HCR 203 Week 5 HIPAA and Compliance in Claims Processing Example

A Spike in 99215s, Statements Mailed to the Wrong Houses and a Sixty-Day Clock: HIPAA and Fraud-and-Abuse Compliance at a Medical Billing Company

[Student Name]

University of Phoenix

HCR/203: Medical Claims Processing and Compliance

Week 5 Assignment

[Instructor Name]

[Date]

The billing company, its clients and the incidents are composites written for a model paper; laws, rules and guidance come from the sources listed.

The compliance committee of the billing company followed throughout this course meets once a quarter. This quarter it reviewed three problems: an unusual pattern in one client's office visit coding, patient statements mailed to the wrong homes and overpayments discovered during a payer audit. This paper explains the compliance rules that apply to claims processing and how the company handled each problem.

The Company's Obligations

The company handles protected health information on behalf of its clients, which makes it a business associate under HIPAA. Each client has signed a business associate agreement requiring the company to use information only for billing, protect it with administrative, physical and technical safeguards and report incidents. The company must also submit claims using the standard transactions and code sets. Federal guidance written for billing companies urges them to adopt compliance programs with policies, training, auditing, reporting channels and corrective action and warns specifically against upcoding, duplicate billing and billing for services not documented (Office of Inspector General, 1998).

Fraud and Abuse Laws in Brief

The False Claims Act imposes liability for knowingly submitting false claims to federal programs, and knowledge includes deliberate ignorance and reckless disregard. The anti-kickback statute bars paying for referrals, and the physician self-referral law restricts certain referrals. For a billing company, the most direct risks are coding that overstates services and failing to act on known errors.

Case One: A Spike in the Highest Visit Level

The company's monthly analysis compares each client's distribution of office visit levels with national patterns. One practice's share of 99215, the highest established patient level, rose from 7% to 22% in a year while its patient mix and staff stayed the same. Years earlier, a federal review had found that physicians increasingly billed higher-level visits and identified a group who consistently billed the highest levels, making such patterns a known audit target (Office of Inspector General, 2012). The company's coders reviewed 40 visits and found that many notes were copied forward from earlier visits, repeating extensive histories and examinations that did not reflect the day's care and did not support the level billed. A billing company that sees a pattern and keeps submitting the claims can no longer call them honest mistakes.

The Response to Case One

The company paused coding at the 99215 level for the practice pending review, met with its physicians and compliance lead, provided documentation training and recommended an independent audit. The audit estimated overpayments, which the practice, as the billing provider, reported and returned. The company added an alert that flags any client whose visit level distribution shifts sharply.

Case Two: Statements to the Wrong Homes

A software update merged two address fields, and 212 patient statements listing dates of service, provider names and in some cases diagnosis descriptions were mailed to other patients' addresses. The company notified its clients within the time set in the business associate agreements. HIPAA's breach rule starts from the assumption that any disclosure the rules do not allow counts as a breach; the covered entity can overcome that assumption only by documenting, through a four-factor assessment, that the information was unlikely to have been compromised (U.S. Department of Health and Human Services, n.d.). Because the statements contained health information and went to unknown recipients, the clients concluded the incident was a breach requiring notice to affected patients, and because fewer than 500 people were affected, to the federal government in the annual log.

The Response to Case Two

The company paid for the mailing of notification letters, recalled what it could and changed its release process: every software update is now tested on a sample of statements before production runs, and statements no longer print diagnosis descriptions.

Case Three: Overpayments and the Sixty-Day Clock

During a commercial payer's audit, the company discovered that a Medicare contractor had also paid 38 of the hospital's claims twice over five months because the hospital had resubmitted claims instead of waiting for the first payment. Under the Medicare rule on reporting and returning overpayments, a provider must report and return an overpayment within 60 days after it is identified (Centers for Medicare & Medicaid Services, 2016). The hospital quantified the duplicates within two weeks and returned them through its Medicare contractor's voluntary refund process.

The Response to Case Three

The company's scrubber now blocks resubmission of any claim still pending, and its posting team flags any remittance paying a claim already paid.

Training That Uses Real Cases

The committee turns each quarter's problems into training. New specialists now review an anonymized version of the visit-level case to learn how data patterns reveal documentation problems, and every employee completed a short module on the mailing incident explaining why a single merged field could expose hundreds of patients. The training ends with a reminder that anyone can report a concern through the company's anonymous line, which received seven reports last year, two of which led to findings. Using the company's own cases makes the rules concrete in a way that general videos do not.

Working With Clients

Because the company bills in its clients' names, most compliance decisions, such as refunds and patient notifications, belong to the clients. The company's role is to detect problems, inform clients promptly, recommend actions and document what was decided. Its contracts require clients to respond to compliance findings within 30 days.

The Compliance Program Behind the Responses

Each case was found by a control the company had built: data analysis, incident reporting and payment posting review. The committee tracks every issue to closure, reports to the company's board and to clients and updates training each year with cases like these.

Conclusion

Compliance in claims processing combines privacy duties as a business associate, fraud and abuse laws that punish knowing false claims and rules requiring overpayments to be returned. The quarter's three cases show those rules applied: a coding pattern investigated and corrected, a mailing error assessed and reported as a breach and duplicate payments returned within 60 days. In each, the lasting fix was a better process.

References

Centers for Medicare & Medicaid Services. (2016). Medicare program; Reporting and returning of overpayments. Federal Register, 81, 7654. https://www.federalregister.gov/d/2016-02789

Office of Inspector General. (1998). Publication of the OIG compliance program guidance for third-party medical billing companies. Federal Register, 63, 70138. https://www.federalregister.gov/d/98-33565

Office of Inspector General. (2012). Coding trends of Medicare evaluation and management services (OEI-04-10-00180). U.S. Department of Health and Human Services. https://oig.hhs.gov/oei/reports/oei-04-10-00180.pdf

U.S. Department of Health and Human Services. (n.d.). Breach notification rule. https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html