May 16, 1998 Health Care Financing Administration Department of Health and Human Services Attention: HCFA-7020-P P.O. Box 26676 Baltimore, MD 21207-0519 Re: Proposed Rule HCFA-7020-P To Whom It May Concern: The Association of American Physicians and Surgeons ("AAPS") hereby submits its comments to proposed rule HCFA-7020-P ("Proposed Rule"). AAPS is a not-for-profit membership organization that represents thousands of physicians in all practices and specialties. It was established in 1943 to preserve the practice of private medicine, and has remained dedicated to the Oath of Hippocrates and protecting the sanctity of the patient-physician relationship. It is incorporated in the State of Indiana and is tax-exempt under Section 501(c)(6) of the Internal Revenue Code. AAPS is firmly opposed to Medicare fraud and waste. As explained in detail below, AAPS objects to the Proposed Rule with respect to Subpart D -- Medicare Integrity Program Contractors. AAPS objects to several inconsistencies between the statutory mandate and the Proposed Rule. AAPS also objects to arbitrary and capricious aspects of the Proposed Rule. AAPS comments that HCFA has failed to consider several important facts relating to the practice of private medicine, as well as the privacy interests of patients. AAPS observes that the effect of the Proposed Rule would be to exacerbate fraud and waste by carriers and intermediaries, while imposing crippling burdens on independent physicians. The Proposed Rule would ultimately harm patients, who would be victimized by unwarranted invasions of privacy and unnecessary administrative burdens on their physicians. Background. Prior to passage of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), HCFA was not authorized to retain contractors to perform audits and investigations of private physicians. The Proposed Rule would provide for the private contracting of audit and investigation functions that are typically performed by government officials in other fields, such as tax collection. Because of inadequate safeguards against conflicts of interest, the Proposed Rule would allow entrenched corporate interests to cover-up their own fraud and instead drive their competitors out of business. The statutory mandate to eliminate the conflicts of interest that have plagued Medicare has thereby been violated by the Proposed Rule. Instead, it would impose a draconian regulatory burden on the private practitioner, to the advantage of corporate interests and the detriment of patients. The Proposed Rule fails to protect the needs of small businesses - here, the private practitioners and their patients - as required by the Paperwork Reduction Act of 1995 ("PRA"), Executive Order 12866, and the Regulatory Flexibility Act ("RFA"). HCFA failed to consider the enormous burdens on private practitioners that result from the proposed audit and investigation activities. The Proposed Rule would unleash, without adequate safeguards, a new group of investigators who could and would impose burdens on physicians with impunity. It would grant immunity to such investigators, and even reimburse their litigation expenses by using scarce Medicare resources. Moreover, these private auditors could invade the privacy of patients without any fear of liability. I. The Proposed Rule for Conflicts of Interest is Grossly Inadequate. The Proposed Rule includes an unjustified exception to the prohibition against a conflict of interest: Exception. HCFA may contract with an offeror or contractor that has an unresolved conflict of interest if HCFA determines that it is in the best interest of the Government to do so. Sec. 421.310(d). This exception is unnecessarily broad, and eviscerates all of the other protections in the Proposed Rule against conflicts of interest. It is arbitrary and capricious for HCFA to disregard, without substantive or procedural safeguards, its own conflict of interest rules. This "exception" violates the constitutional due process rights of the physicians victimized by the conflicts of interest. HCFA can no more adopt this "exception" than adopt a rule that "HCFA may, in its sole discretion, suspend due process protections if it is in the best interest of the Government to do so." Both the statutory mandate to eliminate conflicts of interest, and the constitutional requirements of due process, prohibit this "exception". At a minimum, HCFA should only contract with an entity having an unresolved conflict of interest provided that HCFA first disclose to the public (i) the nature of the conflict and (ii) HCFA's justifications for disregarding such conflict in awarding the contract. A physician who is subjected to an audit or investigation has a due process right to know if the auditor has a conflict of interest and the reasoned basis on which HCFA elected to allow the conflict to continue. The Proposed Rule would allow physicians to be victimized by private auditors based on an undisclosed conflict. It is axiomatic, under the enabling statute and the Constitution, that physicians have a right to an impartial auditor and knowledge of any circumstances that may create prejudice. Otherwise the appearance of impropriety will continue to undermine the Medicare system, because every private auditor could have an undisclosed conflict of interest. Under the Proposed Rule, HCFA "establishes a Conflicts of Interest Review Board to resolve organizational conflicts of