This blog is the second in a series about interacting with government regulators and is intended to help our clients understand and manage contact and outreach from government regulators, law enforcement, or both.
The Set Up
You manage or operate a health care provider entity in New York State that services patients insured through the New York State Medical Assistance Program (Medicaid). Like most health care providers, you’re busy, often understaffed, primarily concerned with the needs of your patients, and find government oversight and regulations challenging. In your less-guarded moments, you find them unduly burdensome. The paperwork seems endless. On this day, an investigator arrives at your office and gives you a letter that demands, under 18 NYCRR § 504.3, a host of old patient records. Busy as usual, you ask your staff to locate the records and, once gathered, you give them to the investigator, who promises to give them back. You don’t make copies. Did you do the right thing?
The Law
Ultimately, yes, but perhaps not in a way that best protects your interests and the interests of your patients. 18 NYCRR § 504.3(a) requires all providers, as a condition of Medicaid reimbursement, “to furnish such records and information, upon request” that supports “the extent of services furnished” and the payment of claims so long as the information is sought by one of four government agencies: the State Department of Health (DOH), the state Office of the Medicaid Inspector General (OMIG), the state attorney general’s Medicaid Fraud Control Unit (MFCU), or the United States Department of Health and Human Services (HHS). The right to secure these records is broad and has been upheld by New York State’s appellate courts.i Indeed, failure to comply with this type of request, whether from OMIG or one of other three agencies, constitutes an “unacceptable practice” under Medicaid program rules and regulationsii and can subject a provider to sanctions. Courts in New York State have upheld these sanctions, including subjecting a provider to a payment suspension for failing to provide records under a 504.3 demand.iii In extreme situations, exclusion is an available sanction for failing to comply with a 504.3 demand.
Our Advice
Despite nearly unfettered access to your records and dire consequences from failing to comply, you, as a provider, are not without options when a government agent seeks your records under a 504.3 demand letter.
First, verify their credentials and ensure that the party seeking your records is entitled to them. While other agencies often possess independent authority to secure your records, under 18 NYCRR § 504.3 that right is limited to DOH, OMIG, MFCU, and HHS.
Second, find out who specifically at that agency’s headquarters is requesting the records and contact them or, more appropriately, have your attorney contact them. The investigator is rarely the ultimate end user of the records. Ask specifically to whom the records are going and ask for their contact information. Record requests are often expansive and burdensome and the requesting health care regulators often know that; they are generally willing to work with providers to limit or prioritize their requests, to provide additional time to produce records, or both. Health care regulators are generally loath to make requests that negatively impact the delivery of patient care. If the regulator’s request is burdensome, working with them to arrive a reasonable production schedule is perfectly acceptable.
In the case of paper records, it’s also important to find out whether the regulator will accept copies of your records or wants your original records. The former takes more times to gather, but preserves your access to the records—something you may need; the latter is sometimes telling. A request for original paper records is sometimes indicative that the identity of the individual who created the records is in doubt and original records are sought to obtain evidence of forgery or to obtain handwriting exemplars. If the government agency is looking for original records, arrange (or have your attorney arrange) for copies to be made first. Fight the urge to fix, complete, or update your records (i.e., to include information that should have been included contemporaneous to their creation) before complying. Doing so only invites heightened scrutiny. And, of course, find out when you might get your records back, especially if they’re original records. As an enrolled provider in New York State, you are required to maintain your records for six years from the date of serviceiv; as part of that responsibility, it’s important to note and memorialize where your records can be found, even if they are not directly under your control.
Our third and most important piece of advice is that it’s important to try to learn why the records are being requested. Again, your attorney may be most helpful here. Any decisions you make up front are ones that you’ll have to live with down the road, and given the uncertain road ahead at the start of any government outreach, advice and guidance from an attorney is likely to be quite helpful. Demand letters under 504.3 can be innocuous requests for records as part of an audit or investigation that is focused on someone else or somewhere else other than your business. In both cases, the health care regulator is merely seeking records to assist them audit or investigate another health care provider or group of individuals. More times than not, though, receipt of a 504.3 demand, particularly one served by OMIG or MFCU, is an indication that you or your business is about to be audited or are currently under investigation. As previously noted, a request for original records can indicate the investigation is focused on an allegation of forgery. Knowing the difference between the two is critical. Asking for information from the requesting regulator, however, needs to be friendly and informational rather than confrontational; by asking too many questions or asking questions harshly, you inadvertently raise the suspicions of the regulator when they previously had none.
Still, an early warning of, or insight about, an audit or an investigation allows you to proactively address the underlying issue. Proactive engagement with an investigative or prosecutorial agency can provide key information into why the records are being sought. This information can help your manage the forthcoming disruption to your business, reduce the harm ultimately imposed on it, and on occasion, end the audit or investigation before you or your company suffer any financial or reputational harm. So, upon receipt of a 504.3 demand letter, don’t reactively comply. Instead, stop, talk, and then comply. And consider seeking the guidance and assistance of an attorney. In the long run, time spent thoroughly addressing a 504.3 demand request up front, prior to complying, will save you time, headaches, and money.
If you have any questions regarding the content of this blog, please contact Chris Shaw, partner, at cshaw@barclaydamon.com, or another member of the firm’s Health Care Controversies Team.
iSee Kasin v. Novello 303 AD2d 910.
iiSee 18 NYCRR § 515[a]1] and [b][6].
iiiKasin v. Novello, supra [upholding a 10 percent withhold]; Checker Transportation v. Office of the Medicaid Inspector General of NYS, 2019 NYLJ LEXIS 1670 [May 6, 2019] [upholding a 100 percent withhold that was later reduced by OMIG, on its own, to 15 percent].
ivSee 18 NYCRR § 504.3[a].