This document discusses corporate compliance programs and fraud and abuse laws. It defines compliance, fraud, and abuse, and describes major federal fraud statutes like the False Claims Act. It outlines penalties for fraud like civil monetary penalties and lists high-risk areas for fraud. It discusses the roles of agencies that combat fraud like the Office of Inspector General. It also describes key elements of effective corporate compliance programs.

1. © 2017 American Health Information Management Association© 2017 American Health Information Management Association
Chapter 18:
Corporate Compliance
Fundamentals of Law for Health
Informatics and Information
Management, Third Edition

2. © 2017 American Health Information Management Association
Compliance
• Refers to adherence to federal statutes
and regulations designed to
– Prevent unjust financial enrichment
– Patient privacy breaches by healthcare
providers or organizations

3. © 2017 American Health Information Management Association
Fraud and Abuse
• Fraud
– A false representation of fact
– A failure to disclose a fact that is material
(relevant) to a healthcare transaction
– Damage to another party that reasonably
relies on the misrepresentation or failure to
disclose

4. © 2017 American Health Information Management Association
Fraud and Abuse (continued)
• Abuse
– Inconsistent handling of sound fiscal,
business, or medical practices resulting in
• Unnecessary costs to the program
• Improper payment
• Services that fail to meet professionally recognized
standards of care or are medically unnecessary
• Services that directly or indirectly result in adverse
patient outcomes or delays in appropriate
diagnosis or treatment

5. © 2017 American Health Information Management Association
Most Common Types of Fraud
• Billing for services that were never rendered
• Billing for more expensive services or procedures than were
actually provided—upcoding
• Performing medically unnecessary services
• Misrepresenting noncovered treatments as medically
necessary
• Falsifying a patient’s diagnosis to justify tests or procedures
• Unbundling
• Billing patients more than the copay amount for services
• Accepting kickbacks for patient referrals
• Waiving patient copays or deductibles and overbilling the
health plan (NHCAA)

6. © 2017 American Health Information Management Association
To Combat Fraud and Abuse
• Revenue cycle management
– Supervision of all administrative and clinical functions
that contribute to the capture, management, and
collection of patient service revenues
• Role of documentation
– Documentation must support the billing
– Claims, requests for reimbursement, and supporting
documentation must be complete and accurate
– Reflect reasonable and necessary services ordered
by an appropriately licensed medical professional

7. © 2017 American Health Information Management Association
Key Federal Fraud Statutes
• False Claims Act (FCA) (31 USC 3729)
– Primary litigation tool for combating fraud,
contains both criminal and civil provisions
– Qui tam (whistleblower)
• Private persons known as relators may enforce the
FCA by filing a complaint, under seal, alleging fraud
committed against government.
• Provides protection to qui tam relators who are
discharged, demoted, suspended, threatened,
harassed, or in any other way discriminated against

8. © 2017 American Health Information Management Association
False Claims Act (FCA) (31
USC 3729)
• What constitutes a false claim?
– Must establish that the claim was false or
fraudulent
– Furnishing inaccurate or misleading
information
– FCA has been extended to cover quality of
care cases

9. © 2017 American Health Information Management Association
False Claims Act (FCA) (31
USC 3729)
– The Knowing Standard
– Provider must have knowingly submitted the
false claim
– FCA defines “knowing” and “knowingly” to
mean that a person:
– Has actual knowledge of falsity of information
– Acts in deliberate ignorance of truth or falsity of
information
– Acts in reckless disregard of truth or falsity of information

10. © 2017 American Health Information Management Association
Key Federal Fraud Statutes
• Fraud Enforcement and Recovery Act of
2009: Revisions to FCA
– Expanded potential for liability under FCA and
also expanded government’s investigative powers
– FCA penalties apply to “any person who
knowingly presents, or causes to be presented, a
false or fraudulent claim for payment or approval,”
regardless of to whom the claim was made
– Definition of a “claim” expanded to broaden the
types of payments that fall within the scope of
FCA

11. © 2017 American Health Information Management Association
Fraud Enforcement and
Recovery Act of 2009:
Revisions to FCA
• Established that FCA penalties apply to “any
person who knowingly makes, uses, or causes to
be made or used, a false record or statement
material to a false or fraudulent claim”
• Expanded antiretaliation protections for
whistleblowers
• Expanded US attorney general’s authority to issue
civil investigative demands
• Broadened the federal government’s authority to
share documents obtained through subpoena with
qui tam relators and other parties

