14.4 Healthcare Fraud, Abuse Laws, Audits & AHIMA Ethical Standards

Healthcare Fraud, Abuse Laws, Audits & AHIMA Ethical Standards

AHIMA CCS Exam Focus: Regulatory compliance, legal integrity, and ethical standards are tested within Domain IV, which the current CCS outline weights at 18–22% of scored content. Candidates must demonstrate deep knowledge of the False Claims Act (FCA) (including the "knowing" standard, treble damages, and qui tam suits), the Anti-Kickback Statute (AKS), the Stark Law, the OIG Work Plan, MAC Targeted Probe and Educate (TPE), Recovery Audit Contractors (RACs), and the AHIMA Standards of Ethical Coding.

---

1. Statutory Fraud and Abuse Legal Frameworks

Healthcare fraud and abuse statutes protect the financial integrity of federal healthcare programs (Medicare, Medicaid, TRICARE) and ensure patient safety by penalizing improper billing, illegal financial arrangements, and deceptive coding practices.

                     The Federal Fraud & Abuse Triad
                                    │
        ┌───────────────────────────┼───────────────────────────┐
        ▼                           ▼                           ▼
False Claims Act (FCA)      Anti-Kickback Statute (AKS)   Stark Law (Self-Referral)
• 31 U.S.C. § 3729          • 42 U.S.C. § 1320a-7b(b)    • 42 U.S.C. § 1395nn
• Civil liability           • Criminal Felony             • Strict Liability Civil
• "Knowing Standard"        • "Knowing & Willful"         • No Intent Required
• Treble Damages + Fines    • Remuneration for Referrals  • Referrals for DHS
• Qui Tam / Whistleblowers  • Prison + Mandatory Exclusion• Payment Denial + Fines

1. The False Claims Act (FCA) (31 U.S.C. §§ 3729–3733)

Originally enacted during the American Civil War (the "Lincoln Law") to combat military contractor fraud, the False Claims Act is the primary statutory weapon used by the Department of Justice (DOJ) to prosecute healthcare billing and coding fraud.

• Prohibited Conduct: Knowingly presenting, or causing to be presented, a false or fraudulent claim for payment or approval to the federal government; or knowingly making or using a false record or statement material to a false claim.
• The Statutory "Knowing" Standard (31 U.S.C. § 3729(b)):
  • A person acts "knowingly" if they:
    1. Have actual knowledge of the information;
    2. Act in deliberate ignorance of the truth or falsity of the information; or
    3. Act in reckless disregard of the truth or falsity of the information.

  • Critical Legal Rule for the CCS Exam: The government is NOT required to prove specific intent to defraud. Actual knowledge, deliberate ignorance, or reckless disregard can satisfy the FCA standard; a mere mistake or ordinary negligence does not automatically do so.

• Penalties:
  • Treble Damages: Three times the total amount of damages sustained by the federal government.
  • Civil Monetary Penalties: An inflation-adjusted penalty applies per violation in addition to treble damages; verify the DOJ amount effective on the assessment date rather than memorizing a stale range.
• Qui Tam (Whistleblower) Provisions:
  • Allows private individuals (known as "Relators"—frequently medical coders, CDI specialists, compliance officers, or nurses) to file civil lawsuits on behalf of the United States.
  • Whistleblowers are legally entitled to receive 15% to 30% of the total funds recovered by the government, alongside statutory protection against employer retaliation (31 U.S.C. § 3730(h)).

2. The Anti-Kickback Statute (AKS) (42 U.S.C. § 1320a-7b(b))

• Nature: A criminal felony statute prohibiting the knowing and willful solicitation, receipt, offer, or payment of any remuneration (direct or indirect, overt or covert, in cash or in kind) to induce or reward patient referrals or generate business reimbursable under federal healthcare programs.
• Penalties:
  • Criminal fines up to $100,000 and up to 10 years imprisonment per violation.
  • Mandatory exclusion from participation in Medicare, Medicaid, and all federal healthcare programs.
  • Civil monetary penalties and assessments may also apply; current amounts are inflation-adjusted and should be verified for the enforcement date.
  • Statutory Link: Under the ACA, any claim resulting from an AKS violation automatically constitutes a false claim under the False Claims Act.
• Safe Harbors: Regulatory exceptions (e.g., fair market value space rental, bona fide employment relationships, investment interests in large publicly traded entities) that protect legitimate commercial arrangements from AKS prosecution.

