Understanding the Requirement of Review

Sometimes, life is predictable.

Eclipses are a great example. (You should plan on seeing the next total solar eclipse, on April 8, 2024! It’ll be visible across a large swath of the country, from Texas to Maine.) It’s the stuff of legend, how people once used the ability to predict an eclipse to appear magical.

But sometimes, life gets complicated, and the thing that we predicted would happen, doesn’t. In the compliance world, failed predictions can generate significant compliance headaches. I have stated my thoughts about the disadvantages of having detailed compliance policies many times. It is quite common for policies created with the intention of helping an organization stay out of trouble to wind up doing exactly the opposite. There may be no better illustration of this point than policies regarding internal audits. 

First, I don’t like the term “audit.”

I know that the sentencing guidelines, the source document for compliance plans, include “auditing and monitoring” as one of the seven key elements in an effective compliance plan. But I learned a lesson 30 years ago. My client had a policy to perform internal evaluation and management (E&M) audits. The government asserted that every time an audit found a physician’s documentation to be deficient, there was an obligation to issue a refund. The fact that my client called these reviews “audits” appeared to add a level of scientific precision to the process that simply didn’t exist.

But as regular readers here know, “if it isn’t written, it wasn’t done” isn’t the law; it’s an expression and a misleading one at that.

While Medicaid in many states has an explicit documentation requirement, Medicare only requires documentation for very limited services, such as teaching physician services and anesthesia services. The government used my client’s “internal audit” process against it. While we ultimately prevailed in the case, it took a while.

Most organizations with a compliance policy have one that calls for internal audits. Let us assume that the policy wisely uses the term “review,” rather than “audit.” There’s still another big problem the policy can cause. Many policies include specific details about the frequency of the reviews. Let’s say your policy calls for a certain number of charts to be reviewed annually or quarterly. Then, along comes some unexpected event – perhaps a global pandemic or a workforce shortage. Suddenly, what was happening quarterly or annually is happening semi-annually, or every few years.

Is your organization violating any laws if it conducts reviews slightly less frequently? Absolutely not. But can someone suggest that you aren’t taking compliance seriously because you are failing to follow your very own policy? Absolutely.

To be clear, I am not suggesting you shouldn’t perform reviews.

I am saying that doing reviews without a written policy is at least as good as doing reviews with one, but failing to do reviews is worse if you have a policy than if you don’t. The bottom line is that having the policy doesn’t offer any material help, but it can most certainly hurt. 

When something can only make things worse, it seems foolish to do it. Therefore, I would recommend that you conduct regular reviews, but without having a formal policy purporting to “require” them.

Programming note: Listen to healthcare attorney David Glaser’s “Risky Business” segment every Monday on Monitor Mondays with Chuck Buck.