12. © 2017 American Health Information Management Association
Patient Protection and
Affordable Care Act: Revisions
to the FCA
• Known as the health reform bill
• Further amends the FCA by allowing private
individuals more successful in filing false
claims lawsuits
• Broadened the definition of “original source”
to allow public disclosure defense to be
overcome if individual bringing suit
possesses knowledge that adds to publicly
disclosed information
• Clarified retention of overpayments

13. © 2017 American Health Information Management Association
Federal Anti-Kickback Statute
(42 USC 1320a-7b)
• Establishes criminal penalties for individuals and
entities that knowingly and willfully offer, pay, solicit, or
receive remuneration in order to induce business for
which payment may be made under any federal
healthcare program
• Remuneration: Defined broadly to include the transfer
of anything of value, directly or indirectly, overtly or
covertly, in cash or in kind
• Violation constitutes a felony punishable by a fine of
up to $25,000, imprisonment for up to five years, or
both
• Clearly prohibits payments for patient referrals

14. © 2017 American Health Information Management Association
Federal Anti-Kickback Statute
(42 USC 1320a-7b) (continued)
• Statutory exceptions created to protect
legitimate business arrangements
– Discounts that are properly disclosed and
reflected in the costs claimed
– Payments by an employer to an employee for
provision of covered items and services
– Certain risk-sharing arrangements
– Waivers of coinsurance amounts in connection
with certain federally qualified healthcare centers

15. © 2017 American Health Information Management Association
Federal Anti-Kickback Statute
(42 USC 1320a-7b) (continued)
• Safe harbors: Activities that are not subject to
prosecution and protect the organization from
civil or criminal penalties
– Investments in certain large or small entities
– Investments in entities in underserved areas
– Space and equipment rental
• Common theme: To protect certain
arrangements in which commercially
reasonable items or services are exchanged
for fair market value compensation

16. © 2017 American Health Information Management Association
Safe Harbor for EHRs
• Are intended to protect beneficial
arrangements that would eliminate perceived
barriers to the adoption of EHRs without
creating undue risk that the arrangements
might be used to induce or reward the
generation of Federal healthcare program
business (HHS OIG 2006, 2013a).
• Figure 18.1 lists the safe harbors for EHRs

17. © 2017 American Health Information Management Association
Civil Monetary Penalties (CMP)
• Provides administrative remedies
• Authorizes secretary and inspector general of
HHS to impose CMPs, assessment, and
program exclusions on individuals and
entities whose wrongdoing caused injury to
HHS programs or their beneficiaries
• Up to $50,000 per violation and treble
damages

18. © 2017 American Health Information Management Association
Federal Physician Self-Referral
Statute (the Stark Law)
• Prohibits physicians from ordering designated health services
for Medicare (and to some extent Medicaid) patients from
entities with which the physician, or an immediate family
member has a financial relationship
• Exclusions
– Services that are reimbursed by Medicare as part of a composite
rate
– Certain referral relationships are permitted, such as a request by
a pathologist for clinical diagnostic laboratory tests.
– Physician services exception
– In-office ancillary services
– Financial arrangements between academic institutions and their
affiliated hospitals and physicians

19. © 2017 American Health Information Management Association
Sherman Antitrust Act
• Illegal to restrain trade through contracts or
conspiracies, and they prohibit price fixing
and mergers that lessen competition
• Federal Trade Commission (FTC) and the
Department of Justice enforce these laws
• Healthcare mergers and joint ventures and
credentialing and peer review processes
must be carefully handled to avoid anti-trust
issues

20. © 2017 American Health Information Management Association
HIPAA—Expanded OIG
• Sanction authorities
• Application of CMP provisions beyond those
funded by HHS to include all federal
healthcare programs (e.g., Tricare, Veterans
Affairs, and Public Health Service)
• Strengthened the OIG’s CMP penalties for
violations under Medicare and state
healthcare programs

21. © 2017 American Health Information Management Association
Deficit Reduction Act of 2005
• Transitioned compliance programs from voluntary to
mandatory
• Contains employee education about FCR provision
• Written policy must provide
– Detailed information about the FCA
– Administrative remedies for false claims and statements
– Any state laws pertaining to civil or criminal penalties for
false claims and statements
– Whistleblower protections
• Detailed provisions regarding the entity’s policies and
procedures for detecting and preventing fraud, waste,
and abuse

