OAR 410-120-1396: Provider and Contractor Audits

(1) Individual providers or business entities (providers) enrolled with or under contract with the Oregon Department of Human Services (ODHS) or the Oregon Health Authority (Authority) (hereafter referred to as “provider”) receiving payments from the ODHS or Authority are subject to audit or other post payment review procedures (hereafter referred to as “audit”) for all payments applicable to items or services furnished or supplied by the provider to or on behalf of ODHS or Authority Medicaid members. (a) Audit rules and procedures ensure proper payments were made based on requirements applicable to covered services, ensure program integrity of the Authority or ODHS programs and services as outlined in Oregon Administrative Rules (OARs) 407-120-0310, 943-120-1505, 410-120-1160, OAR Ch 410 sections applicable to specific services, and establish authority for the Authority Office of Program Integrity (OPI) to recover overpayments and discover possible instances of fraud, waste, and abuse in the Medicaid member program. (b) Audits are conducted of providers paid under Oregon’s Medicaid program who direct, furnish or supply items or services as fee-for-service providers, as defined in OAR 410-120-0000, or as participating providers, non-participating providers or subcontractors of a Managed Care Entity (MCE), as defined in OAR 410-141-3500. This includes all provider types enrolled by the Authority or ODHS under OAR 410-120-1260 or by agreement or contract with the Authority or ODHS. (c) The Authority and ODHS share duties and functions related to audits and have the authority to determine which of the two agencies is authorized to fulfill a particular function. (2) The Authority may employ internal staff, consultants, or contractors, or cooperate with federal or state oversight authorities or other designees to conduct an audit or perform other audit procedures. The Authority will assign a contractor or one or more individuals to conduct the audit (hereafter referred to as “auditor”). (a) The Authority shall ensure auditors have appropriate training and subject matter expertise to conduct the audit and perform other audit procedures. (b) OPI may, at its sole discretion, modify or extend the timeframes noted in this rule when the provisions of OAR 410-120-0011 are in effect or in response to local emergencies that are outside the control of Authority or providers. (3) The auditor and OPI management will determine the scope, time period, objective, and subject matter covered by the audit. (4) The authority for access to records is found in OARs 407-120-0370 and 410-120-1360, as well as other terms of agreements or contracts authorizing access to records for audit purposes. (5) The auditor may conduct an on-site audit, examine and copy records using provider’s on-site resources or at the provider’s expense, interview employees, and conduct such work as the auditor determines is necessary to provide sufficient and competent evidential basis for drawing conclusions about the audit subject matter. (6) The auditor may conduct a desk audit of records requested by the auditor and supplied by the provider, at the provider’s expense, or other source as necessary for the auditor to determine sufficient and competent evidential basis for drawing conclusions about the audit subject matter. (7) The auditor may consider other audits of the provider including, but not limited to, reviews conducted by a federal or state authority, which may include those performed by internal auditors, audit organizations, or contractors established by the federal or state government for the auditing of the Authority or DHS programs, an MCE, and the provider's independent audit of the provider's claims and financial statements. (a) The auditor may consider other indicators or issues related to program integrity activities. The auditor may also consider past or present Authority program integrity activities conducted under OAR 410-120-1395 and OAR 407-120-0310 that have identified same or similar instances of non-compliance. (b) The auditor shall determine the scope of other audit work and evaluate the reliability of its relationship to the scope and objective of the audit being conducted in determining the weight to be given to the other audit work. (c) The auditor may, in addition to the record request sent to the provider, request documentation from an MCE when the items or services within the audit scope were furnished or supplied to or on behalf of a Medicaid member enrolled in that MCE. (A) The auditor shall provide copies of the preliminary and final audit report to the MCE; (B) The MCE must hold the audit, the preliminary report and its preliminary findings in confidence and must not act directly or indirectly to discourage a provider’s participation in the audit; (C) The auditor may consider the MCE documentation requested by the auditor as necessary for the auditor to determine sufficient and competent evidential basis for drawing conclusions about the audit subject matter; and (D) The auditor shall evaluate the relevance and reliability of the MCE’s documents in relationship to the scope and objective of the audit being conducted in determining the weight to be given to any MCE documents. (8) The Authority’s OPI may use a statistical sampling methodology in audits. The OPI may use, but is not limited to, the statistical and sampling methods in the book entitled " Sampling Techniques, 3rd Edition," written by William G. Cochran, (Cochran) For sampling and calculation of overpayments. (a) In determining whether to use an overpayment calculation method in section (8) of this rule, the auditor and OPI management may consider: (A) The provider's