By: Bret S. Bissey, MBA, FACHE

For the last two articles I have written for the RAC Monitor, we presented a thesis that the elements of a Model Compliance Program, as detailed to us on numerous occasions by the Department of Health and Human Services, Office of Inspector General's office, does provide to healthcare providers an appropriate structure from which to prepare for RAC. As a refresher, the seven elements of a model compliance program are as follows:

• Designation of a compliance officer and compliance committee;
• Development of compliance policies and procedures, including standards of conduct;
• Development of open lines of communication;
• Appropriate training and education;
• Internal monitoring and auditing;
• Response to Detected Deficiencies
• Enforcement of disciplinary actions

I am asked frequently, "which is most important element" or "do I really need to complete all elements." My responses include that I don't think you can say that one element is always most important and certainly "yes" you need to address each element or you are opening your organization up for increased risk. Having said this, I must comment that a very important element for all of your compliance efforts is always your ability to do accomplish effective internal monitoring and auditing.

Auditing/Monitoring and RAC

For those of us assigned to manage or prepare our organizations for RAC, one of things that keep us "up at night" is asking the question, "how much risk do we have with RAC?" Like with all risk areas the way to answer the question with clarity and a sense of validation is to perform an assessment.

This does not just apply to healthcare but many other areas of life as well. Has anyone added a teenage driver to their insurance policy lately? Your coverage rates increase significantly because the insurance company knows (statistically based upon data) that there is an increased likelihood of a traffic accident occurring with this driver on your policy. In order for the insurance company to make that determination regarding how much risk that young driver presents they need to perform an assessment of their historical claims data.

Back to healthcare and RACS - one of the methods that healthcare systems are adopting to assess their RAC risk is to perform audits. When performing audits there are a number of different factors to consider (sample size, focus, who is the auditor, review time period, etc...).

What Are You Doing?

I would suggest, however, that before those items are addressed in your organization you need to answer a very important question; "what are you going to do with your audit results?" Many organizations understand that via their contract with Medicare called the "Conditions of Participation" and their Compliance Program framework that if they find (have knowledge of) a billing inconsistency or claims that don't comply with the Medicare rules that they must repay the owed monies and put a process in place to assure correct claims are being submitted in the future.

Understanding this requirement, some organizations and many in the legal profession routinely advise that when performing audits, whose findings may potentially present a financial risk to the organization, that the practice of engaging the audit through an attorney who represents the organization be considered. This is called "Attorney-Client Privilege." When performing RAC or other audits we are routinely asked our opinion of this concept, we consistently respond that this is a matter you should discuss with your Counsel.