3. The Physician Self-Referral Law (Stark Law) (42 U.S.C. § 1395nn)

• Nature: A civil, strict-liability statute prohibiting physicians from making referrals for DHS payable by Medicare for Designated Health Services (DHS) to an entity with which the physician (or an immediate family member) has a direct or indirect financial relationship (ownership, investment, or compensation arrangement), unless a specific statutory exception applies.
• Strict Liability Standard: Unlike the AKS, Stark Law requires NO proof of intent, knowledge, or willfulness. Intent is not an element of the referral and billing prohibitions, but whether an arrangement is non-compliant still depends on the statute, regulations, and available exceptions.
• Designated Health Services (DHS) Include:
  • Inpatient and outpatient hospital services
  • Clinical laboratory services
  • Physical therapy, occupational therapy, and speech-language pathology
  • Radiology and certain other imaging services (MRI, CT, PET)
  • Radiation therapy services and supplies
  • Durable medical equipment (DME) and prosthetics/orthotics
  • Home health services and outpatient prescription drugs
• Penalties: Mandatory denial and refund of all claims billed in violation of Stark; civil monetary penalties; and False Claims Act liability if claims are submitted knowingly.

                    Comparative Fraud & Abuse Matrix
  ┌─────────────────────┬───────────────────────────┬───────────────────────────┐
  │ Feature             │ Anti-Kickback Statute     │ Stark Law                 │
  ├─────────────────────┼───────────────────────────┼───────────────────────────┤
  │ Scope of Law        │ Criminal Felony + Civil   │ Civil Statute Only        │
  │ Intent Requirement  │ "Knowing and Willful"     │ Strict Liability (NO intent)│
  │ Covered Referrals   │ Federal-program business │ Referrals from PHYSICIANS │
  │ Covered Services    │ ANY federal program items │ Designated Health Services│
  │ Legal Exceptions    │ Voluntary Safe Harbors    │ Mandatory Exceptions      │
  │ Incarceration Risk  │ Up to 10 years in prison  │ None (Civil monetary only)│
  └─────────────────────┴───────────────────────────┴───────────────────────────┘

---

2. Federal Healthcare Audit Programs and Oversight Entities

Hospitals and healthcare systems operate under constant surveillance by multiple overlapping federal audit bodies:

                         Federal Audit Architecture
                                     │
       ┌──────────────────────┬──────┴──────────────┬──────────────────────┐
       ▼                      ▼                     ▼                      ▼
Office of Inspector     Medicare Administrative   Recovery Audit         Unified Program
General (OIG)           Contractors (MACs)        Contractors (RACs)     Integrity Contractors
• HHS-OIG Work Plan     • Targeted Probe &        • Contingency fees     • Suspected Fraud
• Annual Risk Priorities  Educate (TPE)            • Complex & Automated  • Law Enforcement
• Corporate Integrity   • 3 Probe Rounds          • Look-back Limits     • Payment Suspensions

1. Office of Inspector General (OIG)

Operating under the Department of Health and Human Services (HHS), the OIG protects the integrity of HHS programs. The OIG publishes the monthly/annual OIG Work Plan, which alerts coding professionals to high-risk audit targets:

• Inpatient upcoding of severe malnutrition (Kwashiorkor E40 and Marasmus E41)
• High-complexity MS-DRG upcoding (e.g., Sepsis with MCC vs. simple UTI)
• Outpatient hyperbaric oxygen therapy and cardiac catheterization unbundling
• Modifier 25 and Modifier 59 overutilization on surgical claim lines
• Two-Midnight rule compliance and observation vs. inpatient stay status

2. Medicare Administrative Contractors (MACs) & Targeted Probe and Educate (TPE)

MACs are private companies contracted by CMS to process Medicare claims and conduct medical review. Under the Targeted Probe and Educate (TPE) program, MACs focus on providers with high claim error rates or unusual billing patterns:

• Round 1: MAC selects 20 to 40 claims for prepayment or postpayment review, followed by 1-on-1 clinician/coder education.
• Round 2: If error rates remain elevated after 45 days of corrective action, a second 20–40 claim probe is initiated.
• Round 3: Continued non-compliance triggers a third probe. Continued high error rates after Round 3 lead to referral to CMS, which may consider further action such as additional review, extrapolation, payment suspension, or a program-integrity referral.

