EDITOR’S NOTE: Edward Roche, in association with RACmonitor, is writing a series on the need for U.S. healthcare facilities to protect themselves from cybercriminals demanding ransoms for patient records. This is the sixth installment in this series.
Cybersecurity audits now are becoming an integral part of the internal control requirements in the Medicare Financial Management Manual (MFMM).
Under the Federal Managers’ Financial Integrity Act of 1982 (FMFIA) (P.L. 97-255), Section 113 of the Accounting and Auditing Act of 1950 (31 U.S.C.66a) will be changed so that “each executive agency … shall provide reasonable assurance that … (their) systems of internal accounting and administrative control fully comply” with guidelines established by the Director of the Office of Management and Budget “in consultation with the Comptroller General.”
In the MFMM, Section 10.1.2, these requirements apply to all Centers for Medicare & Medicaid Services (CMS) contractors and healthcare providers because there is an article in their agreements with CMS “to cooperate … in the development of procedures permitting CMS to comply with FMFIA.” Also, the “Medicare Administrative Contractor (MAC) … Statements of Work” specify that “the contractor shall establish and maintain efficient and effective internal controls.”
The essence of this burdensome and convoluted language is that all Medicare contractors are required to follow internal control procedures that are approved by CMS. These are specified in Chapter 7 of the MFMM, in which information and communications are listed as being one of the “five interrelated standards” for internal control (§10.2.3).
Cybersecurity Auditing
“CMS conducts … information technology (IT) audits … to provide reasonable assurance that contractors have developed and implemented internal controls,” this language goes on to read (§40). “Information technology (IT) audits … include network vulnerability assessment (and) security testing (NVA/ST), (including) OIG information technology (IT) controls” (§40¶2.1,3).
“All contractors are required to certify their system security compliance (and) …should write a few paragraphs to self-certify that their organization has successfully completed all required security activities, including the security self-assessment of their Medicare IT systems and associated software in accordance with the terms of their contract,” this passage continues (§20.1). “Access to significant computerized applications … (must be) appropriately authorized.”
The U.S. Department of Health and Human Services (HHS) Office of Inspector General (OIG) has clear authority to investigate and audit cybersecurity problems, even if this has not been an element of its responsibility in the past.
This is because HHS OIG has a broad mandate to prevent fraud and abuse, and to promote economy, efficiency, and effectiveness. For example, it has the authority to identify “systemic weaknesses giving rise to opportunities for fraud and abuse in HHS programs and operations.” Since much “systemic weakness” can come from the information systems that operate within every healthcare provider, this would include a look at cybersecurity.
The Office of Investigations (OI) is tasked with ensuring “that policies and procedures are followed effectively, and are functioning as intended.” (Ibid, §QJ.20) It also “coordinates the adoption of advanced digital forensic acquisition and examination and information security technologies to assist in the investigation … of fraud and abuse.”
It appears that the OIG can audit to ensure that cybersecurity is sound. It also has the power to develop “standards governing the imposition of … exclusion.” Therefore, it is entirely reasonable that a healthcare provider involved with Medicare could be audited if its cybersecurity fell below the standards that are set in FMFIA and related statutes, and possibly excluded.
There was consideration given in the past to setting cybersecurity standards, and it was put to the side. However, with the recent wave of ransomware attacks and the exposure of other IT vulnerabilities, we might expect a more aggressive auditing effort in this area in the future.
We can expect much more audit risk in the future, and we will continue to discuss these new audits in future installments of this RACmonitor series.
Welcome back everybody after the holidays. As a CPA, I have always been uncomfortable when the word “Audit” is used to describe activity since the term
Today, I want to revisit a foundational flaw in how federal audit contractors calculate overpayments – a flaw so severe that in any other federal
Please log in to your account to comment on this article.
Accurately determining the principal diagnosis is critical for compliant billing, appropriate reimbursement, and valid quality reporting — yet it remains one of the most subjective and error-prone areas in inpatient coding. In this expert-led session, Cheryl Ericson, RN, MS, CCDS, CDIP, demystifies the complexities of principal diagnosis assignment, bridging the gap between coding rules and clinical reality. Learn how to strengthen your organization’s coding accuracy, reduce denials, and ensure your documentation supports true medical necessity.
Denials continue to delay reimbursement, increase administrative burden, and threaten financial stability across healthcare organizations. This essential webcast tackles the root causes—rising payer scrutiny, fragmented workflows, inconsistent documentation, and underused analytics—and offers proven, data-driven strategies to prevent and overturn denials. Attendees will gain practical tools to strengthen documentation and coding accuracy, engage clinicians effectively, and leverage predictive analytics and AI to identify risks before they impact revenue. Through real-world case examples and actionable guidance, this session empowers coding, CDI, and revenue cycle professionals to shift from reactive appeals to proactive denial prevention and revenue protection.
Sepsis remains one of the most frequently denied and contested diagnoses, creating costly revenue loss and compliance risks. In this webcast, Angela Comfort, DBA, MBA, RHIA, CDIP, CCS, CCS-P, provides practical, real-world strategies to align documentation with coding guidelines, reconcile Sepsis-2 and Sepsis-3 definitions, and apply compliant queries. You’ll learn how to identify and address documentation gaps, strengthen provider engagement, and defend diagnoses against payer scrutiny—equipping you to protect reimbursement, improve SOI/ROM capture, and reduce audit vulnerability in this high-risk area.
Only ICD10monitor delivers what you need: updates on must-know changes associated with the FY26 IPPS, including new ICD-10-CM/PCS codes, CCs/MCCs, and MS-DRGs, plus insights, analysis and answers to your questions from two of the country’s most respected subject matter experts.
Stay ahead of the 2026-2027 audit surge with “Top 10 Audit Targets for 2026-2027 for Hospitals & Physicians: Protect Your Revenue,” a high-impact webcast led by Michael Calahan, PA, MBA. This concise session gives hospitals and physicians clear insight into the most likely federal audit targets, such as E/M services, split/shared and critical care, observation and admissions, device credits, and Two-Midnight Rule changes, and shows how to tighten documentation, coding, and internal processes to reduce denials, recoupments, and penalties. Attendees walk away with practical best practices to protect revenue, strengthen compliance, and better prepare their teams for inevitable audits.
As AI reshapes healthcare compliance, the risk of biased outputs and opaque decision-making grows. This webcast, led by Frank Cohen, delivers a practical Four-Pillar Governance Framework—Transparency, Accountability, Fairness, and Explainability—to help you govern AI-driven claim auditing with confidence. Learn how to identify and mitigate bias, implement robust human oversight, and document defensible AI review processes that regulators and auditors will accept. Discover concrete remedies, from rotation protocols to uncertainty scoring, and actionable steps to evaluate vendors before contracts are signed. In a regulatory landscape that moves faster than ever, gain the tools to stay compliant, defend your processes, and reduce liability while maintaining operational effectiveness.
Get clear, practical answers to Medicare’s most confusing regulations. Join Dr. Ronald Hirsch as he breaks down real-world compliance challenges and shares guidance your team can apply right away.
Federal auditors are zeroing in on Inpatient Rehabilitation Facility (IRF) and hospital rehab unit services, with OIG and CERT audits leading to millions in penalties—often due to documentation and administrative errors, not quality of care. Join compliance expert Michael Calahan, PA, MBA, to learn the five clinical “pillars” of IRF-PPS admissions, key documentation requirements, and real-life case lessons to help protect your revenue.
Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →
CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 1 with code CYBER25
CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 2 with code CYBER24
