OIG Can Examine Cybersecurity and Internal Controls in Medicare Financial Management: Part VI

EDITOR’S NOTE: Edward Roche, in association with RACmonitor, is writing a series on the need for U.S. healthcare facilities to protect themselves from cybercriminals demanding ransoms for patient records. This is the sixth installment in this series.

Cybersecurity audits now are becoming an integral part of the internal control requirements in the Medicare Financial Management Manual (MFMM).

Under the Federal Managers’ Financial Integrity Act of 1982 (FMFIA) (P.L. 97-255), Section 113 of the Accounting and Auditing Act of 1950 (31 U.S.C.66a) will be changed so that “each executive agency … shall provide reasonable assurance that … (their) systems of internal accounting and administrative control fully comply” with guidelines established by the Director of the Office of Management and Budget “in consultation with the Comptroller General.” 

In the MFMM, Section 10.1.2, these requirements apply to all Centers for Medicare & Medicaid Services (CMS) contractors and healthcare providers because there is an article in their agreements with CMS “to cooperate … in the development of procedures permitting CMS to comply with FMFIA.” Also, the “Medicare Administrative Contractor (MAC) … Statements of Work” specify that “the contractor shall establish and maintain efficient and effective internal controls.” 

The essence of this burdensome and convoluted language is that all Medicare contractors are required to follow internal control procedures that are approved by CMS. These are specified in Chapter 7 of the MFMM, in which information and communications are listed as being one of the “five interrelated standards” for internal control (§10.2.3).

Cybersecurity Auditing

“CMS conducts … information technology (IT) audits … to provide reasonable assurance that contractors have developed and implemented internal controls,” this language goes on to read (§40). “Information technology (IT) audits … include network vulnerability assessment (and) security testing (NVA/ST), (including) OIG information technology (IT) controls” (§40¶2.1,3).

“All contractors are required to certify their system security compliance (and) …should write a few paragraphs to self-certify that their organization has successfully completed all required security activities, including the security self-assessment of their Medicare IT systems and associated software in accordance with the terms of their contract,” this passage continues (§20.1). “Access to significant computerized applications … (must be) appropriately authorized.”

The U.S. Department of Health and Human Services (HHS) Office of Inspector General (OIG) has clear authority to investigate and audit cybersecurity problems, even if this has not been an element of its responsibility in the past.

This is because HHS OIG has a broad mandate to prevent fraud and abuse, and to promote economy, efficiency, and effectiveness. For example, it has the authority to identify “systemic weaknesses giving rise to opportunities for fraud and abuse in HHS programs and operations.” Since much “systemic weakness” can come from the information systems that operate within every healthcare provider, this would include a look at cybersecurity.

The Office of Investigations (OI) is tasked with ensuring “that policies and procedures are followed effectively, and are functioning as intended.” (Ibid, §QJ.20) It also “coordinates the adoption of advanced digital forensic acquisition and examination and information security technologies to assist in the investigation …  of fraud and abuse.”

It appears that the OIG can audit to ensure that cybersecurity is sound. It also has the power to develop “standards governing the imposition of … exclusion.” Therefore, it is entirely reasonable that a healthcare provider involved with Medicare could be audited if its cybersecurity fell below the standards that are set in FMFIA and related statutes, and possibly excluded.

There was consideration given in the past to setting cybersecurity standards, and it was put to the side. However, with the recent wave of ransomware attacks and the exposure of other IT vulnerabilities, we might expect a more aggressive auditing effort in this area in the future.

We can expect much more audit risk in the future, and we will continue to discuss these new audits in future installments of this RACmonitor series.

Print Friendly, PDF & Email
Facebook
Twitter
LinkedIn

Edward M. Roche, PhD, JD

Edward Roche is the director of scientific intelligence for Barraclough NY, LLC. Mr. Roche is also a member of the California Bar. Prior to his career in health law, he served as the chief research officer of the Gartner Group, a leading ICT advisory firm. He was chief scientist of the Concours Group, both leading IT consulting and research organizations. Mr. Roche is a member of the RACmonitor editorial board as an investigative reporter and is a popular panelist on Monitor Mondays.

Related Stories

Leave a Reply

Please log in to your account to comment on this article.

Featured Webcasts

Leveraging the CERT: A New Coding and Billing Risk Assessment Plan

Leveraging the CERT: A New Coding and Billing Risk Assessment Plan

Frank Cohen shows you how to leverage the Comprehensive Error Rate Testing Program (CERT) to create your own internal coding and billing risk assessment plan, including granular identification of risk areas and prioritizing audit tasks and functions resulting in decreased claim submission errors, reduced risk of audit-related damages, and a smoother, more efficient reimbursement process from Medicare.

April 9, 2024
2024 Observation Services Billing: How to Get It Right

2024 Observation Services Billing: How to Get It Right

Dr. Ronald Hirsch presents an essential “A to Z” review of Observation, including proper use for Medicare, Medicare Advantage, and commercial payers. He addresses the correct use of Observation in medical patients and surgical patients, and how to deal with the billing of unnecessary Observation services, professional fee billing, and more.

March 21, 2024
Top-10 Compliance Risk Areas for Hospitals & Physicians in 2024: Get Ahead of Federal Audit Targets

Top-10 Compliance Risk Areas for Hospitals & Physicians in 2024: Get Ahead of Federal Audit Targets

Explore the top-10 federal audit targets for 2024 in our webcast, “Top-10 Compliance Risk Areas for Hospitals & Physicians in 2024: Get Ahead of Federal Audit Targets,” featuring Certified Compliance Officer Michael G. Calahan, PA, MBA. Gain insights and best practices to proactively address risks, enhance compliance, and ensure financial well-being for your healthcare facility or practice. Join us for a comprehensive guide to successfully navigating the federal audit landscape.

February 22, 2024
Mastering Healthcare Refunds: Navigating Compliance with Confidence

Mastering Healthcare Refunds: Navigating Compliance with Confidence

Join healthcare attorney David Glaser, as he debunks refund myths, clarifies compliance essentials, and empowers healthcare professionals to safeguard facility finances. Uncover the secrets behind when to refund and why it matters. Don’t miss this crucial insight into strategic refund management.

February 29, 2024
2024 ICD-10-CM/PCS Coding Clinic Update Webcast Series

2024 ICD-10-CM/PCS Coding Clinic Update Webcast Series

HIM coding expert, Kay Piper, RHIA, CDIP, CCS, reviews the guidance and updates coders and CDIs on important information in each of the AHA’s 2024 ICD-10-CM/PCS Quarterly Coding Clinics in easy-to-access on-demand webcasts, available shortly after each official publication.

April 15, 2024

Trending News

Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →

SPRING INTO SAVINGS! Get 21% OFF during our exclusive two-day sale starting 3/21/2024. Use SPRING24 at checkout to claim this offer. Click here to learn more →