OAR 407-120-1505: Provider and Contractor Audits, Appeals, and Post Payment Recoveries

(1) Providers or entities under contract with the Department of Human Services (Department) or the Oregon Health Authority (Authority) (hereafter referred to as “provider”) receiving payments from the Department or Authority are subject to audit or other post payment review procedures (hereafter referred to as “audit”) for all payments applicable to items or services furnished or supplied by the provider to or on behalf of Department or Authority clients. (a) Audit rules and procedures ensure proper payments were made based on requirements applicable to covered services, ensure program integrity of the Department or Authority programs and services as outlined in OAR 407-120-0310, and establish authority for the Office of Payment, Accuracy and Recovery (OPAR), Provider Audit Unit (PAU) to recover overpayments and discover possible instances of fraud, waste, and abuse. (b) The Department and Authority share duties and functions related to audits and have the authority to determine which of the two agencies is authorized to fulfill a particular function. References in this rule to one agency should be construed to include, as the context requires, either or both agencies. (2) The Department may employ internal staff, consultants, or contractors, or cooperate with federal or state oversight authorities or other designees to conduct an audit or perform other audit procedures. The Department shall assign a contractor or one or more individuals to conduct the audit (hereafter referred to as “auditor”). (3) The auditor or PAU management shall determine the scope, time period, objective, and subject matter covered by the audit. (4) The authority for access to records is found in OAR 407-120-0370 and 410-120-1360 and other terms of agreements or contracts authorizing access to records for audit purposes. (5) The auditor may conduct an on-site field audit, examine and copy records at the provider’s expense, interview employees, and conduct such field work as the auditor determines shall provide sufficient and competent evidential basis for drawing conclusions about the audit subject matter. (6) The auditor may conduct a desk audit of records requested by the auditor and supplied by the provider, at the provider’s expense, or other source as necessary for the auditor to determine sufficient and competent evidential basis for drawing conclusions about the audit subject matter. (7) The auditor may consider other audits of the provider including but not limited to reviews conducted by the appropriate federal authority and the provider's independent audit of the provider's financial statements, which may include those performed by internal auditors, audit organizations, or contractors established by the federal or state government for the auditing of the Department or Authority programs. (a) The auditor may consider other indicators or issues related to program integrity activities. The auditor may also consider past or present program integrity activities listed in OAR 407-120-0310 that have identified same or similar instances of non-compliance. (b) The auditor shall determine the scope of other audit work and evaluate the reliability of its relationship to the scope and objective of the audit being conducted in determining the weight to be given to the other audit work. (8) PAU may use a random sampling method such as that detailed in the paper entitled "Development of a Sample Design for the Post-Payment Review of Medical Assistance Payments," written by Lyle Calvin, Ph.D., (Calvin Paper). The Department adopts by reference but is not limited to following the method of random sampling and calculation of overpayment described in the Calvin Paper: (a) In determining whether to use an overpayment calculation method set forth in section (8) of this rule, the auditor or PAU management may consider: (A) The provider's overall error rate identified in the audit; (B) If past audits have identified the same or similar instances of non-compliance; (C) The severity of the errors established in the audit; or (D) Any adverse impact on the health of the Department or Authority’s clients and their access to services in the provider's service area. (b) If the auditor determines an overpayment amount by a random sampling and overpayment calculation method set forth in section (8) of this rule, the provider may request a 100 percent audit of all billings from the same time period of the audit submitted to the Department or Authority for items or services furnished or supplied to or on behalf of Department or Authority clients. If a 100 percent audit is requested: (A) Payment and arrangement for a 100 percent audit shall be paid by the provider requesting the audit; (B) The audit must be conducted by an independent auditor or other individual whose qualifications the Department has determined, in writing, to be acceptable, who is knowledgeable with the Oregon Administrative rules covering the payments in question, who must waive any privilege to PAU in relation to the work papers and work product of the independent auditor; (C) The 100 percent audit must be completed within 90 calendar days of the provider's request to use such audit in lieu of the Department’s random sample; (D) The provider must waive all rights to appeal the factual findings of the independent auditor; and (E) The independent auditor must produce a final audit report or similar document detailing the findings of the 100 percent audit, including the overpayment assessment and recommendations to the provider