Small Medicare Audits Put Your Billing Privileges at Risk

Author: Kaitlyn DelBene, Wachler & Associates, PC
3/3/24

The authority to revoke the Medicare billing privileges of enrolled providers is one of many program integrity tools used by the Centers for Medicare & Medicaid Services (“CMS”) to curb fraud, waste, and abuse in the federal healthcare programs. While CMS has generally stated that its revocation authority is intended to protect the Medicare program and its beneficiaries from overt abuse, ongoing expansions to the grounds for revocation have swept many well-intentioned providers into CMS’s crosshairs. Increasingly, relatively very small audit findings, e.g., amounting to $5,000 or less in alleged overpayments, if left un-appealed by the provider, are leading CMS contractors to pursue disproportionately severe revocation actions based on alleged abuse of billing privileges. Providers faced with audit findings should be cognizant of CMS’s revocation authority and should make it a standard practice to seriously engage in the appeals process when faced with audit findings by CMS or its contractors.

CMS Expands Revocation Authority for Abuse of Billing Privileges under Section (a)(8)(ii)

CMS’s revocation authority is set forth at 42 CFR § 424.535, pursuant to which CMS may revoke a currently enrolled provider’s Medicare billing privileges and any corresponding provider agreement (or supplier agreement) for any of a list of ever-expanding reasons, with at least 23 currently enumerated bases. The focus of this article is revocations for abuse of billing privileges pursuant to 42 CFR § 424.535(a)(8)(ii), which permits revocation if CMS determines that the provider or supplier has a pattern or practice of submitting claims that fail to meet Medicare requirements.

CMS’s power to revoke pursuant to Section (a)(8)(ii) is discretionary rather than mandatory. CMS has emphasized that Section (a)(8)(ii) revocations “should be reserved for only the most serious of abuses,” stating that this section “will only be applied when it is clearly appropriate.”¹ Specifically, CMS has stressed that it will only apply Section (a)(8)(ii) “[i]n situations where the behavior could not be considered sporadic” and “after the most careful and thorough consideration of the relevant factors.”² CMS has also stated that it “always considers mitigating factors…in its denial and revocation determinations” pursuant to the “any other information” criterion at § 424.535(a)(8)(ii)(D).³

Despite these assurances by CMS of careful consideration and sparing use of Section (a)(8)(ii), it is increasingly common to see revocation decisions that do not adequately account for all relevant factors, and that are based on audit findings not amounting to a pattern or practice of serious abuse. Notably, CMS proposed to define a “pattern or practice” to constitute as little as “three submitted non-compliant claims” for the purpose of Section (a)(8)(ii) revocations.⁴ Although it ultimately did not adopt this proposed language, recent revocation actions confirm that CMS takes a very broad view when identifying a pattern or practice of non-compliance. In effect, any provider who has been subject to an audit finding involving three or more claims should consider the possibility of an associated revocation decision. CMS contractors routinely state as much in standard language that they include in letters communicating their audit findings, warning of the possibility of a Section (a)(8)(ii) revocation if CMS determines that a pattern or practice of non-compliance exists.

The enumerated factors considered by CMS when making a Section (a)(8)(ii) determination are: (A) the percentage of submitted claims that were denied during the period under consideration; (B) whether the provider or supplier has any history of final adverse actions and the nature of any such actions; and (C) the type of billing non-compliance and the specific facts surrounding said non-compliance (to the extent this can be determined). CMS’s inclusion, and interpretation, of these factors only serves to enable its broad application of this ground for revocation.

For example, the “period under consideration” is whatever timeframe CMS decides to audit and/or examine to make its revocation decision: this language was added by CMS specifically to enhance its “capacity to target brief periods involving a significant percentage of denied claims,” without a need to weigh these periods against the percentage of claim denials “over the entire period of the provider’s or supplier’s enrollment.”⁵ Thus, CMS has given itself the flexibility to generate, and base a revocation decision upon, denial rates of 100% over one or more discrete audits, even when this percentage does not account in any way for intervening periods of time and many other claims billed to CMS by the same provider.

