Medicare providers face an alphabet soup of entities seeking to recover “overpayments” from them on behalf of Medicare.  Commonly referred to as Recovery Audit Contractors (“RACs”), these entities include Zone Program Integrity Contractors (“ZPICs”), and they have an aggressive mandate to recover Medicare “overpayments” to providers.

We recently represented a physician from whom a RAC sought $850,000 in overpayments for services billed to Medicare.  The liability arose because our client did not have any documentation to support the $850,000 in billed services.  However, our client did not have the supporting documentation because she never performed or billed the services!  It turns out that the client’s prior employer stole her Medicare provider “identity” and billed the services for himself.

Fortunately, CMS started a Victimized Provider Project a couple of years ago to address these situations.  We performed our own investigation and confirmed that our client’s former employer pled guilty to conspiracy to commit healthcare fraud in federal court, and we obtained sufficient information from the court records to document this theft.

After formally submitting a request for assistance from the Victimized Provider Project, CMS investigated and agreed with our assertion that our client’s identity was stolen.  Happily, CMS formally announced that it would not hold our client liable for the $850,000 in overpayments and would cease all collection efforts.

CMS recommends that providers take the following steps to prevent or spot identity theft:

  • Actively manage enrollment information with payors. Always keep reimbursement banking information current, and update payors when opening, closing, or moving practice locations.
  • Monitor Billing and Compliance Processes. Review OIG’s guidance at oig.hhs.gov/compliance/compliance-guidance/index.asp. Always be aware of billings in your name.  Review entities to which you have reassigned billing privileges.  Compare remittances with medical records.
  • Control Unique Medical Identifiers. Avoid giving your identifiers to prospective employers before performing due diligence. Train staff on appropriate use and distribution of your medical identifiers, including when not to distribute them.  Control prescription pads.
  • Engage Patients. Encourage patients to request and review their medical bills and have patients report any irregularities they see.