and PAU. The independent auditor’s work papers must be made available to the Department auditor upon request. (9) The auditor shall prepare a preliminary audit report or similar document and deliver the preliminary audit report to the provider in person, or by registered or certified mail. The preliminary audit report shall inform the provider of the opportunity to provide additional documentation to the auditor about the information within the scope of the preliminary audit report. (a) Refusing to accept the registered or certified mail or in-person delivery shall not stop the audit process from proceeding forward. (b) The provider shall have 30 calendar days from the postmark date of the preliminary audit report to respond to the audit or request an informal meeting with the auditor. The informal meeting to review the report shall be held within 45 days from the date of the request for an information meeting. (c) The provider may request, in writing to the auditor, a 15-day extension to the preliminary audit report response due date for the purpose of submitting additional documentation. The extension must be authorized in writing by the auditor or PAU management. An additional 15-day extension, requested in writing, may be granted at the discretion of PAU management. (10) The auditor shall prepare a final audit report or similar document which is also the Department or Authority’s final order, and deliver the final audit report in person, or by registered or certified mail. The audit record that forms the basis for the final audit report shall be closed on the date of the final audit report. The final audit report shall include but is not limited to an overpayment assessment, findings, recommendations, and sanctions. (a) The overpayment assessment stated in the final audit report shall include but is not limited to the amount of overpayment PAU is authorized to recover and: (A) Is not limited to amounts determined by criminal or civil proceedings; (B) May include interest to be charged at allowable state rates; and (C) May include triple damages as described in section (18) of this rule. (b) Refusing to accept the registered or certified mail or in-person delivery shall not stop the audit process from proceeding. (c) If the provider disagrees with the final audit report or the overpayment amount, the provider must appeal the decision within 30 calendar days from the postmark date of the final audit report by submitting a written request for either an administrative review or a contested case hearing to the OPAR Administrator. The written request for appeal must outline in detail the areas of disagreement. (A) The OPAR Administrator or designee (hereafter referred to as “Administrator”) shall determine which appeals may be suitable for review as administrative review or contested case hearing, taking into consideration issues presented in the request for review and the purposes served by administrative review in section (12) or contested case hearing in section (13) of this rule. (B) If the Administrator decides the determinations of the final audit report or the content of appeal is appropriate for a contested case hearing or denies a request for an administrative review on the basis the appeal should be heard as a contested case hearing, the Administrator shall notify the provider and refer the appeal directly to the Office of Administrative Hearings (OAH) for a contested case hearing pursuant to these rules. (11) If a provider fails to request an appeal within the time frame specified in section (10) of this rule the final audit report, overpayment amount, and all recommendations and sanctions shall become final. Appeal requests submitted to PAU must: (a) Be in writing to the Administrator. (A) The appeal request is not required to follow a specific format as long as it provides clear written expression from the provider expressing disagreement with the final audit report findings. (B) The request must specify issues or decisions being appealed and the specific reason for the appeal on each finding or decision. The request must provide specifics for each claim such as procedure code, diagnosis code, reason for denial, administrative rules, or other authority applicable to the issue, and why the provider disagrees with the decision. If this information is not included in the appeal request in a manner that reasonably permits the Administrator to understand the decision being appealed or the basis for the appeal, the request shall be returned to the provider and the provider shall be required to resubmit the appeal within 10 working days from the date PAU returned the appeal to the provider. (b) Be received by the Administrator within 30 calendar days from the postmark date of the final audit report. (A) Late requests require written supporting documentation explaining reason for a late request. The Administrator shall determine whether failure to file a timely request was caused by circumstances beyond the control of the provider and enter an order accordingly. The Administrator may conduct further inquiry as deemed appropriate. In determining timelines of filing a request for review, the amount of time the Administrator determines accounts for circumstances beyond the control of the provider is not counted. (B) The untimely request may be referred to the OAH for a hearing on the question of timeliness. (12) Administrative review allows opportunity for the Administrator to review a decision affecting the provider. Appeals are limited to legal or policy issues where there is a stipulation of factual matters to be