Medicare Advantage Audits – Risk Scoring Fraud Part I

Nolan Auerbach & White are experienced Medicare Fraud Attorneys helping courageous whistleblowers.

In response to the failure of the Medicare + Choice reimbursement methodology to control costs, the “Medicare Modernization Act of 2003” created Medicare Advantage, which relies on the “Hierarchical Condition Category” (HCC) system to formulate payments for participating managed care plans.

HCC payment is designed to match the individual health risk profile of each Medicare Advantage member with the premiums paid to the plan bearing the risk. Age-sex modifiers play a minor role in determining premium rate-setting. The HCC system utilizes ICD-9 diagnostic information as the primary indicator of each member’s health status. Thousands of ICD-9 codes are mapped to specific HCC disease categories, which ultimately dictate the premiums paid to the Medicare Advantage plan. This prospective payment system is known as “health status based risk adjustment”, or, in its abbreviated form, “risk adjustment”.

The HCC risk adjusted payment system is designed to reimburse plans more for members with higher burden of illness and expected costs and utilization. The system also reimburses less for members inferred to be “healthier”, based on more favorable, less morbid diagnosis profiles. (By law, the HCC system is designed to be revenue-neutral, so that plans with “healthier” members would see a significant drop in their reimbursement.)

Physician and hospital claims are submitted monthly to CMS, which then maintains a risk score by beneficiary based on current claims documentation. The beneficiary’s array of diagnoses is refreshed annually. Thus, for example, if a complex diabetic (kidney disease, heart disease, peripheral vascular disease) has provider claims submitted lacking the appropriate ICD-9 diagnoses at least annually, that patient’s premium reimbursement to the plan devolves to a lower rate, although the patient remains medically complex and at high risk for utilization. As stated in the Medicare Managed Care Manual, “Beneficiary risk scores are used to adjust each plan’s base payment rate for member health status. The risk score is computed for each beneficiary for a given year and applied prospectively. The risk score follows the beneficiary for one calendar year.”

Since CMS only accepts provider in-and out-patient attestation of a beneficiary’s burden of illness, in the form of in- or out-patient ICD-9 diagnosis arrays, the provider becomes key in maintaining risk-scores and, indirectly, reimbursement to the plan. The plan literally becomes dependent upon provider documentation for its economic survival.

HCFA 1500 Forms bearing current diagnoses must be submitted by date of service by providers, even if they are paid on a capitated basis by the plan. Capitated providers have no incentive to submit claim forms, since they are not paid on a fee-for-service basis. Absent these claims and diagnoses, the plan loses valuable, current diagnostic information on members, which leads to lower payment from CMS.

Medicare anticipated that potential for upcoding would accompany this reimbursement methodology, since provider diagnosis submissions directly impact plan revenues, and provider diagnoses have heretofore not been subject to audit. The Center on Budget and Policy Priorities clearly outlined the potential harm to the Medicare Advantage program, absent meaningful audits and sanctions for overstating Medicare beneficiaries’ burden of illness. The HCC risk adjustment program was designed with the objective of appropriate payment to plans with medically complex members; it was also intended to reduce inappropriate prospective capitated payments in behalf of members who were at lower risk of utilization. Flagrant exaggeration of member risk scores would obviously drive up plan payments beyond their actuarial cost risk.

Physicians are at risk for pressure from the plans, as a plan that intends to defraud Medicare wants the most medically complex diagnoses applicable to a member to realize optimal plan reimbursement. There are about a dozen ICD-9’s for diabetics for example, implying a broad range in complexity and severity, with a corresponding impact on payments. In this example, the submission of the most complex level of diagnoses for the diabetic patient, if not accurate, is called “coding optimization” or up-coding by the managed care organization; of course a more blatant method of fraud is if the managed care organization changes the physician coding.

While one set of ICD-9’s may be the only ones which apply based on clinical evidence, simply stretching the clinical “facts” yields a different set of ICD-9’s which provide the plan higher payment.

This is troubling because 1) potential distortion of true clinical complexity which higher resulting payments from CMS, 2) the question of kickback going to providers to provide the up coding, and 3) the implied pressure upon docs to exploit their attestation authority to the advantage of the plan (and possibly indirect advantage to the docs). The attestation authority is very hard for CMS to overturn even with medical record review. Many ICD-9 examples of coding creep are based on physician opinion and secondhand patient history which doesn’t require objective evidence for incremental reimbursement.

This type of Medicare fraud causes Medicare to pay a premium for a member who is not supported by that member’s medical complexity and future risk for unusual utilization costs. Upcoding is a direct violation of the False Claims Act.

If a plan a) induces a physician to submit diagnoses on claim forms which are fictitious or exaggerated, or does so itself; or b) the physician falsifies the medical record to support a higher level of patient complexity than is the case, and if this practice is carried out in exchange for an inducement from the plan, then the False Claims Act has been violated, as well as anti-kickback statutes.

The False Claims Act has been implicated because Medicare will end up paying more to the plan based on false data. Here’s a condensed version of how Medicare would be damaged, based not only on false diagnoses but also inaccurate plan enrollment numbers:

1. 1. In theoretical year 1 the Plan submits a total set of charges for medical expense to CMS divided by total membership to derive a “base rate” of claims costs per member.
   2. CMS receives County of Residence data containing benchmark Medicare A and B costs for the entire plan membership, which generates a “scaling factor”.
   3. Next, the Plan creates a “base factor”, which is essentially the previous year’s total Part A and B costs, which were generated by 100% of the plan’s true membership.
   4. The plan then proceeds to report total A + B claims costs for the preceding year (which are false based on upcoded diagnoses) and employed a false reduction in membership, thus creating an average member claim cost that is inflated, producing a fraudulently inflated “base factor”, or PMPY cost.
   5. That “base factor” is then applied to the total plan HCC scores (based on diagnoses for all acknowledged member) to create a “risk factor”, which is then carried forward in future years. These HCC scores are reported for the 100% membership. The “scaling factor” is multiplied by the “base factor” to derive HCC premiums.
   6. The “risk factor” thus inflated then creates higher premiums for the plan in the ensuing year(s).

Because premiums are paid based on documents containing these numbers, CMS places reliance upon the plan to report correct data for membership, residence information, and total claims costs. CMS, in turn, creates the HCC profiles, based on diagnoses that are submitted to CMS over the course of a year on UB92 and HCFA1500 Forms. Relatively few Medicare Fraud whistleblower cases have been brought based upon this scenario, but we expect numbers to increase in the coming years.