January 1, 2014 is fast approaching and regulators, payor organizations, providers, and many other in- terested parties are working to implement, opera- tionalize, and participate in the state-based American Health Benefit Exchanges and Small Business Health Options Program (‘‘SHOP’’) Exchanges (the ‘‘Exchanges’’).

Many aspects of the Exchanges and the related pro- grams created under the Patient Protection and Afford- able Care Act¹ (‘‘ACA’’) will present new challenges to the parties involved. In particular, the risk adjustment programs to be implemented in each state will present many challenges for health plans and providers.

Implementing and operating a risk adjustment pro- gram requires significant effort by all parties involved: (i) regulators need to create clear standards setting forth what data and supporting documentation will be required; (ii) health plans need to establish ways to col- lect, analyze, and validate the required data; (iii) provid- ers need to learn how to provide the types of data and information health plans require; and (iv) consultants who assist health plans and providers need to under- stand and operationalize the new standards.

Luckily for all interested parties, the Medicare Advantage risk adjustment program, referred to as the CMS-HCC system,² has been operating for several years and practices under that program can offer in- sight into the legal and business risks inherent in risk adjustment.

Medicare Advantage case law provides a warning that the government and relators will use various legal theories to claim that plans and providers operating in the risk adjustment program have violated the law. Government audit practices also indicate that incomplete or inaccurate documentation can lead to plans re- funding hundreds of millions of dollars.

Following a brief introduction to risk adjustment systems in general, this article discusses (i) the federally designed risk adjustment program in which small group and individual insurance plans will operate as a result of ACA, (ii) legal and financial risks facing plans under the ACA risk adjustment program, and (iii) operational and contractual strategies for success within the risk adjustment program.

I. What is Risk Adjustment?

Risk adjustment is a methodology used to adjust payments to health plans based on the demographics and health care status of the population insured by the plans. Without a risk adjustment system, health plans that insure higher risk and more costly individuals would receive the same capitated payments as those health plans that insure patients that have, on average, fewer and less costly health conditions. Risk adjustment systems are currently used by Medicare Advantage and some state Medicaid programs.

Risk adjustment systems require the establishment of many standards, including: (i) what data will be used, (ii) who can provide the data, (iii) how the data can be proven or validated, (iv) how the data will be communi- cated to the system, and (v) how payments to health plans will be impacted by the data.

Risk adjustment systems typically require medical records and claims/encounter data to be organized and collected for all individuals who are enrolled in a health plan in a specific market. A risk adjustment methodology then converts the data into risk scores for all individuals. Payments from the government to health plans are then adjusted based on either each individual’s risk score or the health plan’s total risk score as compared to other plans in a given market.

II. Risk Adjustment Under the Affordable Care Act

The ACA requires that non-grandfathered individual and small group health plans, inside and outside of the Exchanges,3 operate in statebased risk adjustment programs effective January 1, 2014. States can either elect to establish and operate their own risk adjustment program,⁴ which must be approved by the Department of Health & Human Services (‘‘HHS’’), or allow the federal government to operate a risk adjustment program on the state’s behalf. Federally operated risk adjustment programs will implement the risk adjustment methodology that has been adopted by HHS through regulations. All of the states, except for Massachusetts, have elected to operate under the federal risk adjustment program.

The ACA risk adjustment program will provide payments to health plan issuers that attract higher risk populations by transferring funds to them from plans that enroll lower risk individuals. Such transfers are intended to reduce or eliminate premium differences among plans based solely on favorable or unfavorable risk selection in the individual and small group markets. Through the program, a plan’s risk profile is evaluated against that of other plans offered within that plan’s state and within that plan’s market.⁵

Similar to the CMS-HCC system, the ACA risk adjustment program calculates individuals’ risk scores based on demographics and health status. Health status is established through diagnosis codes reported by providers to plans, and by plans to HHS. Only diagnoses that the government has determined impact costs affect an individual’s risk score and the payment a plan will receive.

