal and Discussion Periods

Providers have 15 days from the date of a notification letter to submit matters in rebuttal to the RAC. This process is no different from the one found in
Chapter 3 of the Medicare Program Integrity Manual. Its intent is to identify errors in the calculation of an overpayment, not to address substantive errors with the determination.

In addition to the rebuttal process, CMS has made reference to a "discussion period" ending on the recoupment date (41 days after the date of a notification letter) during which providers can discuss the results of a medical review with the RAC. Having a discussion with an RAC regarding a particular case does not extend the timeline for filing the first-level appeal.

First Level of Appeal

The first level of appeal is to the Medicare contractor (fiscal intermediary, carrier, Medicare Administrative Contractor) that processed the initial claim. It is considered a request for redetermination.

A provider has 120 days to file a first-level appeal. However, unless an appeal is filed within 30 days, the money will be recouped by Medicare. In addition, interest will be charged if an appeal is filed within 30 days (thus avoiding recovery of the overpayment) but is eventually unsuccessful. This rule suggests that a provider shouldn't adopt a practice of appealing all RAC overpayments without some analysis of the merits.

Second Level of Appeal

The second level of appeal is to a qualified independent contractor. It is considered a request for reconsideration. Providers have 180 days from resolution of the first-level appeal, but again, recoupment can be avoided if the appeal is filed within 60 days.

Most significantly, this level of appeal is the provider's last opportunity to submit documents that will eventually be part of the record should it be necessary to appeal to an administrative law judge or beyond. Therefore, providers would be well advised to have an attorney review the documents submitted to the qualified independent contractor, if an attorney has not already been involved. If a provider is unsuccessful at this level, CMS will recoup the identified overpayment with interest.

Third Level of Appeal

The third level of appeal is to the Office of Medicare Hearings and Appeals, where the case will be reviewed by an administrative law judge. Hearings are usually conducted by phone or video teleconference. Providers have 60 days to appeal to this level following receipt of the reconsideration decision. During the RAC demonstration, approximately 5,000 claims were appealed to this level.

Fourth Level of Appeal

The fourth level of appeal is to the Medicare Appeals Council, otherwise referred to as the Departmental Appeals Board, or DAB. Providers have 60 days from the third-level decision to appeal to this level. During the RAC demonstration, approximately 200 claims were appealed to this level.

Fifth Level of Appeal

The final level of appeal is to a federal district court. Providers have 60 days from the date of the Medicare Appeals Council decision to appeal to this level. The amount in controversy must be at least $1,220.

Audit Preparation Must Be Joint Effort

Within hospitals and other health care entities, personnel and management in a number of areas will need to work together in preparation for RAC record requests.

Compliance staff will need to study issues that were identified in the RAC demonstration and implement prevention strategies. For example, medically unnecessary hospital admissions were an area of significant recoveries by RACs. In the past, however, this issue has not been an area of major focus of Medicare audits. Compliance officers need to make sure their hospitals have adequate processes in place to review and document the medical necessity of inpatient admissions.

In addition to understanding the issues identified in the RAC demonstration, compliance officers need to continuously review new issues identified on an RAC's Web site, showing exactly what types of claims they will be reviewing. Compliance officers need to ensure that their organization is compliant with any new issues posted by an RAC.

Finance officers will need to determine whether or not to set a reserve for future recoveries by RACs. If finance officers know the average value of an inpatient, outpatient and physician claim, they can take into account the number of medical records that can be requested—and the fact that RACs found overpayments in 33 percent of all records requested. While this method is one way to estimate the future impact of RAC audits, it does not take into account automated reviews. In any event, any actual recovery by an RAC is likely too speculative at this point to justify a reserve. Perhaps by the end of 2009 the picture will be clearer, and a reserve would be prudent.

Health information management departments need to be prepared to respond in a timely manner to medical record requests from RACs. Each request should be reviewed for completeness before it is produced. All communication with the RAC, as well as documents produced, should be scanned and preserved so they can be quickly reviewed if a denial of payment is received. Tracking and preserving RAC-related records may require special software.

Revenue cycle management departments, which routinely receive and respond to denials from all third-party payers, may be the central clearinghouses for RAC denials. What is unique about RAC denials is that they will likely involve medical judgment, and the value of a claim denied by a Recovery Audit Contractor will be much higher than the average claim denied by Medicare. Is your revenue cycle management department able to request a redetermination from the fiscal intermediary, carrier or Medicare Administrative Contractor? Who will review certain types of denials? Will outside experts be necessary? Should your revenue cycle management department obtain legal review on at least second-level appeals and beyond?

Conclusion

Although some providers are tired of hearing about RACs, for health care providers in much of the United States they are really here. And it's time to prepare.

If there is a bright side to these audits, it is that their focus and process are no mystery. The three-year demonstration highlights areas where providers would do best to identify and mitigate RAC-related risk before they receive record requests.

To ensure that their businesses do well now that test time is here, providers need to be ready to submit records, review denials and submit appeals in a timely manner. Collaboration among a number of departments will be necessary. If internal resources are not sufficient for some of the required tasks, health care providers may wish to consider adding or developing personnel or engaging outside assistance.