22. © 2017 American Health Information Management Association
Patient Protection and
Affordable Care Act (ACA)
• Expanded funding of enforcement efforts
• Expansion of RACs to Medicare Part C &
D and Medicaid
• Added penalties
• Requiring Medicare and Medicaid
overpayments to be returned in 60 days

23. © 2017 American Health Information Management Association
OIG List of Excluded Individuals
and Entities
• Medicare fraud
• Patient abuse or neglect
• Felony convictions related to fraud, theft,
embezzlement, breach of fiduciary responsibility,
or other financial misconduct in connection with
the delivery of a healthcare item or service
• Felony convictions for unlawful manufacture,
distribution, prescription, or dispensing of
controlled substances
• OIG has the discretion to impose exclusions for
other reasons

24. © 2017 American Health Information Management Association
High-Risk Areas for Potential
Fraud and Abuse
• Billing for noncovered
services
• Altered claim forms
• Duplicate billing
• Misrepresentation of
facts on claim form
• Failing to return
overpayments
• Unbundling
• Billing for medically
unnecessary services
• Overcoding or
upcoding
• Billing for items or
services not rendered
• False cost reports

25. © 2017 American Health Information Management Association
Healthcare Fraud and Abuse
Control (HCFAC) program
• Goal to coordinate state, federal, and local
fraud and abuse activities
• Healthcare Fraud Prevention Partnership
(HFPP) goal is to be proactive in
identifying fraud
• Healthcare Fraud Prevention and
Enforcement Action Team (HEAT)

26. © 2017 American Health Information Management Association
CMS—Center for Program
Integrity
• Fraud Prevention System (FPS)
• Comprehensive Error Rate Testing (CERT)
Program
• MACs
• Program Integrity Contractors

27. © 2017 American Health Information Management Association
Role of Department of Justice
(DOJ)
• Root out fraud and safeguard taxpayers
from illegal conduct
• Works in collaboration with a number of
other federal agencies to investigate and
prosecute fraudulent activities

28. © 2017 American Health Information Management Association
Role of the Office of the
Inspector General (OIG)
• OIG office: Responsibility to report
program and management problems to
both the HHS Secretary and Congress,
along with recommendations to correct
them.
– Annual OIG Work Plan outlines new and
ongoing review activities
– Fraud alerts and advisory opinions

29. © 2017 American Health Information Management Association
Corporate Compliance
Programs
• Evolved from 1991 US Sentencing Commission’s
Federal Sentencing Guidelines
– Fines and penalties reduced to organizations found guilty
of fraud if organization has a fraud prevention and
detection program in place
– Helps organizations identify problems and improve
performance and avoid a corporate integrity agreement
(program imposed by government with oversight and
outside expert involvement)
– Program requires a compliance officer: Responsible for
overseeing processes that promote an organization’s
ethical business practices and its conformity to federal,
state, and private payer program requirements

30. © 2017 American Health Information Management Association
Corporate Compliance
Programs
• Hospitals
• Clinical laboratories
• Home health agencies
• Third-party medical milling
companies
• Durable medical equipment
providers
• Hospices
• Medicare+Choice
organizations
• Nursing facilities
• Ambulance suppliers
• Individual and small group
physician practices
• Pharmaceutical
manufacturers
• Recipients of US Public
Health Service (PHS)
research awards
• Part D plan sponsors
(included in the Medicare
Prescription Drug,
Improvement and
Modernization Act of 2003)
Who should have compliance programs place?

31. © 2017 American Health Information Management Association
Guidelines offer Seven Steps
for an Effective Compliance
Program
• Establish compliance standards and procedures that are
reasonably capable of reducing criminal conduct
• Assign responsibility to oversee compliance with the
standards and procedures to specific individual(s)
• Use due care to avoid delegation of substantial discretionary
authority to an individual
• Communicate the standards and procedures to all
• Achieve compliance with the standards through monitoring
and auditing
• Enforce standards through appropriate disciplinary
mechanisms
• Respond appropriately to any offense detected to prevent
similar offenses in the future

32. © 2017 American Health Information Management Association
Elements of a Corporate
Compliance Program
• Compliance programs should be tailored
specifically to individual organization but
should at least include elements that address
– Corporate code of conduct
– Policies and procedures (practice standards)
– Education and training
– Auditing and monitoring
– Offense detection and corrective action initiatives
– Enforcing disciplinary standards through well-
publicized guidelines