Also, importantly, diagnostic information is only acceptable for risk adjustment purposes if it is reported by certain types of providers for care provided in certain types of settings. For example, a hospital record that reports that an individual has diabetes is acceptable for risk adjustment, whereas, a pharmacy claim showing that an individual filled a prescription for insulin is not acceptable. Understanding the importance of accurate, acceptable data and operationalizing how to obtain and report such data is critical to succeed within a risk adjustment environment.

The ACA risk adjustment program will calculate risk scores concurrently, meaning that an individual’s medical visits, claims, and demographics from plan year 2014 will be used to calculate his or her 2014 risk score. This differs from the CMS-HCC system that operates prospectively. Plans must make data available to HHS for purposes of calculating risk scores by April 30 of the year following the plan year. Health plan issuers will then learn by June 30 whether they will receive risk adjustment payments or be required to pay into the risk adjustment fund for issuers with higher risk scores. The adjustment methodology takes into account the need for inter-plan transfers to net zero.⁶ As a result, no federal money will be separately added to the system.

Finally, plans are subject to risk adjustment data vali- dation (‘‘RADV’’). HHS’s RADV model requires two levels of audits, first an audit by an independent third party paid for and selected by the plan issuer, and sec- ond, a government audit by HHS.⁷ HHS selects the sample to be audited and plans are not permitted to supplement documentation after the initial audit.⁸ The error rate determined through the government audit will be extrapolated to an issuer’s entire risk adjusted population.⁹

While plans must adhere to data validation require- ments in 2014 and 2015, HHS will not adjust payments based on the findings during the first two years as a re- sult of the complexity of the program and the uncer- tainty in the market.¹⁰

III. Legal and Financial Risks Under the ACA Risk Adjustment Programs

Plans that fail to comply with the ACA risk adjust- ment program requirements may be subject to civil monetary penalties and potentially face sizable finan- cial risk through RADV audits.

Additionally, two significant federal fraud and abuse laws, the Federal False Claims Act (the ‘‘FCA’’) and the Federal Anti-Kickback Statute (the ‘‘AKS’’), may apply to health plans and providers within the context of the ACA risk adjustment program.

A. Civil Monetary Penalties

On June 19, HHS proposed regulations that would al- low HHS to impose civil monetary penalties on plan is- suers that (i) substantially fail to comply with standards under the risk adjustment program (including access to and timely submission of data), or (ii) intentionally or recklessly misrepresent or provide false information to HHS or to an entity upon which HHS relies to evaluate a plan’s compliance with applicable standards. The maximum penalty is $100 per day, per individual affected by the plan’s non-compliance, and HHS may estimate the number of individuals affected.¹¹

B. RADV

Plan issuers’ compliance with data requirements will be evaluated through RADV audits. The findings and error rate from the second level of audit, which is conducted by HHS or HHS’s agent, will be extrapolated across a plan issuer’s entire risk adjusted population. Through this process, small documentation errors or omissions present in the audit sample can result in significant financial consequences for the issuer.

HHS has yet to provide guidance on the exact standards to be used under the RADV audits, but if it is ultimately similar to the audits and requirements under the CMS-HCC system, plans will face various challenges as they try to document their members’ health status.

C. The False Claims Act

Actions health plans and providers take, and arrange- ments they enter into, to produce and/or review medi- cal records and risk adjustment data can trigger FCA liability.

The government may initiate an FCA action if it alleges that a health plan’s or provider’s coding/medical review practices inaccurately reflect an enrollee’s health status, and the plan or provider either knows or should have known that it submitted inaccurate data to be used to assign risk scores. Whistleblowers and the government have sought to enforce the FCA against Medicare Advantage plans and providers based upon their risk adjustment practices.¹² Similarly, according to HHS, the FCA may govern risk adjustment practices under the ACA.