overall error rate identified in the audit; (B) If past audits have identified the same or similar instances of non-compliance; (C) The severity of the errors established in the audit; or (D) Any adverse impact on the health of members and their access to services in the provider's service area. (b) If OPI determines an overpayment amount by a random sampling and overpayment calculation method in section (8) of this rule, the provider may request, for the services within the scope of the audit, a 100 percent audit of all billings from the same time period of the audit submitted to the DHS or Authority for items or services furnished or supplied to or on behalf of members. If a 100 percent audit is requested by the provider: (A) Payment and arrangement for a 100 percent audit must be paid by the provider requesting the audit; (B) The audit must be conducted by an independent auditor or other individual whose qualifications the Authority has determined, in writing, to be acceptable; who is knowledgeable with OAR and the billing and coding standards covering the payments in question; and who must waive any privilege to OPI in relation to the work papers and work product of the independent auditor; (C) The 100 percent audit must be completed within 90 calendar days of the provider's request to use such audit in lieu of the Authority’s sample, or within a timeframe approved by OPI; (D) The provider must waive all rights to appeal the findings of the independent auditor; and (E) The independent auditor must produce a final audit report or similar document, detailing the findings of the 100 percent audit, including the overpayment assessment and recommendations to the provider and OPI. The independent auditor’s work papers must be made available, at the providers’ expense, to OPI upon request. (c) For providers furnishing or supplying items or services to or on behalf of Medicaid members enrolled in an MCE, the overpayment amount will be determined by OPI: (A) Using the Authority fee-for-service fee schedule in effect on the date of service; or (B) If requested by the MCE, OPI may use the MCE’s rate per claim or encounter when that rate increases the accuracy of the calculated overpayment. OPI reserves the right to review the MCE rate for reasonability. (9) The auditor shall prepare a records request letter and deliver the records request to the provider in person, or by secure encrypted email, or registered or certified mail. (a) A provider’s refusal to accept the secure encrypted email, registered or certified mail or in-person delivery will not stop the audit from proceeding. (b) The provider shall have 30 calendar days from the postmark date or email sent date of the records request letter to respond with the requested records. The provider must provide immediate access to the requested records when the request is made in person. (c) The provider may request, in writing to the auditor, up to a 15 calendar-day extension to the records request due date for preparing documentation. The request must be received by OPI before the timeframe in subsection 9(b) of this rule expires and the extension must be authorized in writing by the auditor or OPI management. An additional 15 calendar-day extension, requested in writing, may be granted at the discretion of OPI management. (10) The auditor will prepare a preliminary audit report or similar document. The preliminary audit report informs the provider of the opportunity to provide additional documentation to the auditor about the services within the scope of the preliminary audit report: (a) Auditor will deliver the preliminary audit report to the provider in person, by secure encrypted email, or by registered or certified mail; (b) Refusing to accept the secure encrypted email, registered or certified mail or in-person delivery will not stop the audit process from proceeding; (c) The provider and MCE have 30 calendar days from the in-person delivery date, postmark date, or email sent date of the preliminary audit report to respond to the audit. The MCE must hold the preliminary report and its preliminary findings in confidence and must not act directly or indirectly to discourage a provider’s participation in the audit; (d) The provider may request, in writing to the auditor, up to a 15 calendar-day extension to the preliminary audit report response due date for submitting additional documentation. The request must be received before the 30 calendar-day timeframe in subsection 10(c) of this rule expires and the extension must be authorized in writing by the auditor or OPI management. An additional 15 calendar-day extension, requested in writing, may be granted at the discretion of OPI management. (11) The auditor will prepare a final audit report or similar document which is also the Authority’s final order. The final audit report includes an overpayment amount, findings, recommendations, and appeal rights. Auditor will deliver the final audit report to the provider in person, by secure encrypted email or by registered or certified mail. When the audit is of an MCE provider, the auditor will also deliver a copy of the final audit report to the MCE in person, by secure encrypted email or by registered or certified mail: (a) The overpayment amount stated in the final audit report includes but is not limited to the amount of overpayment OPI is authorized to recover and: (A) Is not limited to amounts determined by criminal or civil proceedings; (B) May include interest to be charged at allowable state rates; and (C) May include triple damages as described in section (20) of this rule. (b) Refusing to accept the secure encrypted email, registered or certified mail or in-person delivery will not stop the audit process from