3. Recovery Audit Contractors (RACs)

Established by the Medicare Modernization Act of 2003, RACs are private auditing organizations that operate on a contingency fee basis (retaining a percentage of recovered overpayments and underpayments):

• Automated Reviews: Computerized edits identifying clear coding/billing errors (e.g., MUE breaches, unbundling, billing duplicate lines).
• Complex Reviews: Require human medical record analysis to verify medical necessity, coding validity, and DRG assignment.

4. Unified Program Integrity Contractors (UPICs) & CERT

• UPICs: Investigate suspected fraud, waste, and abuse, perform record review and other program-integrity work, and refer appropriate matters or recommend administrative actions. CMS or law-enforcement authorities—not the contractor itself—impose payment suspensions or pursue civil or criminal enforcement.
• Comprehensive Error Rate Testing (CERT): Measures the national Medicare fee-for-service improper payment rate by randomly sampling claims to evaluate payment accuracy.

---

3. AHIMA Standards of Ethical Coding

First established by the American Health Information Management Association (AHIMA) and updated to reflect modern digital environments, the Standards of Ethical Coding govern the professional conduct of all credentialed coding specialists (CCS, CCS-P, CCA, RHIA, RHIT).

                   AHIMA Standards of Ethical Coding: Core Tenets
  ┌─────────────────────────────────────────────────────────────────────────────────┐
  │ 1. Quality & Data Integrity: Apply accurate, complete, consistent coding rules. │
  ├─────────────────────────────────────────────────────────────────────────────────┤
  │ 2. Anti-Optimization: Refuse to alter codes solely to maximize reimbursement.   │
  ├─────────────────────────────────────────────────────────────────────────────────┤
  │ 3. Unbundling & Upcoding Prohibition: Never report unsupported or split codes.  │
  ├─────────────────────────────────────────────────────────────────────────────────┤
  │ 4. Compliant Query Practice: Follow non-leading AHIMA/ACDIS query standards.     │
  ├─────────────────────────────────────────────────────────────────────────────────┤
  │ 5. Confidentiality: Safeguard protected health information (PHI) under HIPAA.   │
  ├─────────────────────────────────────────────────────────────────────────────────┤
  │ 6. Professional Competence: Maintain ongoing coding education and CEUs.         │
  ├─────────────────────────────────────────────────────────────────────────────────┤
  │ 7. Professional Resistance: Formally refuse unethical/illegal employer demands. │
  └─────────────────────────────────────────────────────────────────────────────────┘

High-Yield Ethical Coding Principles for the CCS Exam

1. Principle 1 (Accurate Application): Apply accurate, complete, and consistent coding practices that yield quality health data according to official ICD-10-CM/PCS, CPT, and HCPCS Level II coding guidelines.
2. Principle 2 (Data Integrity vs. Revenue): Code assignment must be supported by the health record and the official rules governing which provider or other clinician documentation may supply each code detail. A coding professional must never manipulate code selection, omit secondary conditions, or fabricate complications to meet financial targets or increase MS-DRG/APC reimbursement.
3. Principle 3 (Refusal of Non-Compliant Demands): Coding professionals have an affirmative ethical and legal duty to refuse to participate in or conceal unethical coding practices, including upcoding, unbundling, or failing to report required codes, even when instructed to do so by hospital leadership, supervisors, or physicians.
4. Principle 4 (Objective Queries): Provider queries must be initiated solely to resolve ambiguity, conflict, or clinical vagueness—never to inappropriately steer a provider toward an MCC or CC diagnosis.