Case Study 2 — The Practice That Did Everything Right and Still Repaid: A Composite

A composite built from documented compliance program guidance, the sixty-day overpayment rule, and the OIG self-disclosure protocol. The framework is Tier 1; the practice and its figures are Tier 3 and constructed.

Background

Case Study 1 was about the organization that ignores a problem. This one is about the organization that finds one, and it is included because the honest version of compliance is not "do it right and nothing bad happens." It is "do it right and something bad happens smaller."

Section 5.6 said element 5 (auditing) is comparatively easy and element 7 (corrective action) is where organizations fail. This case study is what element 7 looks like when it actually happens, including the parts that are unpleasant.

The composite

Constructed. Not a real organization.

A twelve-physician multispecialty group has a compliance program that is, by the standards of a practice its size, genuinely functional: written policies, a compliance officer who is the practice administrator with a direct line to the board, annual training, an anonymous reporting line, and a quarterly internal audit of ten charts per provider.

The Q2 audit finds something. One physician, who joined eighteen months earlier from a hospital employed position, is billing a particular service at a level the documentation does not support. Nine of ten sampled charts fail. The pattern is consistent and it is not close.

Here is what the practice does, and it is worth walking step by step because each step is a decision that could have gone the other way.

Week 1 — They believe the audit

The reflexive response to an adverse audit finding is to question the audit. The practice's compliance officer instead has a second reviewer sample ten additional charts, blinded to the first result. Eight of ten fail. The finding holds.

Week 1 — They stop the bleeding before they understand it

The physician is asked to hold billing for that service pending review. Not suspended, not accused — the claims stop going out while the question is open.

This is the step organizations skip, because it costs money immediately and the problem is not yet proven. It is also the step that determines how large the eventual number is, because every claim submitted after the finding is a claim submitted with knowledge (§5.2).

Weeks 2–3 — They find out why

The reason turns out to be mundane and entirely predictable: the physician learned this service's documentation requirements at their prior employer, where a hospital template captured elements their current system does not, and nobody had ever told them the documentation had to look different here. There was no intent, no financial motive the physician was aware of, and no attempt to conceal anything.

The practice's onboarding had never included coding expectations. That is the actual finding, and it is about the practice, not about the physician.

Weeks 3–6 — They size it honestly

The compliance officer, with counsel, determines the look-back period and reviews a statistically defensible sample across it, rather than reviewing only the quarters that are convenient.

This is the second step organizations skip. The temptation is to define the problem as the twenty charts already reviewed. The exposure is not the sample; it is the population, and defining it narrowly is a decision that will be second-guessed by someone whose job is second-guessing.

The constructed figure: 610 claims over eighteen months, average overpayment \$74.20, total identified overpayment \$45,262.00.

Week 7 — The sixty-day clock

Under the Affordable Care Act's overpayment provision, an identified overpayment must be reported and returned within sixty days of identification, and a retained overpayment becomes an obligation under the False Claims Act. The regulation addresses when an overpayment is "identified," including the exercise of reasonable diligence.

The practice reports and repays. Given the pattern and the volume, counsel recommends using the OIG Self-Disclosure Protocol rather than a simple refund to the contractor — a route with its own requirements and its own consequences, including that self-disclosure is generally treated as a mitigating factor.

Ongoing — Corrective action that corrects something

• Onboarding now includes documentation expectations, with a chart review at 30, 60, and 90 days for every new provider.
• The audit sample for this service is increased and the frequency raised for two quarters.
• The template is modified to prompt the missing elements.
• The physician receives education, not discipline — because the finding was about onboarding.

What it cost

Constructed.

And the counterfactual, which is the point:

What it shows

First, a functioning compliance program does not prevent findings. It changes what findings cost. This practice still repaid \$45,262 and spent \$82,662 all in. What it did not do is repay a multiple of that under treble damages, or negotiate a corporate integrity agreement, or explain to a court why its own audit report sat unactioned.

Second, the finding was about the organization, not the individual. This is the most common shape of a real compliance finding and the least intuitive. The physician did nothing that a reasonable person in their position would recognize as wrong. The practice had a process gap. Compliance findings that terminate in "this person made errors" have usually stopped one question short.

Third, stopping the billing immediately is the decision that determines the size of everything else. It is also the decision that costs money on the day it is made, with the benefit arriving invisibly and much later. Organizations that manage this well have decided the rule in advance, when nothing is at stake.

Fourth, the sixty-day clock forces the pace. A practice cannot investigate at leisure once it has identified an overpayment. This is a genuine tension — the regulation contemplates reasonable diligence, and reasonable diligence takes time — and it is why counsel gets involved early rather than at the end.

Fifth, and this is the sentence to carry: auditing without correcting is worse than not auditing. §5.2 established the mechanism; this case study is the practical consequence. An organization that is not prepared to act on findings should understand that generating them creates exposure. The correct response to that observation is to build the capacity to act — not to stop looking. Stopping looking is deliberate ignorance, which is the second prong of "knowingly."

The lesson

Compliance is not insurance against bad outcomes. It is the difference between a bad quarter and a bad decade.

Three carry-forwards:

Decide the "stop billing" rule before you need it. Write down, in advance, what triggers a hold. Making that decision under pressure, with revenue on the line and a colleague's reputation involved, produces the wrong answer reliably.

Size the problem by the population, not by the sample. The narrow definition is always available and never survives review.

And when you find something, the question to ask is not "who did this." It is "what in our process allowed this to happen for eighteen months without anyone noticing." The first question produces a disciplinary action. The second produces a fix.

The overpayment rule, the definition of identification, the self-disclosure protocol, and their requirements are all subject to change and to substantial interpretive nuance. This composite is illustrative only. Consult counsel.

Discussion questions

1. The practice stopped billing the service before the problem was proven. Defend that decision to a physician-owner who points out that it cost \$9,000 and the finding might have been wrong.

2. The finding was ultimately about onboarding, not about the physician. Does that change what the practice owed the government? Does it change what the practice owed the physician? Are those the same question?

3. The case study says auditing without correcting is worse than not auditing, and then says the right response is to build the capacity to act rather than to stop looking. Construct the argument a cost-conscious owner would make for the second option, and then dismantle it using §5.3.

4. Compare the two case studies in this chapter. In one, an organization ignored a problem and the enforcement mechanism was an employee. In the other, an organization found a problem and repaid \$82,662. Which practice would you rather work for, and — separately — which would you rather own? If your answers differ, say why.

5. Design the "stop billing" trigger this practice should have written down in advance. Be specific about the threshold, who has authority to invoke it, and how it ends.