Incoming! Medicaid RACs Enter the Claims Auditing Arena

On September 16, 2011, the Centers for Medicare and Medicaid Services (“CMS”) published the final rule (the “Final Rule”) implementing section 6411 of the Patient Protection and Affordable Care Act, which requires states to implement Medicaid Recovery Audit Contractor (“Medicaid RAC”) programs by January 1, 2012.1 Medicaid RACs identify and recover overpayments to Medicaid providers on a contingency fee basis (they are also expected to identify underpayments). The net savings estimated as a result of the implementation of the Medicaid RACs from 2012 to 2016 is $1.22 billion to the federal Medicaid program and $910 million to the state Medicaid programs. For providers, the roll-out of the Medicaid RAC program means that yet another contractor will be auditing their claims.

Medicaid RAC Program Requirements

In the Final Rule, CMS requires states to enter into contracts, consistent with state law, with one or more eligible Medicaid RACs by no later than January 1, 2012. CMS acknowledges similarities between the Medicare and Medicaid RAC programs, but also reiterates that states should be afforded flexibility in the design and operation of the Medicaid RAC program. Therefore, in the Final Rule, although CMS requires certain Medicaid RAC program elements to be consistent with the Medicare RAC program, CMS also allows for greater flexibility to be given to states for implementing other elements.

The elements of the Medicaid RAC program mandated by CMS that are consistent with the Medicare RAC program include the following:

  • Requiring the hiring of a minimum of 1.0 FTE contractor medical director who is an M.D. or D.O in good standing, although a state may seek to be excepted from this requirement by submitting to CMS a written request subject to CMS review and approval;
  • Requiring the hiring of certified coders to conduct review of claims. CMS provides flexibility to the states to determine if certified coders are required. Certified coders will not be required if the state determines they are not required for effective review of Medicaid claims;
  • Requiring that the Medicaid RAC work with the state to develop an education and outreach program, which includes notification to providers of audit policies and protocols;
  • Requiring that the Medicaid RAC provide minimum customer service measures that include: (1) providing a toll-free customer service number during normal business hours from 8:00 a.m. to 4.30 p.m.; (2) compiling and maintaining provider-approved addresses and points of contact; (3) mandatory acceptance of provider submissions of electronic medical records on CD/DVD or via fax at the providers’ request; and (4) notifying providers of overpayment findings within 60 calendar days;
  • Permitting a three-year maximum claims look-back period;
  • Requiring a state-established limit on the number and frequency of medical records requested by a Medicaid RAC;
  • Providing for state coordination of recovery audit efforts with other auditing entities to minimize the potential for multiple audits of the same provider; and
  • Requiring return of contingency fees within a reasonable timeframe as prescribed by the state if a Medicaid RAC determination is overturned at any level of appeal.

In the Final Rule, CMS allows states the flexibility to design and implement the following elements, although CMS encourages states to adopt the Medicare RAC version of these elements:

  • Medical necessity review;
  • Extrapolation and audit findings;
  • External validation of accuracy of RAC findings; and
  • Types of claims audited.

With respect to contingency fees, CMS clarifies that states maintain the flexibility of paying contingency fees either from amounts identified and recovered, but not fully adjudicated, or after the overpayment has been fully adjudicated and all appeals available to the provider have been exhausted. As indicated above in the mandated program requirements, a Medicaid RAC will be required to return the contingency fee within a reasonable timeframe (corresponding to the amount of the overpayment), as prescribed by the state, if an adverse determination is overturned at any level of appeal.

Finally, CMS addresses elements of the Medicaid RAC program in which states have complete flexibility regarding design, procurement, administration and operation. These elements are as follows:

  • Underpayment methodology;
  • State appeals process;
  • Contingency fee rates;
  • State exclusion of claims;
  • Bundling of procurements; and
  • Coordination of the collection of RAC overpayments.

States also are required to report to CMS elements describing the effectiveness of the state’s RAC program, including, but not limited to, general program descriptors and metrics. CMS will provide sub-regulatory guidance to states related to performance metrics, state reporting requirements and other milestones contained in the RAC program.

Appeals Process

In the Final Rule, CMS requires states to have an appeals process in place for providers to appeal adverse Medicaid RAC determinations. CMS will not impose a single appeals process on states and describes such a requirement as “unreasonably burdensome.” Instead, states are given the flexibility to determine the form of appeals process that best suits their respective Medicaid RAC programs.

