A Matter of Law: Managed Care Record Audits

by Legal and Regulatory Affairs Staff

Imagine getting a notice from a managed care organization (MCO) that the company is auditing your records of their health plan subscribers. If that weren’t enough cause for anxiety, what if after the audit the MCO demands that you refund a portion of the money that they paid to you?

A major source of discomfort in facing such an audit is uncertainty about your rights, how the process works and how you should respond. This article addresses common issues you should know about as an MCO audit begins, and other issues to know about if the company seeks a refund.

Since MCOs must comply with the Health Insurance Portability and Accountability Act (HIPAA), audits raise HIPAA Privacy Rule concerns. For example, if you keep separate psychotherapy notes as defined by the Rule the company cannot ask for those notes. The company also cannot attempt to coerce your patient into providing an authorization to release psychotherapy notes by threatening to withhold treatment or payment.

In addition, whether or not you keep psychotherapy notes, the company must follow the “minimum necessary” rule, seeking only those records necessary to accomplish the purpose of the audit. For example, if the audit focuses on whether you actually saw a patient on particular dates for which you were paid, you could claim that the company does not need to see anything further than your records involving the specified dates.

While the HIPAA Privacy Rule may narrow the range of records that you can release for the audits, a few state laws such as New Jersey’s Peer Review Statute, as well as the District of Columbia’s privacy law, provide even stronger privacy protections that will further narrow the information you can release.

For more details on the HIPAA Privacy Rule, see the Privacy Rule section.

Once you have determined what records you can release, the next question is whether you have adequate consent from the patient to release those records. This is generally a question of state law governing consent.

Under applicable state law, consent may be satisfied by the consent form that the psychologist had the patient sign at the start of treatment, or by a consent that the patient signed when applying for health insurance with the MCO. It is important to make certain that the provisions of the consent form you used are sufficient to cover an audit. For example, a consent form may cover future disclosures for obtaining payment or consultations with other health professionals, but not be broad enough in scope to cover an audit. With regard to the health insurer’s consent form, the MCO may claim to have the patient’s consent but be unable to provide you with a copy.

If you are uncertain about the adequacy of either your prior consent form or the company’s form, and you are able to contact the patient, you may wish to do so and obtain the patient’s consent for releasing records for the audit. You should not release the records if you do not believe that you have adequate consent from the patient.

Issues Concerning Refund Demands

In some cases, the audit may result in the MCO writing you a letter asking you to refund money to the company from the amounts that they reimbursed you. This will raise additional issues, including those discussed below.

Any demand letter from an MCO should explain to you clearly the basis for the company’s refund demand. It should explain exactly how the MCO calculated the dollar amount, and may include a spreadsheet that details the individual claims that went into the calculation. If these aspects are unclear, you should ask the company for clarification.

A common refund demand is based on the claim that the health care professional’s records were inadequate, such as the demands made by Oxford Health Plans in 2003.

In this situation, the company does not dispute that you actually performed the services claimed; it simply contends that your recordkeeping for those services was inadequate. For example, the MCO may claim that you did not record sufficient details for a number of sessions.

If your MCO demands a refund based on inadequate recordkeeping, you should review your provider contract, your provider manual, and applicable state law for the following issues. If favorable to you, any of the following factors may be used to argue against an MCO’s claim for a refund:

• Does the company clearly state what type of records it expects psychologists to keep? (Note that in some cases, the record keeping guidelines are directed at physicians and may not apply to psychologists.) 
• If the company claims that notes from particular sessions were not sufficient, did the company make clear what it expected the psychologist to record for each session? 
• If the company did not give clear record keeping guidance, what does your state require? Do your records meet that standard? 
• What does your provider contract or provider manual say will happen if records are not adequate? Does the contract specifically make your reimbursement dependent on adequate record keeping? (If not, you can argue that your reimbursement was not contingent on the content of your record keeping.) Does the provider contract allow the company to demand refunds for claims of record deficiencies? 
• Note that state law may be helpful for practitioners. For example, the New York HMO law requires the HMO to specify in its provider contract the methods the company would use to adjust payment, which is arguably what they are doing in demanding a refund for inadequate record keeping. 
• Remember that if you choose to keep detailed records in your psychotherapy notes, apart from your general clinical records, the MCO is not entitled to these notes. The company should not be able to penalize you for not having details in your clinical record that you have properly protected in your psychotherapy notes.

In Medicare and Medicaid, regulations often allow auditors to extrapolate from the audited sample of claims across a much larger volume of reimbursement payments. For example, if the auditors sample 10 claims and believe that two of the claims should not have been paid, they can then demand a refund for 20 percent of prior payments over a certain period of time.

However, those regulations do not apply to the private sector. Therefore, an MCO dealing with private sector claims would have to rely on its contractual agreement (its provider contract with you) for the right to extrapolate. Many provider contracts have no provision allowing the company to extrapolate.

If you have further questions about audits, please contact the Practice Directorate’s Office of Legal & Regulatory Affairs. We are particularly interested in hearing from you if you think a company auditing you is violating your provider contract, HIPAA or state law.

This article is the seventh in a series, “A matter of law,” about the practical effect of various laws and regulations on practicing psychologists.

PLEASE NOTE: Legal issues are complex and highly fact-specific and require legal expertise that cannot be provided by any single article. In addition, laws change over time. The information in this article should not be used as a substitute for obtaining personal legal advice and consultation prior to making decisions regarding individual circumstances.