While HHS announced that it will not adjust pay- ments based on data validation findings conducted for 2014 and 2015, HHS did note that authorities outside of the HHS risk adjustment program, including prosecution under the FCA, may still apply to health plan conduct.13

In addition to considering risks associated with the FCA, health plans must consider similar state laws. Most states have false claims laws that apply to claims submitted to state health care programs. Many states also have insurance fraud laws that apply to claims submitted to private insurers.

D. The Anti-Kickback Statute

The government has been silent regarding whether it considers health plans that are offered through the ACA Exchanges to be ‘‘federal health care programs’’ and therefore it remains unclear whether the AKS applies to such plans and the arrangements into which they enter. Nonetheless, even if the AKS is entirely inapplicable to these plans, many states have laws similar to the AKS that may apply to the plans.

Finally, while utilizing the AKS safe harbors only im- munizes an arrangement from AKS violations, that an arrangement is structured to comply with a safe harbor can support the argument that the arrangement is for a legitimate and bona fide service and can therefore potentially reduce risks under other laws such as the FCA.

IV. Strategies for Success Within a Risk Adjustment Payment Program

In order to succeed within the ACA risk adjusted pay- ment system health plans must (i) educate their em- ployees and providers about the risk adjustment pro- gram standards, (ii) effectively contract with providers, (iii) implement meaningful quality assurance and audit programs, and (iv) properly engage coders and coding review services.

A. Education

Health plans should offer or encourage their employees and contracted providers to participate in educational sessions regarding the new ACA risk adjustment program and the importance of medical record accuracy. Employees should understand how the system operates, the types of information that are required, and how to properly communicate with providers when required information is not submitted.

Providers should also understand how the system operates and what is required of them. Educational sessions for providers are increasingly common with the adoption of electronic medical records and can offer an opportunity to educate providers regarding the extent to which accurate medical records can improve patient care and case management both by the provider and the health plan.

B. Effective Provider Contracting

The most important relationship within a risk adjusted system is that between the health plan and its providers. Because the information reported by provid- ers is at the heart of payment adjustments, health plans must engage providers in a manner that results in medical records that accurately reflect diagnoses and comply with risk adjustment program requirements.¹⁴ Contractual mechanisms used to incentivize providers to maintain accurate and complete medical records and to provide required data vary, as do the risks associated with them.

i. Capitated Providers

Capitated provider arrangements present an opportunity to incentivize providers to maintain complete and accurate medical records. An arrangement under which a provider receives a percentage of the risk adjusted premium automatically ties the provider’s reimbursement to his or her ability to provide accurate diagnoses in medical records. Offering or requiring attendance at educational sessions is important under these arrangements so that the provider understands the payment system, appreciates the importance of complete documentation, and recognizes how reimbursement is affected by such documentation.

In addition to standard capitation arrangements, health plans can potentially offer positive incentives or impose penalties based on the quality of a provider’s medical record documentation or consider increasing the percentage of premium a provider receives based on the health conditions of his or her patients.

ii. Fee-for-Service Providers

Many providers continue to contract with health plans on a fee-for-service (‘‘FFS’’) basis. FFS providers do not typically see their reimbursement increase based on the diagnoses they report because they are paid based on reported procedure codes. As a result, contracting with FFS providers in a way that produces medical records with complete diagnoses presents different challenges than capitated arrangements.

Alternative arrangements that can be utilized with FFS providers includes Payments Based on Audit Findings—Plans can of- fer a bonus or impose a penalty based on how a provider’s medical record accuracy rate compares to a contractually established error rates. Stricter Requirements for Reimbursement—Plans can require that only claims that include information about the patient, his or her history, conditions, and diagnoses are eligible for reimbursements. Intensive Physical Examinations—Plans can con- tract with FFS providers for comprehensive physical examinations that result in more accurate and complete medical records and data.

C. Meaningful Quality Assurance and Audit Programs

Health plans and providers should have an effective internal quality assurance and audit¹⁵ program in place to properly report data needed for risk adjustment and to reduce risks under applicable fraud and abuse laws. Cases brought against both health plans and providers under the Medicare Advantage program demonstrate that whether an entity has implemented a quality assurance program is a critical part of the government’s analysis.