proceeding; (c) If the provider or MCE disagrees with the final audit report or the overpayment amount, the provider or MCE may appeal the decision. The provider or MCE must appeal the decision within 30 calendar days from the in-person delivery date, postmark date, or email sent date of the final audit report by submitting a written request for either an administrative review or a contested case hearing to OPI. The written request for appeal must outline in detail the areas of disagreement: (A) The OPI Administrator or designee is referred to as “Administrator” in this rule. The Administrator will determine which appeals may be suitable for review as administrative review or a contested case hearing, taking into consideration the issues presented in the request for appeal and the purposes served by administrative review in section (13) or contested case hearing in section (14) of this rule; (B) If the Administrator decides the determinations of the final audit report or the content of appeal is appropriate for a contested case hearing or denies a request for an administrative review on the basis the appeal should be heard as a contested case hearing, the Administrator notifies the provider and refers the appeal directly to the Office of Administrative Hearings (OAH) for a contested case hearing pursuant to these rules; (C) The MCE is a party in an appeal only where a provider furnished or supplied items or services to the MCE member. An MCE appeal of the final audit report or the overpayment amount will proceed as outlined in sections (11) through (21) of this rule; (D) The MCE must comply with provisions for handling of overpayments made to providers as required by any contracts or agreements between the MCE and the Authority. (12) If a provider or MCE fails to request an appeal within 30 calendar days from the date of the final audit report, the overpayment amount, findings, and all recommendations shall become final. Provider or MCE appeal requests submitted to OPI must: (a) Be in writing to the Administrator: (A) The appeal request is not required to follow a specific format as long as it provides clear written expression from the provider or MCE expressing disagreement with the final audit report findings; (B) The request must specify issues or decisions being appealed and the specific reason for the appeal on each finding or decision. The request must provide specifics for each claim such as procedure code, diagnosis code, reason for denial, administrative rules, or other authority applicable to the issue, and why the provider or MCE disagrees with the decision. If this information is not included in the appeal request in a manner that reasonably permits the Administrator to understand the decision being appealed or the basis for the appeal, the request will be returned to the provider or MCE and the provider or MCE must resubmit the appeal within 10 calendar days from the date on OPI’s notice returning the appeal. (b) Be received by OPI within 30 calendar days from the in-person delivery date, postmark date, or email sent date of the final audit report: (A) Late appeal requests require written supporting documentation clearly explaining the reason for a provider’s or MCE’s late request. The Administrator will determine whether failure to file a timely request was caused by circumstances beyond the provider’s or MCE’s control and enter an order accordingly. The Administrator may conduct further inquiry as deemed appropriate. In determining timelines of filing a request for review, the amount of time the Administrator determines accounts for circumstances beyond the control of the provider is not counted. (B) The untimely request may be referred to the OAH for a hearing on the question of timeliness. (13) Administrative review allows an opportunity for the Administrator to review a decision affecting the provider or MCE. Administrative review is limited to legal or policy issues where there is a stipulation of factual matters to be heard. The administrative review may be conducted as a desk review of available documentation or as a meeting, in-person or through the use of telephonic or electronic communication, between OPI and the provider or MCE, at the sole discretion of Administrator: (a) Administrative review meetings will be: (A) Scheduled within 90 calendar days from receipt of the written request by the Administrator: (i) The Administrator will send written notice to the provider or MCE of the date, time, and place of the meeting; (ii) If the Administrator decides a preliminary meeting, in-person or through the use of telephonic or electronic communication, between the provider or MCE and OPI may assist the administrative review, the Administrator shall provide written notice to the provider or MCE of the date, time, and place the preliminary meeting is scheduled. (B) Held in Salem, unless otherwise stipulated to by OPI; (C) Conducted by the OPI Administrator; (D) Authority or ODHS staff will not be available for cross-examination; (E) Authority or ODHS staff may attend and participate in the meeting; and (F) The provider or MCE is not required to be represented by legal counsel and will be given ample opportunity to present relevant information from the existing case record. (b) If a provider, MCE, or legal representative fails to appear at the administrative review meeting, the final audit report, all findings including the overpayment, and recommendations and sanctions as specified in the report will become final. In addition, the provider or MCE may not further appeal the final audit report. The Administrator may cancel the final order upon request of the provider, MCE, or legal representative. The provider or MCE must be able to show evidence