interest and determines when the Board is convened." Sec. 421.314(a). The Proposed Rule, however, lacks any procedural protections for the physicians affected by the decision of the Board. At a minimum, HCFA should require a reasoned basis for any decision by the Board to disregard a conflict of interest, and publication of such opinion. In light of the potential for fraud and abuse resultant from a conflict of interest by a private auditor, HCFA should also establish a procedure for complaints and objections by affected physicians. It is self- contradictory for the Proposed Rule to prohibit an "apparent conflict of interest," Sec. 421.310(c)(4)(i), but then fail to provide a procedural mechanism for dispelling the appearance of impropriety. The Proposed Rule also inadequately prevents conflicts of interest that arise during the term of a contract. HCFA proposes a prohibition upon receipt by the contractor of compensation from the entity being investigated or contacted during the audit. Sec. 421.310(f). This is insufficient. The far greater risk, recognized by HCFA in its own comments, is that a contracted auditor may receive benefits from a competitor of the physician being audited. 63 FR 13590, 13592. Such benefits are tantamount to bribery, and must be strictly prohibited. The contractor must have a regulatory obligation to report such conflict, and the Proposed Rule must expressly prohibit it. HCFA has invited comments "to establish the level of financial interest that could be considered a material interest in different situations." Id. at 13596. AAPS submits that no level of financial interest by a private auditor in a competitor, employer or hospital of an investigated physician is acceptable. The potential for abuse by the private auditor in subjecting a physician to harassment and draconian demands is simply too great to allow any financial conflict of interest. Just like the well- established rule that no amount of stock ownership by a judge in a litigant is ethical, no amount of financial interest by a contractor in a competitor is acceptable. Moreover, such undisclosed conflicts of interest are particularly harmful and unacceptable. The Proposed Rule affirmatively conceals the conflicts of interest of the private auditors retained under the program. The proposed lengthy certification program is utterly meaningless in light of HCFA's announced intention to conceal the essential material under the proprietary-information exception to FOIA. Sec. 421.312(d). As Justice Brandeis once observed, "sunlight is the most powerful of all disinfectants." HCFA should have considered allowing such "sunlight" by requiring applicants to waive any rights to a FOIA exemption for conflicts of interest. The Proposed Rule would render it impossible for any audited physician to determine if the auditor is motivated by an undisclosed conflict of interest that was disregarded by the government. Such proposal applies the statutory mandate in an unconstitutional manner by depriving physicians of their right to know of conflicts prejudicing the auditor or investigator. HCFA should provide to audited physicians all information relating to a potential conflicts, and require a waiver from applicants concerning FOIA exemptions with respect to such conflicts. Finally, the Proposed Rule contains inadequate termination provisions, in the event a conflict of interest is discovered during the course of a contract. Sec. 421.310(f)(2). HCFA proposes limiting its remedies to (i) failure to renew the contract, (ii) modification of the contract, or (iii) termination of the contract. These remedies will only encourage concealment of conflicts of interest. What incentive does a contractor have to reveal all of its conflicts of interest, when no penalty or sanction is imposed for such conflicts? What incentive does a contractor have to refrain from financial transactions that create post-award conflicts of interest? HCFA failed to consider the economic incentives created by its lack of sanctions for misconduct. Under the Proposed Rule, a contractor is in fact encouraged to conceal its conflicts of interest in order to reap the financial benefit until detection. HCFA must adopt a meaningful penalty, such as a requirement of refund of all payments, plus interest and penalties, if a contract is voided due to an undisclosed conflict of interest. II. The Proposed Rule Fails to Protect the Privacy of Patients. The Proposed Rule authorizes thousands of private contractors to scrutinize personal medical records, and yet fails to consider the issue of the privacy rights of patients in those records. Not once does the Proposed Rule even mention privacy. This is in sharp contrast to the speech of Vice President Gore at New York University on May 14, 1998, in which he declared that all agency heads were under an executive order to review their existing privacy practices. Such review should begin with the Proposed Rule, and safeguards for patient privacy must be added. In its introductory comments, the Proposed Rule notes that a "contractor-owned HMO could use its Medicare beneficiary database to perform health screening of beneficiaries." 