Properly Documenting High-Risk Diagnoses: Lessons Learned from OIG Compliance Audits

The Office of Inspector General (OIG) has released 23 reports on its findings for Medicare Advantage Organizations’ (MAOs) compliance audits for specific diagnoses and diagnosis codes submitted to the Centers for Medicare and Medicaid Services (CMS) for use in CMS’s risk adjustment program payments.

Most of the audits were for diagnoses submitted by health plans for dates of service from 2015-2016 that led to millions of dollars in net overpayments. Here are the findings of the specific targeted Hierarchical Condition Category (HCC) diagnosis audits the OIG has completed on 21 MAOs since February 2021 to the latest report for April 2023.

Background

Under the Medicaid Advantage (MA) program, CMS makes monthly payments to MA organizations based on risk factors such as age, gender, and health status of individual beneficiaries enrolled in these health plans. To determine the health status of beneficiaries, CMS relies on MA organizations to submit diagnosis codes from their providers. CMS then maps specific diagnosis codes, based on similar clinical characteristics and severity and cost implications, into HCCs. Each HCC has a risk adjustment factor (numerical value) assigned to it for use in each beneficiary’s risk score.

The risk adjustment program is a prospective payment system; CMS uses the diagnosis codes that the beneficiary received for one service year to determine HCCs and calculate risk scores for the following calendar year (payment year). Therefore, a beneficiary’s risk score does not change for the year in which a diagnosis is made. Instead, the risk score changes the following year after the diagnosis has been made.

The risk score calculation is an additive process; as HCC risk scores accumulate, a beneficiary’s risk score increases, and the monthly risk-adjusted payment to the MA organization also increases. In this way, the risk adjustment program compensates MA organizations for the additional risk of providing coverage to the beneficiaries expected to require more healthcare resources and expenditures.

High-Risk Groups of Diagnoses

The OIG targeted MAOs “because some diagnoses are at higher risk for being miscoded, which may result in overpayments from CMS.” Using proprietary data mining techniques, CMS identified 10 high-risk diagnostic groups at higher risk for miscoding.

• Acute Stroke: A beneficiary received one acute stroke diagnosis on one physician (outpatient) claim during the service year but did not have that diagnosis on a corresponding inpatient hospital claim. 
• Acute Heart Attack: A beneficiary received one diagnosis that mapped to either the HCC for Acute Myocardial Infarction or to the HCC for Unstable Angina and Other Acute Ischemic Heart Disease (Acute Heart Attack HCCs) on only one physician outpatient claim but did not have that diagnosis on a corresponding inpatient hospital claim (either within 60 days before or 60 days after the physician’s claim). 
• Acute Stroke and Acute Heart Attack Combination: A beneficiary met the conditions of the acute stroke and acute heart attack high-risk groups in the same year.
• Major Depressive Disorder: A beneficiary received a major depressive disorder during the service year but did not have an antidepressant medication dispensed on their behalf. In these instances, the major depressive disorder diagnoses may not be supported in the medical records.
• Embolism: A beneficiary received one diagnosis that mapped to either the HCC for Vascular Disease or the HCC for Vascular Disease with Complications (Embolism HCCs) but did not have an anticoagulant medication dispensed on their behalf. An anticoagulant medication is typically used to treat an embolism.
• Vascular Claudication: A beneficiary did not receive a diagnosis related to vascular claudication (which maps to the HCC for Vascular Disease) for two years and then, in the subsequent year, received that diagnosis but had medication dispensed on their behalf that is frequently dispensed for a diagnosis of neurogenic claudication.
• Lung, Breast, and Colon Cancer: A beneficiary received a lung, breast, or colon cancer diagnosis but did not have surgical therapy, radiation treatments, or chemotherapy drug treatments administered within six months before or after the diagnosis.
• Potentially Miskeyed Diagnosis Codes: A beneficiary received multiple diagnoses for a condition but received only one—potentially miskeyed—diagnosis for an unrelated condition (which mapped to a possibly unvalidated HCC). The OIG developed an analytical tool to identify 832 scenarios in which diagnosis codes were miskeyed because of data transposition or other data entry errors that could have resulted in the assignment of an unvalidated HCC. For example, ICD-9 diagnosis code 250.00 (which maps to the HCC for Diabetes Without Complication) could be transposed as diagnosis code 205.00 (which maps to the HCC for Metastatic Cancer and Acute Leukemia, in this example, and would be invalidated).

Conclusion

According to the OIG, any diagnosis code submitted to CMS that generates an HCC must meet federal requirements to support diagnosis codes. The common response from the OIG was that an MAO’s policies and procedures to ensure compliance with CMS program requirements were ineffective, as required by federal regulations. As a result, for any diagnosis code that could not be substantiated in the provider’s medical record, the MAO will be required to refund the federal government any overpayments. The health plan will also need to put more robust audit protocols, policies, and procedures in place to eliminate these errors.  

The findings reveal that providers, MAOs, and health organizations have the necessary audit protocols to minimize these overpayments. Below are three key questions to consider as you determine if your organization is vulnerable to an OIG investigation surrounding high-risk diagnoses:

• Have you analyzed claims information to replicate the audit logic used by the OIG for these targeted reviews? Conduct audits using this data mining logic to ensure documentation supports these diagnoses.
• Do you have policies in place to support internal audit procedures to verify the accuracy of these high-risk diagnosis codes? Create policies and procedures to support internal audit policies.
• Have you educated your health information management and revenue cycle team on the coding and billing for these conditions? Consider creating a query process or stopping claims from going out to ensure they are accurate.