that the provider, MCE, or legal representative was unable to attend the Administrative Review and unable to request a postponement for reasons beyond the provider’s or MCE’s control; (c) The results of the meeting shall be sent to the provider or MCE, in writing, by secure encrypted email, registered or certified mail within 30 calendar days of the conclusion of the administrative review proceedings. The result of the administrative review is final; (d) All administrative review decisions are subject to procedures established in OARs 137-004-0080 to 137-004-0092 and judicial review under ORS 183.484 in the Circuit Court. (14) The contested case hearing process is conducted in accordance with ORS 183.411 to 183.497 and the Attorney General’s Uniform and Model Rules of Procedure for the Office of Administrative Hearings (OAH), OAR 137-003-0501 to 137-003-0700: (a) If the Administrator decides an informal pre-hearing conference, in-person or through the use of telephonic or electronic communication, between the provider or MCE and OPI shallassist the contested case hearing, the Administrator will notify the provider or MCE of the time and place of the informal pre-hearing conference without the presence of an Administrative Law Judge (ALJ). The purpose of the informal pre-hearing conference is to: (A) Provide an opportunity to settle the matter or discuss Model Rules of Procedure for contested case hearings listed in OAR 137-003-0575. Any agreement reached in a pre-hearing conference will be submitted to the ALJ in writing or presented orally on the record at the contested case hearing; (B) Provide an opportunity for the provider or MCE and OPI to review the information, correct any misunderstanding of facts, and understand the reason for the action that is the subject of the contested case hearing; or (C) Determine if the parties wish to have witness subpoenas issued when the contested case hearing is conducted. (b) Prior to the date of the contested case hearing, the provider may request additional informal conferences with OPI representatives. The request must be made in writing to the Administrator. A second informal conference may be granted at the sole discretion of the Administrator if the second informal conference is determined to facilitate the contested case hearing process or resolution of disputed issues; (c) The contested case hearing shall be held in Salem, unless otherwise stipulated to by OPI; (d) The OAH shall serve a proposed order on behalf of OPI unless the Administrator notifies the parties that OPI will issue the final order. The proposed order shall become the final order if no exceptions are filed within the time specified in this rule; (e) The provider or MCE may file exceptions or written argument to the proposed order to be considered by OPI. The exceptions must be in writing and received by OPI within 10 calendar days after the date the proposed order is issued. No additional evidence may be submitted. After receiving the exceptions or argument, OPI may adopt the proposed order as the final order, amend the order, or prepare a new order; (f) A provider or MCE may withdraw a contested case hearing request at any time. The OAH will send a final order confirming the withdrawal to the provider pursuant to OARs 137-003-0670 to 137-003-0672. (15) If the provider, MCE, or legal representative fail to appear at the contested case hearing, OPI may elect one of the following options at its sole discretion: (a) The contested case hearing request may be dismissed by order. The Administrator may cancel the dismissal order upon request of the provider, MCE, or legal representative. The provider or MCE must be able to show evidence that the provider, MCE, or legal representative was unable to attend the hearing and unable to request a postponement for reasons beyond the provider’s or MCE’s control; (b) OPI may enter a final order by default when the Administrator determines that the issuance of a final order with findings is appropriate as a basis of sanction authority or to establish a basis for future sanction authority or other reason consistent with the administration of the Authority or DHS programs. The designated record, for purposes of a default order, will be the record as designated in the notice issued to the provider or MCE. If not so designated, the designated record will consist of the files and records held by OPI in the contested case hearing packet prepared by OPI. (16) Final orders are effective immediately upon being signed or as otherwise specified in the order. (a) Final orders resulting from a provider’s or MCE’s withdrawal of a contested case hearing request is effective the date the provider’s or MCE’s request is received by OPI or the OAH, whichever is sooner. (b) When the provider, MCE, or legal representative fails to appear for the contested case hearing, the effective date of the dismissal order or the final order by default is the date of the scheduled contested case hearing. (17) The burden of presenting evidence to support a fact or position in an administrative review or a contested case hearing rests on the provider and MCE. All copies of documentation and records submitted by a provider or MCE for an appeal are provided at the provider’s or MCE’s expense. (18) The Administrator, in consultation with the Authority or DHS Director, may grant the provider or MCE the relief sought at any time. (19) For providers furnishing or supplying items or services to or on behalf of Medicaid members enrolled in an MCE, overpayments shall be paid by the MCE within 30 calendar days from the postmark date or email sent date of the final audit report: (a) The MCE may submit a request to OPI for a modified payment plan as provided