CMS provides two options to the states for implementing an appeals process: (1) either take advantage of a state’s existing appeals process; or (2) establish a separate appeals process for RAC determinations. If a state uses an existing appeals process, it does not need to submit a description of the process to CMS or obtain CMS’ prior approval, as it would if it establishes a new appeals process.

Payment to Medicaid RACs

Medicaid RACs are compensated on a contingency fee basis for identifying overpayments, to the extent consistent with state law. In response to commenters who oppose contingency fees, CMS notes that contingency fees are a statutory obligation and have been a standard practice accepted among private healthcare payers for more than 20 years. The contingency fees paid to the Medicaid RACs must be based on a percentage of the overpayment recovered, which may not exceed that of the highest Medicare RAC, unless the state submits, and CMS approves, a waiver of the specified maximum rate (currently 12.5 percent).

CMS also requires states to determine the appropriate fees paid to Medicaid RACs for identifying underpayments. States must adequately incentivize the detection of underpayments.

Exceptions

CMS also addresses the option available to states to seek exception from some or all Medicaid contracting requirements by submitting to CMS a written justification for the request through the state plan amendment process. However, CMS emphasizes that complete exceptions will be granted rarely and only under exceptional circumstances.

CMS clarifies that states may exclude Medicaid managed care claims from review by Medicaid RACs. In addition, states have the discretion to exclude review of claims that are submitted in connection with payment or delivery system reform programs (e.g. Center for Medicare and Medicaid Innovation and other delivery reform programs that CMS is implementing).

Comparison to Medicaid Integrity Contractors (MICs) and Need for Coordination of Audits

In response to comments that the Medicaid RAC audits would be duplicative of the work of the MICs, CMS notes that the two programs serve different but important purposes. Medicaid RACs are focused on addressing overpayments involving state-specific issues while MICs are charged with addressing vulnerabilities on a regional and national basis. Additionally, MICs can focus on audit issues and fraudulent schemes that may not lead to overpayment recoveries, which are the source of RAC fees.

While these two contractors provide different services, CMS acknowledges the need to minimize the burdens on providers associated with responding to multiple audit requests. For this reason, states and the Medicaid RACs are required to coordinate their audit efforts with other entities performing audits of Medicaid claims.

If you have any questions about this issue of Health Reform IMPACT, please contact any of the attorneys in our Healthcare Fraud and Abuse practice.

1 A copy of the Final Rule can be found here.

Related Services

On September 16, 2011, the Centers for Medicare and Medicaid Services (“CMS”) published the final rule (the “Final Rule”) implementing section 6411 of the Patient Protection and Affordable Care Act, which requires states to implement Medicaid Recovery Audit Contractor (“Medicaid RAC”) programs by January 1, 2012.1 Medicaid RACs identify and recover overpayments to Medicaid providers on a contingency fee basis (they are also expected to identify underpayments). The net savings estimated as a result of the implementation of the Medicaid RACs from 2012 to 2016 is $1.22 billion to the federal Medicaid program and $910 million to the state Medicaid programs. For providers, the roll-out of the Medicaid RAC program means that yet another contractor will be auditing their claims.

Medicaid RAC Program Requirements

In the Final Rule, CMS requires states to enter into contracts, consistent with state law, with one or more eligible Medicaid RACs by no later than January 1, 2012. CMS acknowledges similarities between the Medicare and Medicaid RAC programs, but also reiterates that states should be afforded flexibility in the design and operation of the Medicaid RAC program. Therefore, in the Final Rule, although CMS requires certain Medicaid RAC program elements to be consistent with the Medicare RAC program, CMS also allows for greater flexibility to be given to states for implementing other elements.

The elements of the Medicaid RAC program mandated by CMS that are consistent with the Medicare RAC program include the following:

  • Requiring the hiring of a minimum of 1.0 FTE contractor medical director who is an M.D. or D.O in good standing, although a state may seek to be excepted from this requirement by submitting to CMS a written request subject to CMS review and approval;
  • Requiring the hiring of certified coders to conduct review of claims. CMS provides flexibility to the states to determine if certified coders are required. Certified coders will not be required if the state determines they are not required for effective review of Medicaid claims;
  • Requiring that the Medicaid RAC work with the state to develop an education and outreach program, which includes notification to providers of audit policies and protocols;
  • Requiring that the Medicaid RAC provide minimum customer service measures that include: (1) providing a toll-free customer service number during normal business hours from 8:00 a.m. to 4.30 p.m.; (2) compiling and maintaining provider-approved addresses and points of contact; (3) mandatory acceptance of provider submissions of electronic medical records on CD/DVD or via fax at the providers’ request; and (4) notifying providers of overpayment findings within 60 calendar days;
  • Permitting a three-year maximum claims look-back period;
  • Requiring a state-established limit on the number and frequency of medical records requested by a Medicaid RAC;
  • Providing for state coordination of recovery audit efforts with other auditing entities to minimize the potential for multiple audits of the same provider; and
  • Requiring return of contingency fees within a reasonable timeframe as prescribed by the state if a Medicaid RAC determination is overturned at any level of appeal.