heard. (a) Administrative review meetings shall be: (A) Scheduled within 45 calendar days of receipt of the written request by the Administrator; (i) The Administrator shall prove written notice to the provider of the date, time, and place of the meeting. (ii) If the Administrator decides a preliminary meeting between the provider and PAU staff may assist the administrative review, the Administrator shall provide written notice to the provider of the date, time, and place the preliminary meeting is scheduled. (B) Held in Salem, unless otherwise stipulated to by all parties and PAU; (C) Conducted by the Administrator; (D) Department or Authority staff shall not be available for cross-examination; (E) Department or Authority staff may attend and participate in the meeting; and (F) The provider is not required to be represented by legal counsel and shall be given ample opportunity to present relevant information from the existing case record. (b) If a provider fails to appear at the administrative review meeting, the final audit report, all findings including the overpayment, and recommendations and sanctions as specified in the report shall become final. In addition, the provider may not appeal the final audit report. (c) The results of the meeting shall be sent to the provider, in writing, by registered or certified mail within 30 calendar days of the conclusion of the administrative review proceedings. The result of the administrative review is final. (d) All administrative review decisions are subject to procedures established in OAR 137-004-0080 to 137-004-0092 and judicial review under ORS 183.484 in the Circuit Court. (13) The contested case hearing process is conducted in accordance with ORS 183.411 to 183.497 and the Attorney General’s Uniform and Model Rules of Procedure for the Office of Administrative Hearings, OAR 137-003-0501 to 137-003-0700. (a) If the Administrator decides a contested case pre-hearing conference between the provider and PAU staff shall assist the contested case hearing, the Administrator shall notify the provider of the time and place of contested case pre-hearing conference without the presence of an administrative law judge. The purpose of the pre-hearing conference is to: (A) Provide an opportunity to settle the matter or discuss Model Rules of Procedure for contested case hearings listed in OAR 137-003-0575. Any agreement reached in a pre-hearing conference shall be submitted to the administrative law judge in writing or presented orally on the record at the contested case hearing; (B) Provide an opportunity for the provider and PAU to review the information, correct any misunderstanding of facts, and understand the reason for the action that is the subject of the contested case hearing; or (C) Determine if the parties wish to have witness subpoenas issued when the contested case hearing is conducted. (b) Prior to the date of the contested case hearing, the provider may request an additional pre-hearing conference with PAU representatives. The request shall be made in writing to the Administrator. An additional pre-hearing conference may be granted at the sole discretion of the Administrator if the additional pre-hearing conference is determined to facilitate the contested case hearing process or resolution of disputed issues. (c) The contested case hearing shall be held in Salem, unless otherwise stipulated to by all parties and PAU. (d) The OAH shall serve a proposed order on behalf of PAU unless PAU notifies the parties that PAU shall issue the final order. The proposed order shall become the final order if no exceptions are filed within the time specified in this rule. (e) The provider may file exceptions or written argument to the proposed order to be considered by PAU. The exceptions must be in writing and received by OPAR within 10 calendar days after the date the proposed order is issued. No additional evidence may be submitted. After receiving the exceptions or argument, PAU may adopt the proposed order as the final order, amend the order, or prepare a new order. (f) A provider may withdraw a contested case hearing request at any time. The OAH shall send a final order confirming the withdrawal to the provider. (14) If neither the provider nor the provider’s legal representative appears at the contested case hearing, PAU may elect one of the following options in its sole discretion: (a) The contested case hearing request may be dismissed by order. PAU may cancel the dismissal order upon request of the party on a showing that the party was unable to attend the hearing and unable to request a postponement for reasons beyond the provider’s control. (b) PAU may enter a final order by default. Entry of a final order by default may be made when PAU determines that the issuance of a final order with findings is appropriate as a basis of sanction authority or to establish a basis for future sanction authority or other reason consistent with the administration of the Department or Authority programs. The designated record, for purposes of a default order, shall be the record as designated in the notice issued to the provider. If not so designated, the designated record shall consist of the files and records held by PAU in the contested case hearing packet prepared by PAU. (15) Final orders are effective immediately upon being signed or as otherwise provided in the order. (a) Final orders resulting from a provider’s withdrawal of a contested case hearing request is effective the date the provider’s request is received by PAU or the OAH, whichever is sooner. (b) When the provider fails to appear for the