The government has cited the following failures to support its theory that an entity ‘‘knowingly’’ violated the FCAs: 

• A defendant’s overall lack of an industry-recognized, adequate quality assurance and audit program. From the government’s point of view, if the defendant had conducted audits or implemented quality control measures, the dramatic increase in the use of specific codes would have trig- gered an internal inquiry.¹⁶
• A defendant’s failure to review claims for errone- ous data before submitting them for payment to CMS.¹⁷
• A defendant’s use of a computer system incapable of deleting data and/or filtering out incorrect or in- appropriate data submitted to CMS.¹⁸

The complexity of an effective quality assurance and audit program varies based on the size and sophistica- tion of the entity involved, but typically includes moni- toring, through data analytics, and personal review of claims and diagnoses reported, and an audit plan.

Most importantly, the quality assurance and audit system should be established to ensure that the infor- mation provided is accurate, complete, and in compli- ance with program requirements. This requires that health plans review the information provided to them and that providers review information they report for unsupported codes and missing codes.

Critical considerations for the development of an ef- fective and meaningful quality assurance and audit pro- gram include the following: 

• Assign responsibility for reviewing applicable government guidance and updating the company’s practices to a designated department or person.
• Ensure diagnoses codes submitted to the risk adjustment program are supported by acceptable documentation produced by an acceptable source. ¹⁹
• Ensure that the system that communicates data to the government is capable of correcting codes pre- viously submitted that are later found to be unsup- ported. 20
• Establish an annual audit plan that sets forth how often the plan will conduct internal audits of its data practices and external audits of providers.
• Ensurethatcommunicationswithproviderswhose records have been reviewed are appropriate and do not improperly lead the providers to the codes the plan believes should be reported.²¹
• Ensure individuals and companies are engaged properly and qualified to provide quality assur- ance and audit services.

 After considering all applicable guidance and issues, a health plan should also adopt policies and procedures that will govern its risk adjusted data and quality assur- ance and audit practices^.22

D. Qualified Coders and Third Party Coding Review Services

After developing an effective quality assurance and audit program, health plans and providers should en- sure that the individuals and/or companies providing audit and coding review services are qualified to pro- vide the required services and have been properly engaged. Using individuals who are not properly licensed or certified significantly increases risk under the FCA.²³

The level of fraud and abuse risk associated with au- dit and coding review services is often related to the in- structions provided to the coders and the compensation paid to the individual or company providing the services.

Health plans and providers that engage coders and coding review services should consider implementing the following practices:

• Instruct the coders to look ‘‘both ways’’ for codes, meaning that they report both additional codes that are supported by the records and codes that should be deleted because they are unsupported.²⁴
• If the coders are conducting ‘‘blind’’ reviews,²⁵ ensure that the health plan or provider compares the coder’s findings to the codes originally submit- ted by the providers and either corrects or further investigates codes submitted by the provider but not reported by the coder.²⁶
• Consider structuring the arrangement to comply with either the AKS safe harbors for employees²⁷ or personal services and management contracts. ²⁸
• If not paying the coders or coding review service a set fee, consider basing compensation on an hourly rate or a per chart rate.
• Avoid paying coders (employed or contracted) or coding review services a per code fee or a fee based on the value of the codes they report. Simi- larly, avoid engaging coding review services that pay their coders based on the number or value of the codes they report.
• If the services provided only include coding review, avoid compensation structures under which payment is based on whether such services increase the health plan’s reimbursement.

V. Conclusion

As the various ACA programs continue to roll out, health plans and providers will be continually challenged by each program’s new requirements. The Exchange risk adjustment program will certainly present challenges for plans, but if plans and providers work collaboratively to understand the requirements and pro- duce accurate and complete medical records, everyone should win. Health plans and providers should receive appropriate reimbursement for the risk they assume and services they provide, and patients should receive quality, targeted medical services and care management. 