63 FR 13590, 13592. The Proposed Rule also observes that a contractor gains "access to information about beneficiaries, providers, and suppliers that would be enormously useful in marketing and other business decisions, including provider/supplier information that is considered `proprietary.'" Id. These observations by HCFA plainly implicate substantial - and constitutional - rights to privacy by the patients. Yet the Proposed Rule utterly fails to consider the impact on patients' privacy by authorizing private auditors and investigators to search through anyone's medical records. The Proposed Rule contrasts sharply with regulations in other fields. The Federal Communications Commission ("FCC"), for example, protects the privacy of phone records with far greater diligence than HCFA proposes here for medical records. The FCC establishes a category of information known as Customer Proprietary Network Information ("CPNI") and protects such information in all of its regulations relating to phone records. See, e.g., 69 FR 20326. The Proposed Rule should likewise protect the privacy of patients in their personal medical records. AAPS urges HCFA to adopt a protection for patients that is similar to the provision adopted by attorneys to protect clients. Specifically, the Proposed Rule should include the following provision, based on the widely-adopted rule of legal ethics (Attorney Ethical DR 4-101(a)): A physician need not document or disclose to a contractor under this program any "information gained in the professional relationship that the [patient] has requested be held inviolate or the disclosure of which would be embarrassing or would be likely to be detrimental to the" patient, unless such information concerns unlawful treatment. The need for express protection of patient privacy is particularly important given the complete lack of any background checks on the contractors, and the lack of accountability for contractor misconduct. In the past, auditors and investigators of fraud have been insurance or government enforcement employees, who have been subjected to background checks and were accountable for their misconduct. Under the Proposed Rule, the contractors need not have any law enforcement training, are not subjected to any criminal or other background checks, and have virtually no accountability. Anyone can and will apply for positions as auditors and contractors under the Proposed Rule. It is likely that some applicants will include individuals who intend to provide or even sell highly personal medical information about patients to others. It is essential to protect patient privacy pursuant to the above standard. III. The Proposed Rule Violates the Regulatory Flexibility Act. As restated in the Proposed Rule, the Regulatory Flexibility Act ("RFA") "requires agencies to analyze options for regulatory relief of small businesses." 63 FR 13590, 13602. Physicians in private practice - the membership of AAPS - are plainly within the scope of the RFA and thus are protected against onerous regulatory burdens. The 19-page Proposed Rule devotes only 4 paragraphs to discussing its impact on small businesses, such as physicians in private practice. Id. at 13604. Moreover, the latter 3 of these 4 paragraphs are entirely speculative and irrelevant, focusing on such issues as the cost of an occasional long distance phone call or the treatment of physicians by local media. Id. Only one solitary paragraph in the Proposed Rule discusses the burden of audit demands on physicians. Id. This cursory analysis of the regulatory impact on physicians in private practice is inadequate, and violates the RFA. Any audit - whether a tax audit or a Medicare audit - imposes substantial administrative burdens on small businesses, including physicians. The so-called estimates provided in the Proposed Rule for such burdens are absurdly low, and reflect a lack of consideration by HCFA of this issue. The Proposed Rule arbitrarily states that a physician would only spend 15 minutes of his time responding to an audit inquiry. Id. at 13604. In fact, it requires 15 minutes of a physician's time simply to read and understand a typical audit inquiry. The physician will then spend many hours, even days, to respond fully to a typical audit demand. The so-called estimate provided in the Proposed Rule is wrong by a factor of 10 to 100. One poll, for example, found that physicians would rather be subjected to an IRS audit than a Medicare audit. The Proposed Rule does not impose any limit on the number of audit inquiries that a contractor can make, or even require a reasonable basis for such inquiries. A contractor could simply mail form letters to all the physicians in a region to demand proof of the validity of thousands of claims. Indeed, a contractor under the Proposed Rule could structure its auditing process in order to shift the administrative burdens entirely onto the physicians, thereby maximizing the profits of the contractor. The Proposed Rule could easily result in an administrative burden on individual physicians of a hundred hours per year. The absence of any safeguards to protect the physicians against such administrative burden is in violation of the RFA, as well as the Paperwork Reduction Act ("PRA") and Executive Order 12866. AAPS proposes that HCFA adopt, at a minimum, a limitation of two audits per year of medical practices consisting of six or fewer physicians. This will create an incentive for the contractor to perform due diligence before imposing crippling administrative costs on small businesses protected by the RFA. The unlimited number of audits contemplated by the Proposed Rule violates the RFA with respect to physicians