In the Final Rule, CMS allows states the flexibility to design and implement the following elements, although CMS encourages states to adopt the Medicare RAC version of these elements:

  • Medical necessity review;
  • Extrapolation and audit findings;
  • External validation of accuracy of RAC findings; and
  • Types of claims audited.

With respect to contingency fees, CMS clarifies that states maintain the flexibility of paying contingency fees either from amounts identified and recovered, but not fully adjudicated, or after the overpayment has been fully adjudicated and all appeals available to the provider have been exhausted. As indicated above in the mandated program requirements, a Medicaid RAC will be required to return the contingency fee within a reasonable timeframe (corresponding to the amount of the overpayment), as prescribed by the state, if an adverse determination is overturned at any level of appeal.

Finally, CMS addresses elements of the Medicaid RAC program in which states have complete flexibility regarding design, procurement, administration and operation. These elements are as follows:

  • Underpayment methodology;
  • State appeals process;
  • Contingency fee rates;
  • State exclusion of claims;
  • Bundling of procurements; and
  • Coordination of the collection of RAC overpayments.

States also are required to report to CMS elements describing the effectiveness of the state’s RAC program, including, but not limited to, general program descriptors and metrics. CMS will provide sub-regulatory guidance to states related to performance metrics, state reporting requirements and other milestones contained in the RAC program.

Appeals Process

In the Final Rule, CMS requires states to have an appeals process in place for providers to appeal adverse Medicaid RAC determinations. CMS will not impose a single appeals process on states and describes such a requirement as “unreasonably burdensome.” Instead, states are given the flexibility to determine the form of appeals process that best suits their respective Medicaid RAC programs.

CMS provides two options to the states for implementing an appeals process: (1) either take advantage of a state’s existing appeals process; or (2) establish a separate appeals process for RAC determinations. If a state uses an existing appeals process, it does not need to submit a description of the process to CMS or obtain CMS’ prior approval, as it would if it establishes a new appeals process.

Payment to Medicaid RACs

Medicaid RACs are compensated on a contingency fee basis for identifying overpayments, to the extent consistent with state law. In response to commenters who oppose contingency fees, CMS notes that contingency fees are a statutory obligation and have been a standard practice accepted among private healthcare payers for more than 20 years. The contingency fees paid to the Medicaid RACs must be based on a percentage of the overpayment recovered, which may not exceed that of the highest Medicare RAC, unless the state submits, and CMS approves, a waiver of the specified maximum rate (currently 12.5 percent).

CMS also requires states to determine the appropriate fees paid to Medicaid RACs for identifying underpayments. States must adequately incentivize the detection of underpayments.

Exceptions

CMS also addresses the option available to states to seek exception from some or all Medicaid contracting requirements by submitting to CMS a written justification for the request through the state plan amendment process. However, CMS emphasizes that complete exceptions will be granted rarely and only under exceptional circumstances.

CMS clarifies that states may exclude Medicaid managed care claims from review by Medicaid RACs. In addition, states have the discretion to exclude review of claims that are submitted in connection with payment or delivery system reform programs (e.g. Center for Medicare and Medicaid Innovation and other delivery reform programs that CMS is implementing).

Comparison to Medicaid Integrity Contractors (MICs) and Need for Coordination of Audits

In response to comments that the Medicaid RAC audits would be duplicative of the work of the MICs, CMS notes that the two programs serve different but important purposes. Medicaid RACs are focused on addressing overpayments involving state-specific issues while MICs are charged with addressing vulnerabilities on a regional and national basis. Additionally, MICs can focus on audit issues and fraudulent schemes that may not lead to overpayment recoveries, which are the source of RAC fees.

While these two contractors provide different services, CMS acknowledges the need to minimize the burdens on providers associated with responding to multiple audit requests. For this reason, states and the Medicaid RACs are required to coordinate their audit efforts with other entities performing audits of Medicaid claims.

If you have any questions about this issue of Health Reform IMPACT, please contact any of the attorneys in our Healthcare Fraud and Abuse practice.

1 A copy of the Final Rule can be found here.

In Case You Missed It: