Business Solutions

A Game Plan for Six-Year Lookbacks

CMS's six-year lookback audits represent a daunting challenge for HME providers, but there are steps they can take to deal with them.

game planThe word “audit” can strike terror into the heart of any business owner, especially if you don’t know what to expect or how to prepare and respond. An audit that goes back six years sounds like terror x 6, but it may not have to be.

A DME business that’s been following all the rules and has been stringent about getting documentation for every prescription in advance will have little to worry about from the new six-year lookback rule — but will still have to respond. Just like the Internal Revenue Service, your DME MAC won’t forget about you if you just keep your head down.

“What will happen if the DME supplier says, ‘I’m not going to mess with it,’ is the DME MAC will come in and do their own audit, then you have false claims liability,” says attorney Jeffrey S. Baird, Esq., is chairman of the Health Care Group at law firm Brown & Fortunato, P.C. “That could be far more expensive than complying: “The civil liability under the False Claims Act (FCA) is actual damages, plus treble damages, plus up to approximately $21,000 per claim.”

You can’t blame CMS for checking. According to the most recent Comprehensive Error Rate Testing (CERT) data available, fiscal year 2017, Medicare fee-for-service programs overall have an 8.12 percent overpayment rate, but for DMEPOS it jumps up to 35.54 percent, and that adds up to $2.59 billion.

For now, DMEs that have the most cause for concern are those who have a large PAP business. But that doesn’t mean DMEs are in the clear on other products; this was just the first review to trigger a major clawback. Any segment that requires refills or monthly supplies will be susceptible to problems, and some practices that may have been acceptable (or just gone unnoticed) in the past, like blanket orders, won’t fly now.

“What has happened here can be replicated for other kinds of supplies,” Baird says. Diabetic, CPAP, wound care, catheters and other repeat
products are getting scrutinized because they are more susceptible to documentation errors and fraud. While you may not intentionally send unneeded supplies, mistakes can happen. And there’s no guarantee that one-time products won’t be audited in the future.

“It’s a risk for everybody. They are looking at things like orthotics, because of all the issues they have had with the braces. The six-year look-back applies to any avenue of DME that CMS wants to go down,” says Kim Brummett, Vice President of Regulatory Affairs for the American Association for Homecare. “I don’t think there is any way to avoid it. Smart suppliers probably already have compliance teams.”

If you don’t have a compliance officer or team, it might be time to get one. “We all seem to be on the same page that we think this is going to be the norm every time the Office of the Inspector General (OIG) issues one of their reports,” says Wayne van Halem, president and founder of audit consulting firm The van Halem Group, a division of VGM Group. “That’s something we have to keep track of now and monitor because [a six-year lookback] is such a huge undertaking.”

One thing that seems sure based on conversations with DME MACs, Brummett adds, is that “It will never come out of a DME MAC unless they are instructed to by CMS.”


Baird explains what led to the CPAP reviews under way now. The OIG released a report in June 2018. That traces back to 2014-15 when the OIG reviewed 110 claims nationwide and found 24 of them compliant and 86 noncompliant. Though the total overpayment for the 110 claims was $13,414, OIG’s next step was to do an extrapolation that estimated how much it was costing across the Medicare system -- $631,272,181.

“The OIG said, man, we’ve got a big problem out here,” Baird says. Since the 86 noncompliant claims came from 82 DME suppliers, CMS told the DME MACs to have the suppliers do internal investigations. The MACs sent letters ordering the investigations, including the six-year lookbacks, to those suppliers.


Step 1: Read letter.

Step 2: Mutter something that probably isn’t printable here.

Step 3: Call a lawyer. You don’t know for sure what you will find, and having an attorney can protect your related conversations and reviews under attorney-client privilege.

“If DME companies hire Brown Fortunato, we hire van Halem Group,” Baird says. “If they discover not only bad claims but our client is doing awful, terrible things that could even be criminal, that is protected by attorney-client privilege.”

Most businesses are doing their best to comply, but sloppy or incomplete paperwork can trip them up. If you got a letter, you now have two choices: “Either look at every CPAP resupply claim for the last six years; or, hire a statistician to do a statistically valid sample of claims over the six-year period and extrapolate,” Baird says.

Rooting around through six years’ worth of claims may be a complicated process, but it’s nothing compared to creating a statistically valid sample. Most DME firms, especially small ones, just don’t have ready access to the expertise — unless you have an exceedingly low volume of claims for that code.

If you started by hiring an attorney, the attorney can hire the other help you need and the attorney-client privilege extends to the information those contractors generate during the review. As Baird explains, “The attorney can, in turn, hire an outside consultant to assist with the lookback. The attorney will pay the fees to the consultant (the supplier will reimburse the attorney for the fees), the consultant will report to the attorney, and the attorney will report to the supplier. By following these steps, and assuming that no intervening action occurs that compromises the attorney-client privilege, then the work performed by the consultant will be protected by the attorney-client privilege.”

While CMS allows DMEs to use RATS-STATS to perform their own sampling, Brummett says, “That’s a tool, but nobody knows how to use it. Suppliers aren’t statisticians. The requirement in the letter is scary, because you either audit every claim for the last six years that takes that code, or you take a statistically valid sample that you can justify as being accurate and audit that. When you do a self-audit on the last six years that you’ve filed for that one number, there could be thousands.”

“It’s not something that a lot of people can do internally,” van Halem says. “Where it gets challenging is that you have to run a statistically valid random sample. Most DME suppliers don’t have anyone with that expertise. We have a statistician who is able to design a sample that is statistically valid.”

Unfortunately, you can expect to spend $10,000 or more just for the audit, which van Halem estimates takes about 40 hours to review about 100 claims — plus the time it takes to pull your records, perform your internal review and go through the process.

“That’s just for the audit component, not pulling the claims or identifying the sample and doing all that. It’s a significant amount of time, particularly the review element,” van Halem says. “Overall, in general it would probably be close to or over 100 hours of time dedicated on it — that’s if everything goes smoothly. What we find is that once we get through the first part of the review there are a lot of documents missing that they have to go back and try to locate. There’s a lot of back-and-forth and communication with attorneys.”

In most cases, it’s probably not wise to try to do the review yourself. Most of your existing service providers can’t be much help. Likely the best your software and billing services providers can do is help you identify the universe of potential claims.


The help you need to do your internal audit right the first time isn’t cheap, but the cost is likely to be far lower than making a mistake. In addition to the looming threat of FCA claims, the results of your internal audit may be the path to getting claims rehabilitated, which would reduce any amount you would have to pay back.

In some cases, for example if your review was triggered by just one or two faulty claims, you may be able to dodge the six-year lookback bullet by rehabilitating those claims.

“Some clients have not had to pay, because we were able to get the claim overturned in the appeal process,” Van Halem says. “Once the claim was overturned there was no overpayment. There was only one payment to begin with that caused it.”

There are three possible steps in the process: Redetermination, Reconsideration and administrative law. With redetermination, the supplier submits paperwork correcting the problem and submits it to the DME MAC.

For example. blanket orders are out if they fail to include the exact quantity the patient needs. To fix the problem, “the supplier goes back to the doctor, says ‘please issue me a new order, dated today (because we don’t want to be dishonest), that says this new order is correcting or rehabilitating the prior order you’ve filled until now, today.’ The doctor is stating the quantity ordered for the patient two years ago until today. The old order will have a new order, which is effective two years ago. That is a way to rehabilitate the order.”

If the DME MAC declines the redetermination, the DME can seek reconsideration. At this stage the supplier can no longer add new material to the case. If that review fails, the DME may appeal to an administrative law judge for a hearing but, Baird warns, “Between the reconsideration and the ALJ, the DME MAC can and will offset” the disputed amount against the supplier’s account.

“Most people lose at redetermination or reconsideration,” Baird says. “Out of 30 claims at issue, you might win three at redetermination. At reconsideration you might win on three claims. But you still lost on 24 claims.”

But for one or two faulty claims it’s probably worth a try, because as Brummett notes, if the appeal on the triggering claim succeeds, “The MACs have told us they are not going to respond. They’re putting it in the file and closing it.” van Halem adds, “We’ve had clients with claims that were actually denied that we got overturned in the appeal process. The good thing is, CMS did indicate that if that was the case, they don’t think it was necessary to do a six-year lookback.”


In most of the cases under review, “DMEs would put out the product and not have the documentation in the patient file that was sufficient to withstand an audit,” Baird says. The lookback rule is “motivating the DME not to put out the product until their documentation is complete… If you are running a tight ship, even though you will have to respond, you’ll be just fine.”

It may be small consolation, but Brummett says at least six-year lookbacks don’t require any new day-to-day processes. “If you are following the rules you should not have to change any processes,” she says. “They are not looking to change anything, just make sure you are doing what you should have been anyway.”

Going a step further, van Halem advises that DMEs police themselves carefully and early to avoid problems. “We shouldn’t sit back and wait for this to happen again. We should be, on a quarterly basis, auditing our claims proactively to identify any issues. If you catch it within a quarter you can minimize the impact of it and get it taken care of, so that moving forward we don’t have this issue ongoing.”

He also advises DMEs not to get complacent once they pass a six-year lookback: “There is this six-year lookback. That means they are probably going to come back and do a review in another couple of years to make sure this issue is no longer an issue. I would just go back to being proactive and trying to put the effort in up front to identify issues before the government does that.”

This article originally appeared in the October 2019 issue of HME Business.

HME Business Podcast