10 tips to survive a delegation oversight audit

If your healthcare organization or credentials verification organization (CVO) has a delegation agreement with a private healthcare insurer or government payer (e.g., Medicare Administrative Contractor, MAC) for primary source verification (PSV) or provider enrollment, you know to expect an audit at least annually. 

Delegation oversight audits—or the informal version, payer reviews—gauge your compliance with any number of payer and accreditor rules. Examples include:

• general policies and procedures regarding data handling.
• roster quality and accuracy.
• adherence to accreditor or certifying body standards.
• security related to provider data management technology.

Two factors in particular have led to recent increased frequency and stringency of delegation oversight audits by payers:

1. Inaccurate online provider directories. CMS conducts Medicare Advantage plan online provider directory reviews, and in the most recent round of checks (of about 11,000 locations and 6,000 providers), CMS found:
   1. 55% of provider directory locations are inaccurate.
   2. 55% of provider listings have at least one deficiency.
   3. 60% of errors identified are where the "Provider is not practicing at location."
2. More stringent requirements for accountability in federal legislation including the Affordable Care Act (ACA). Commercial payers on the ACA health insurance exchanges are affected by these regulations.

Most commonly, audits occur at regularly scheduled intervals with the timing and procedures usually spelled out in the delegation contract. However, payers can and do perform them at random with no impetus.

Triggers of unscheduled delegation audits can range widely—for example from payer analysis showing a provider’s or group’s data represents an outlier when compared with others, to frequent errors, upcoming contract renegotiations, changes in payer policies, or complaints by any party.

Audits must follow state law and regulatory guidelines. There are differences among regions and states regarding rules and regulations, so if needed healthcare organizations or health plans should seek legal guidance from an entity with expertise in the relevant locale early in the payer audit process. State medical societies also may prove useful for aiding in the delegation oversight audit process.  

Repeated negative outcomes due to errors or omissions can result in a range of problems, from penalties to contract termination. Avoid the traps by employing a mindset of constant readiness.

10 tips for constant audit readiness

1. Regularly review your formalized credentialing and enrollment policies and procedures. Ensure that they’re up to date, reflect changes the organization has made, and remain in line with the accrediting agency of the health plan.
2. Strive to have desktop audits performed within the same month for all delegated relationships, to minimize disruption within your organization.
3. Ensure that primary sources meet the accepted standard. Not every website is primary source verification (PSV) acceptable. You may need to prove your work; keep documentation that your source meets the standard.
4. Ensure that every provider application is signed and dated. Know the acceptable time frame for a signature. Consider the use of a “true” digital signature. NCQA standards allow for digital and electronic signatures. Many medical credentialing software programs allow for e-signature, whether for contracts, forms, letters, certificates, or other official documentation.
5. Ensure that any organizational changes (e.g., ownership change) are reported timely.
6. Be ready to demonstrate that your organization has a system for ongoing sanctions monitoring. You must show documentation of how you maintain and monitor your providers.
7. Maintain a documented system for the collection of expirables.
8. Determine whether or not you need an actual copy of any given document. In many cases, you don’t. Be ready to cite and demonstrate this to your auditor.
9. Use national databases to regularly validate provider data, doing regular clean-up work to maintain accuracy.
10. Create your own mock audit process in-house to ensure regular compliance.

Organizations unprepared for the next delegation audit, and those seeking to tune up policies and procedures to ensure compliance, benefit from partnering with an expert to avoid the costly consequences of missing red flags.