in private practice. IV. The Proposed Rule Establishes Unwarranted Immunity for the Contractors. The Proposed Rule provides for reimbursement of litigation expenses using scarce Medicare resources. The Proposed Rule states that: HCFA makes payment, to a contractor under this subpart, or to a member or employee of the contractor, or to any person who furnishes legal counsel or services to the contractor, of an amount equal to the reasonable amount of the expenses incurred in connection with the defense of a suit, action, or proceeding, as determined by HCFA, if-- (1) The suit, action, or proceeding was brought against the contractor, or a member or employee of the contractor, by a third party and relates to the performance by the contractor, member, or employee of any duty, function, or activity under a contract entered into with HCFA under this subpart; (2) The funds are available; and (3) The expenses are otherwise allowable under the terms of the contract. Sec. 421.316(b). This proposed reimbursement of expenses of contractors in defending their own misconduct constitutes waste of scarce Medicare resources, and is arbitrary and capricious. It would effectively remove any accountability by the contractor for misconduct, and is contrary to the statutory intent. Specifically, HCFA proposes spending scarce Medicare funds to reimburse expenses of contractors for any litigation relating "to the performance by the contractor, member, or employee of any duty, function, or activity under a contract entered into with HCFA under this subpart." Section 421.316(b)(1). Instead, HCFA should expressly prohibit any reimbursement to a contractor that is held to be liable for any misconduct, whether intentional or negligent. HCFA should also eliminate the term "or activity" as a basis for providing reimbursement to a contractor, because it impermissibly extends the scope beyond the narrow "duty" and "function" bases for reimbursement. Taxpayers should not be required to foot the bill for contractor malfeasance or incompetence that are beyond the specific duties and functions of a contractor. Such reimbursement by the government creates a disincentive for contractors to train and control their employees in the auditing of physicians. HCFA failed to consider the substantial costs to the Medicare program, at the expense of all beneficiaries, that would result from the foregoing reimbursement scheme. Contractors under the Proposed Rule may be subjected to numerous lawsuits for their violations of due care in auditing and investigating physicians. The Proposed Rule enables HCFA to reimburse contractors even when they did not act with due care. AAPS urges HCFA to limit reimbursement to contractors that prove they acted with due care in performing their specific duties and functions. V. The Application Procedures in the Proposed Rule are Inadequate. The Proposed Rule places virtually no restrictions on applicants, even though applicants will engage in "the identification and development of fraud cases for referral to law enforcement." 63 FR 13590, 13593. As proposed, this authorization will provide an unscrupulous competitor or enemy of a physician with the means to ruin his or her career. The protections against conflicts of interest generally ignore those created by competitive actions, as emphasized in Part I above. Government employees utilize standards of performance and background checks that protect citizens, but the Proposed Rule fail to do so for contractors under this program. In addition to the problem of conflicts, unjustified harassment could also result from animus or simply incompetence. HCFA merely proposes that a contractor "[m]eets other requirements that HCFA establishes." Sec. 421.302. This is plainly inadequate. At a minimum, contractors should have a law enforcement background and have completed basic law enforcement training. Moreover, all applicants should be subjected to criminal background checks, and questioned about any competitive or civil disputes with possible targets of their investigations. Physicians must not be subjected to the arbitrary or improper actions of contractors who do not meet basic qualifications of impartiality and competence. The Proposed Rule also fails to consider, as part of the renewal process, physicians' objections and complaints about auditor misconduct. The Proposed Rule provides for renewal without competition based on certain performance requirements and the so-called best interest of the Government. Sec. 421.308. Under this standard of renewal, the concerns of neither the physicians nor the patients are considered. A contractor attempting to maximize its chances of renewal can and will simply trample upon physician and patient alike, to the detriment of the delivery of quality medical care. The renewal process should include a procedure by which physicians may provide comments on the contractors' competence and fairness, much as litigants have a right to comment in the renewal process for a United States Magistrate Judge. The provision of such feedback on contractor performance will greatly enhance the quality of the program itself, and reduce litigation arising from contractor misconduct. Conclusion. AAPS respectfully urges HCFA to consider and implement the above modifications with respect to HCFA-7020-P. Please contact me if I can be of further assistance. Sincerely, Jane Orient, M.D. Executive Director