_{1 Public Law 111-148.}    

_{2 The full name of the system is the Centers for Medicare & Medicaid Services Hierarchical Condition Category payment model.}

_{3 Risk adjustment covered plans do not include grandfathered health plans, group health insurance coverage de- scribed in 45 C.F.R. § 146.145(c), individual health insurance coverage described in 45 C.F.R. § 148.220, and any plan deter- mined not to be a risk adjustment covered plan in the applicable Federally certified risk adjustment methodology. 45 C.F.R. § 153.20.} 

_{4 In order to operate its own risk adjustment system, a state must also operate its own Exchanges. See 78 Fed. Reg. 15410, 15415 (March 11, 2013).}

_{5 See 78 Fed. Reg. 15415-15434. 6 See 78 Fed. Reg. 15417.}

_{7 See 78 Fed. Reg. 15437.}

_{8 See id.} 

_{9 See id.}

_{10 See 78 Fed. Reg. 15438.}

_{11 See 78 Fed. Reg. 37032, 37088 (June 19, 2013).} 

_{12 See U.S. v. Walter Janke, M.D., Lalita Janke, and Medi- cal Resources, LLC, Civ. Act. No. 09-CV-14004-Moore-Lynch (S. Dist. Fla. Feb. 10, 2009); U.S. v. Kernan Hospital, (D.M.D.) Civil Action No.: RDB-11-2961, U.S. ex rel Swoben v. SCAN Health Plan, Case No. CV09-5013JFW(JEMx) (Cent. Cal. No- vember 23, 2011).}

_{13 See 77 Fed. Reg. 73118, 73149 (Dec. 7, 2012) and 78 Fed. Reg. 15438.} 

_{14 See 77 Fed. Reg. 17220, 17241 (Mar. 23, 2012).}    

_{15 The audit program discussed here is in addition to the audits required by HHS RADV.}

_{16 See U.S. v. Kernan Hospital. In 2012, the United States filed an FCA case against a hospital in Baltimore, Maryland, arguing that the hospital fraudulently included inappropriate secondary diagnoses in order to increase its federal reimbursement. The case was dismissed because the government’s complaint lacked specificity as to the precise false claims at issue and failed to address whether or how the allegedly fraudulent diagnoses (i) were reported to the government, and (ii) actually caused the hospital to receive payment for services not rendered.}

_{17 See U.S. v. Janke. The government claimed that the de- fendants violated the FCA by causing a Medicare Advantage Organization, also owned by the Jankes, to falsely increase the severity of beneficiary diagnoses to obtain higher risk adjustment payments. The case settled for $22.6 million. The government also successfully petitioned the court to freeze the Jankes’ assets believed to be the proceeds of their unlawful scheme.}

_{18 See id.} 

_{19 See id.}

_{20 See id.}

_{21 See U.S. v. Kernan and U.S. v. Janke.}

_{22 Some of these policies and procedures can be made part of the health plan’s overall compliance program.}

_{23 See U.S. v. Janke, where the government cited the defendant’s practice of hiring mostly unlicensed physicians to re- view patient files for evidence of diagnoses as support for the defendant knowingly violating the FCA.} 

_{24 See U.S. v. Janke.}

_{25 A blind review is a review where the coder is not informed of the codes that the provider submitted based on the medical record. Health plans often use blind reviews so that the coders are not improperly lead to codes that the provider reported.}

_{26 See U.S. ex. rel. Swoben vs. SCAN Health Plan, Third Amended Complaint. SCAN allegedly reported the codes to the risk adjustment system that the coders had reported and failed to correct or inform the government of codes that were previously submitted to the risk adjustment system that SCAN’s contracted coders did not report. The relator alleged that the procedures used were biased in favor of upcoding diagnoses and that SCAN adopted such procedures knowing that they would result in increased risk scores and capitated payments.}

_{27 42 C.F.R. § 1001.952(i). 28 42 C.F.R. § 1001.952(d).} 

This article was previously published in Health Insurance Report by The Bureau of National Affairs, Inc.