contested case hearing, the effective date of the dismissal order or the final order by default is the date of the scheduled contested case hearing. (16) The burden of presenting evidence to support a fact or position rests on the proponent of the fact or position. Pursuant to OAR 410-120-1360, payment on a claim shall only be made for services that are adequately documented and billed in accordance with OAR 410-120-1280 and 407-120-0330 and include all applicable administrative rules and applicable contract terms related to covered services for the client’s benefit package, and the establishment of conditions under which services, supplies or items are covered, including but not limited to the Prioritized List, diagnosis and procedure coding, medical appropriateness, and other applicable standards. (17) The Administrator, in consultation with appropriate Department or Authority authorities, may grant the provider the relief sought at any time. (18) Overpayments must be paid within 30 calendar days from the postmark date of the final audit report. The provider may submit a request to the auditor or PAU management for a payment plan to satisfy this requirement. The auditor and PAU management may not waive this overpayment requirement. (a) A request for an administrative review or contested case hearing shall not change the date the overpayment is due or a payment plan is to commence, unless otherwise stipulated in writing by the Administrator. (b) PAU management may extend the reimbursement period or accept an offer of payment terms. PAU must make any change in the reimbursement period or terms in writing. (A) The request for a payment plan must be made in writing to PAU management. The auditor or PAU management shall notify the provider, in writing, of the decision regarding acceptance or denial of the request. (B) If the payment plan is agreeable to all parties, the auditor or PAU management shall ensure the payment plan is in writing and signed by all parties. A payment plan may include charging interest at the allowable state rate. (c) If the provider refuses to reimburse the overpayment or does not adhere to an agreed upon payment schedule, PAU may: (A) Recoup, in any manner available to PAU, future provider payments up to the amount of the overpayment; (B) Pursue civil action to recover the overpayment; or (C) Recommend suspension or termination of the provider’s enrollment in the Oregon Medicaid Program. (d) As a result of a contested case hearing or an administrative review, the amount of the overpayment may be reduced in part or in full. (e) PAU may at any time change the amount of the overpayment in accordance with this rule. The provider shall be notified of any changes in writing by certified or registered mail. PAU shall refund the provider any monies paid to PAU in excess of the overpayment. (f) If a provider is terminated from participation in Department or Authority programs or sanctioned for any reason, PAU may pursue civil action to recover any amounts due and payable. (g) If the auditor, in the course of an audit, discovers the provider has continued in the same or similar improper billing practices as established or upheld if appealed, in a previously published final audit report by PAU, or has been warned in writing by the Department or Authority, PAU, or the Department of Justice about improper billing practices, the provider may be liable to PAU for up to triple the amount of the current final audit report establishing the overpayment received by the provider as a result of such violation. (19) Providers who conduct electronic data transactions with the Department or Authority must adhere to requirements of OAR 407-120-0100 to 407-120-0200. This rule only applies to services or items paid for by the Department or Authority. If the provider maintains financial or clinical records electronically, the provider must ensure the use of electronic record keeping systems does not alter the requirements of OAR 407-120-0370. (a) The provider's electronic record keeping system includes electronic transactions governed by HIPAA transaction and code set requirements and records, documents, and documentation, whether maintained or stored in electronic media, including electronic record-keeping systems and information stored or backed up in an electronic medium. (b) If the provider maintains financial or clinical records electronically, the provider must be able to provide PAU with hard copy versions, if requested. The provider must also be able to provide an auditable means of demonstrating the date the record was created, the identity of the creator of a record, the date the record was modified, what was modified in the record, and the identity of any individual who has modified the record. The provider must supply the information to individuals authorized to review the provider's records pursuant to OAR 407-120-0370(3)(e). (c) If the provider maintains records electronically or permits the use of electronic signatures, the provider must document any aspect of the provision of services. The provider must maintain appropriate safeguards to assure the authenticity of the electronic records and signatures. The provider may not challenge the authenticity or admissibility of the electronic signature or documents in any audit, review, hearing, or other legal proceeding. (d) Providers must comply with the documentation review requirements in OAR 407-120-0370 by providing the electronic record in an electronic format acceptable to an authorized reviewer. The authorized reviewer must agree to receive the documentation electronically.