CMS has stated, “[W]e do not intend to use the results of audits performed by our contractors as the sole and absolute criterion of…noncompliance with Medicare payment policies”; rather, “such results will be considered in our review of all of the factors in [Section (a)(8)(ii)].”⁶ Nevertheless, we are increasingly seeing Section (a)(8)(ii) revocation actions based solely and explicitly on audit findings.

Revocations Are Accompanied by Lengthy Reenrollment Bars and Onerous Appeal Processes

In the case of a provider for whom there have been no previous or related revocations, CMS may impose a reenrollment bar for one to ten years, “depending on the severity of the basis for revocation.”⁷ With regard to this severity-based standard, CMS has stated, “The maximum reenrollment bar is typically restricted to egregious acts of misconduct.”⁸ CMS increased the former three-year maximum bar to ten years with a stated “sole objective [] to make certain that unscrupulous providers and suppliers are kept out of Medicare for as long as possible,” and to enable it “to address various factual situations, including particularly improper or fraudulent behavior.”⁹

Nevertheless, as with the previous three-year maximum, it seems as though CMS is treating ten years as a default rather than a maximum. Thus, a provider who receives a revocation that is unwarranted based on a tenuous claim of billing non-compliance may also be faced with an excessive reenrollment bar. Given statutory requirements for state Medicaid programs to revoke where Medicare has revoked, and given that commercial payors usually follow suit, a revocation is equivalent to an exclusion and has devastating effects on the revoked practice.

Because of the severe consequences of a Medicare revocation, a provider or supplier is likely to expend significant effort exercising all available appeal rights. All Medicare revocations have a right to reconsideration by CMS, review by an Administrative Law Judge, appeal to the Departmental Appeals Board, and filing in federal court. Additionally, if and when a revocation is reversed or rescinded, claims that were denied due to the revocation are not automatically paid and must be appealed separately. The enrollment revocation and appeal process is not only administratively onerous but also unfairly structured to limit a provider’s chance of success on appeal, or success with any expediency in the adjudication.¹⁰

Conclusion

For many providers, the decision to appeal audit findings by CMS includes an assessment of the cost involved to engage in the appeal process compared with the amount of the alleged overpayment. Even where the provider has a strong case that the claims at issue were billed in compliance with Medicare requirements, the provider may consider foregoing its appeal rights when the dollar amounts at issue are relatively low. When audit findings are not appealed, however, they become potential bases for CMS to establish a pattern or practice of non-compliance and proceed with a revocation. Given the possible ramifications, providers are well-advised to pursue appeals when compliant claims are denied, no matter how small the audit, to mitigate against the possible imposition of Section (a)(8)(ii).

Short Bio: Katy DelBene is an attorney at Wachler & Associates, PC. Ms. DelBene practices in all areas of healthcare law, representing healthcare providers and suppliers in the defense of Medicare, Medicaid, and third-party payor audits, as well as a broad range of health professional and facility licensing and regulatory compliance matters.

1. 79 FR 72499, 72519 (Dec. 5, 2014). ↩︎
2. 79 FR 72499, 72514 (Dec. 5, 2014). ↩︎
3. 88 FR 78818, 79279 (Nov. 16, 2023). ↩︎
4. 88 FR 78818, 79276 (Nov. 16, 2023). ↩︎
5. 86 FR 64996, 65334 (Nov. 19, 2021). ↩︎
6. 79 FR 72499, 72515 (Dec. 5, 2014). ↩︎
7. 42 CFR § 424.535(c)(1)(i). ↩︎
8. 88 FR 78818, 79266 (Nov. 16, 2023). ↩︎
9. 84 FR 47794, 47826-27 (Sep. 10, 2019). ↩︎
10. For a thorough review of deficiencies in the enrollment revocation process, including arguments about constitutionality, see D. Romano, “Unlawful, Unfair and Unwise: Constitutional and Rulemaking Infirmities in CMS’s Enrollment Revocation Regulations and How to Challenge Them,” The Health Lawyer vol. 31, no. 6 (August 2019). ↩︎