The U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) issued an alert on November 28, 2016, regarding an email purporting to be from OCR.  This phishing email can look like an official government email which may use fake HHS letterhead and may even appear to be signed by OCR’s Director, Jocelyn Samuels.

OCR says:

The email prompts recipients to click a link regarding possible inclusion in the HIPAA Privacy, Security, and Breach Rules Audit Program.  The link directs individuals to a non-governmental website marketing a firm’s cybersecurity services. In no way is this firm associated with the U.S. Department of Health and Human Services or the Office for Civil Rights.”

If you or your organization has a question about whether you received an official communication, OCR suggests that you contact them via email at

The alert can be found at the following link: OCR Alert.

We’ve known for a while now that the Medicare Recovery Audit Contractors ("RAC") program would eventually start impacting physicians and other Part B providers. That time has now come as medical practices and physicians are beginning to receive both audit and repayment letters from RACs. So, if you’re still not familiar with this aggressive audit and recovery program, you are well-advised to begin preparing for the possibility that some of your claims may be reviewed by a RAC.

Continue Reading Physicians Begin Seeing Recovery Audit Contractor (RAC) Letters

With the rollout of the Recovery Audit Contractor (RAC) audit program in full swing, physicians should be paying close attention to their medical record documentation efforts.  One of the Medicare documentation requirement that many physicians don’t fully appreciate is the requirement that all medical records be signed by the performing physician.  Specifically, Medicare requires that medical records include a "legible identifier" for all services provided/ordered. According to the Medicare medical review documentation standards, the legible identifier must be in the form of a hand written or electronic signature (stamp signatures are not acceptable).  The medical review documentation standards can be found at Section of the Medicare Program Integrity Manual.

Document, document, document! is the cry of health care attorneys and consultants across the Country when asked what physicians can do to protect their practices from fraud and abuse liability.  But what happens if you receive a Medicare audit request and you find out that your documentation isn’t so good or even non-existent?  Many physicians when faced with this prospect are tempted to recreate or alter medical record documentation.  Beware, this is probably the worst thing you can do in this situation. 

Poor or even non-existent medical record documentation is not necessarily an indicator of fraud or abuse.  In many cases it is simply an indication of the need for documentation and coding education or better record keeping protocols.  In these circumstances, a physician may have to return some money to Medicare or other payors but will generally not be looking at civil or criminal penalties.  Recreating, altering or falsifying records, however can quickly turn a simple overpayment situation into a criminal case.  That’s what has apparently happened to a podiatrist in New Jersey according to a recent article in the New Brunswick Home News Journal.  According to the article, in response to a request by a Medicare contractor for 25 medical records, the podiatrist re-wrote the records to enhance the Medicare claims under review and was charged with obstructing a federal audit.  The potential penalty for this: a maximum of five years in prison and as much as a $250,000 fine.

 So what can you do if your documentation falls short in the face  of an audit submission?  If the documentation exists but is simply illegible, you might include a typed transcription along with the original records.  If pieces of information are missing from a note, you can include an annotation explaining why the information is missing, but any such annotation should be signed and dated when made.  Back-dating is major a no-no.  Finally, when records are missing altogether, a letter to the auditor explaining the situation and offering to refund the amounts received may make sense.  In any of these circumstances, however, it is highly advisable to immediately consult with a knowledgeable health care attorney before doing anything.