in section (20) of this rule to satisfy this requirement; (b) The Authority shall recoup from future MCE payments up to the amount of the overpayment and any applicable interest. The auditor and OPI management may not waive this overpayment requirement; (c) MCE recovery of overpayments made by the MCE to the applicable provider must comply with any MCE contractual requirements. MCEs’ internal overpayment recovery practices are not covered by this rule. (20) Overpayments shall be paid within 30 calendar days from the postmark date or email sent date of the final audit report. The provider or MCE may submit a request to OPI for a payment plan to satisfy this requirement. The auditor and OPI management may not waive this overpayment requirement: (a) A request for an administrative review or contested case hearing will not change the date the overpayment is due, or a payment plan is to commence, unless otherwise stipulated in writing by the Administrator. OPI will make any change in the reimbursement period or terms in writing: (A) The request for a payment plan or to modify an existing payment plan must be made in writing to OPI. The auditor or OPI management will notify the provider or MCE, in writing, of the decision regarding acceptance or denial of the request; (B) If the payment plan is agreeable, the auditor will ensure the payment plan is in writing and signed by all parties. A payment plan may include charging interest at the allowable state rate pursuant to ORS 82.010. (b) If the provider or MCE refuses to reimburse the overpayment or does not adhere to an agreed upon payment schedule, OPI may take one or more of the following actions: (A) Recoup future payments up to the amount of the overpayment and any applicable interest; (B) Pursue civil action to recover the overpayment and any applicable interest; (C) Refer to Department of Revenue for collection; (D) Recoup the overpayment through other methods pursuant to the provider’s or MCE’s contract or agreement with the Authority or DHS; or (E) Recommend suspension or termination of the provider’s enrollment in Authority or DHS medical programs and the Authority assigned provider number in the Oregon Medicaid Program. This action may be reported by the Authority to CMS, or other federal or state entities as appropriate. (c) As a result of a contested case hearing or an administrative review, the amount of the overpayment may be reduced in part or in full; (d) OPI may at any time decrease the amount of the overpayment in accordance with this rule. The provider or MCE will be notified of any changes in writing by secure encrypted email, certified or registered mail. OPI will refund the provider or MCE any monies paid to OPI in excess of the overpayment; (e) If a provider is terminated from participation in Authority or DHS programs or sanctioned for any reason, OPI may pursue civil action to recover any amounts due and payable, to include any applicable interest; (f) The provider or MCE may be liable for up to triple the total overpayment amount of the current final audit report when: (A) The auditor, in the course of an audit, discovers the provider employs the same or similar improper billing practices as previously identified in a preceding final audit report published by the OPI; (B) The provider has previously been warned in writing by the Authority, DHS, Centers for Medicare and Medicaid (CMS) or their designee, or the Department of Justice (DOJ) of the same or similar improper billing practices. (21) Providers and MCEs who conduct electronic data transactions with the Authority or DHS must adhere to requirements of OARs 943-120-0100 to 943-120-0200 and OARs 407-120-0100 to 407-120-0200. If the provider maintains financial or clinical records electronically, the provider must ensure the use of electronic record keeping systems does not alter the requirements of OARs 410-120-1360 and OAR 407-120-0370: (a) When the provider maintains financial or clinical records electronically, the provider must be able to provide OPI with hard copy versions, upon request. The provider must also be able to provide an auditable means of demonstrating the date the record was created, the identity of the creator of a record, the date the record was modified, what was modified in the record, and the identity and credentials of any individual who has modified the record. The provider must supply the information to individuals authorized to review the provider's records pursuant to OAR 410-120-1360 and OAR 407-120-0370. (b) If the provider maintains records electronically or permits the use of electronic signatures, the provider must document any aspect of the provision of services. The provider must maintain appropriate safeguards to assure the authenticity of the electronic records and signatures. (A) The provider is not allowed to challenge the authenticity or admissibility of the electronic signature in any audit, review, hearing, or other legal proceeding. (B) The provider is not allowed to challenge the authenticity or admissibility of the electronic documents and records due to internal transaction or operation failures of a provider’s or its billing entity's electronic record system in any audit, review, hearing or other legal proceeding. (c) Providers must comply with the documentation review requirements in OAR 410-120-1360 and OAR 407-120-0370 by providing the electronic record in a secure Health Insurance Portability and Accountability Act (HIPAA) compliant electronic format acceptable to an authorized reviewer. Provider’s electronic records must be made available within the audit timeframes in this rule and at the providers’ expense. The authorized reviewer must agree to receive the documentation electronically.