BP - Health Care Compliance Association

any governmental guidelines for fraud and
abuse programs, but, as shown, there may
be a perception gap regarding reasonableness
that will hopefully be bridged as both
government agencies and plan sponsors
become more experienced in this area. For
example, taken literally, certain aspects of
CMS’ Part D fraud and abuse guidance are
virtually impossible to administer. CMS does
not (and cannot as a practical matter) specify
how and to what extent, for instance, plan
sponsors should “monitor” and “investigate”
downstream entities, such as drug wholesalers
or PBMs. Typically, a plan sponsor will not
have practical or legal access to the books,
records, or data of such downstream entities
nor will it have the expertise to review such
records and data even if it were to have access.
A plan sponsor will typically have little ability
to determine whether a downstream entity
is properly calculating true out-of-pocket
costs for drugs or whether a pharmaceutical
manufacturer’s relationship with a physician
may violate federal law.
Likewise, CMS does not explain how a plan
sponsor might, for example, go about reviewing
or investigating transactions between
pharmaceutical manufacturers and physicians
for purposes of identifying “inappropriate
transactions” or “illegal remuneration
schemes.” Plan sponsors typically do not have
access to information that would allow them
to even begin to identify such transactions or
schemes. Thus, it does not seem reasonable
for CMS to expect significant “monitoring”
or “investigating” of any entities other than
the “first tier” entities with which the plan has
direct day-to-day interaction (e.g., network
pharmacies and physicians). CMS’ expectations
and guidance will likely moderate over
time.
Indeed, HHS-OIG’s audit work tends to
prove that plan sponsors are generally unable
to investigate once-or-more-removed entities
with any vigor. In another October 2008
audit, HHS-OIG reviewed the fraud and
abuse reporting data from 86 plan sponsors
to determine what types of fraud and abuse
the plans were identifying and what they were
doing in response. 25 Although the general
results of this audit are not terribly interesting
— some plans identify and report more
fraud and abuse incidents than others — the
results of the type-of-fraud survey show that
most identified incidents result from “direct”
interaction with the plan sponsor (e.g.,
improper billing being the most prevalent
type of fraud and abuse identified). In
contrast, and unsurprisingly, the plan sponsors
identified very few “downstream” types
of fraud and abuse by entities not in direct
contractual privity with the plan sponsors
such as illegal renumeration, bribes, inappropriate
formulary decisions, manipulation
of “true out-of-pocket costs,” or inappropriate
manufacturer sales techniques.
The most reasonable approach for all fraud
and abuse compliance would seem to be that
exemplified in the Medicaid HMO contractual
language set forth above. It is reasonable
to ask government-contracted plans to monitor,
investigate, and resolve fraud and abuse
issues with their direct networks of providers,
members, or others (e.g., PBM’s) for which
the plan has reasonable access to claims data,
medical records, and similar information. It
is also reasonable to expect that plans analyze
and monitor their claims data for aberrations
or patterns indicative of fraud and abuse.
Indeed, at least based on anecdotal information,
Part D plans seem to be structuring
their fraud and abuse compliance plans
assuming that they are responsible for reasonable
outward-looking fraud and abuse efforts
focused on entities with which the plan has a
direct relationship.
Elements of a reasonable program
CMS and Medicaid programs will continue
to require specific, unique fraud and abuse
program components, but a reasonable
outward- or downstream-looking fraud and
abuse investigation program generally will
include the following, scalable elements:
n Monitoring. A “fraud hotline” for members
and providers to report fraud or abuse
by providers and other downstream entities
will be of obvious utility. Depending
on the size of the plan, a dedicated
Medicare or Medicaid fraud hotline might
be warranted. The hit and miss nature of
relying on ad hoc “tips” or “leads” from a
fraud hotline will not be entirely sufficient
for compliance purposes, however. A plan
will want to demonstrate a regularized,
data-driven monitoring process by which
it looks for aberrational billing patterns
based on recognized pattern-detection
methods, for example, peer-group analysis
(e.g., identifying those physicians who
perform the most services per patient and
conducting further investigation). A plan’s
data analysis should also include a specific
focus on claims or risk areas associated
with government-contracted claims or
members.
n Investigating. Depending on the size of
the plan, a qualified, dedicated investigative
staff may be required. The days of
assigning a provider relations employee
to “follow up” on allegations of provider
fraud are over. The investigative function
should be performed by trained personnel;
the specialized skills necessary for
the function are now widely recognized
and accreditation is becoming the norm.
Again, this is a function that could be outsourced
for smaller plans. For example,
using criteria of years of experience,
continuing education, and an examination,
the National Health Care Anti-Fraud
Continued on page 60
Health Care Compliance Association • 888-580-8373 • www.hcca-info.org
59
March 2009