Outsourcing Medical Billing and Coding: Risks, Safeguards, and Best Practices
Outsourcing medical billing and coding is the practice of hiring an external company to handle the submission and management of health insurance claims and patient billing and, potentially, the coding of services based on documentation, rather than employing in-house staff to perform these roles in revenue cycle management.
Outsourcing of coding, billing, or both can occur to contractors who are either onshore (in the same country) or offshore (in a different country).
Some healthcare providers consider outsourcing medical coding and billing functions because of their complexity and because of the costs to hire and maintain competent staff. When evaluating options for potential outsourcing, it is critical to include in the decision-making process an analysis of the potential risks, whether the contractor is onshore or offshore.
While many of the risks and benefits of outsourcing are common to both, offshore outsourcing introduces additional risks to be considered. The following highlights key risk areas that healthcare providers should consider when evaluating the risks and benefits of outsourcing coding, billing, or both to either an onshore or offshore contractor.
Outsourcing Risk: HIPAA Compliance
Compliance with the Health Insurance Portability and Accountability Act (HIPAA) is the most common concern when considering outsourcing of coding and/or billing functions. Most healthcare providers understand that external coding and billing companies are, by law, considered business associates and, therefore, a HIPAA business associate agreement is necessary.
But providers often perform little analysis relative to whether the potential business associate (1) has appropriate policies and procedures in place and (2) has implemented those policies effectively to ensure compliance.
Without conducting a compliance audit (or having a competent compliance auditor conduct one), how certain can the healthcare provider be that the potential business associate has effective policies and procedures in place to protect the integrity of protected health information (PHI)? This question is important because the healthcare provider will share PHI routinely during the term of the engagement with the business associate.
HIPAA Privacy Compliance
Healthcare providers, as covered entities, are responsible for any breach caused by their agents, which include business associates that will have access to their patients’ PHI. Healthcare providers must, at a minimum, require coding and billing services, whether onshore or offshore, to have and be able to produce privacy policies and procedures to ensure HIPAA compliance.
Simple review of those policies and procedures will not reveal whether the potential business associate has actually implemented those policies and whether they are effective in actual practice.
While the healthcare provider can query the business associate’s staff to gauge their knowledge of HIPAA Privacy and Security Rule issues, most healthcare providers do not have the expertise to conduct such an investigation. Simply hoping the potential business associate will safeguard PHI appropriately creates substantial risk to the healthcare provider in the event of a breach.
Consider also that many outsourced coding and billing services employ remote workers. Healthcare providers should confirm whether the use of, access to, storage of, and disclosure of PHI by and between remote employees is accounted for in the policies and procedures, especially in reference to the location where the remote worker is doing work.
During the COVID public health emergency, many medical coders and billers worked from home in nondedicated office spaces, and this trend continues today. Because of this, healthcare providers should require analysis to determine who has access to the system on which PHI is stored, where those individuals are located, and what local safeguards are in place to ensure the PHI will not be inappropriately disclosed.
Additionally, analysis is necessary regarding what printed (hardcopy) PHI exists and how it is protected. Healthcare providers should conduct such analysis for each remote outsourced coding or billing service staff member.
HIPAA Security Compliance
Because PHI will no doubt be transferred back and forth between the healthcare provider and the business associate (the coding or billing service), the respective security risk assessments should account for how PHI is moved between entities and stored electronically. This means that both entities would be required to update their security risk assessment and, as a result, security policies and procedures upon agreement of a new contract.
The healthcare provider should understand key points such as what billing systems the coding or billing service uses, how it stores data (encrypted or nonencrypted), whether the healthcare provider has free right of access to such data during and following termination of the contract, and in what format the data should be sent.
Unfortunately, many healthcare providers overlook the HIPAA Security Rule implications of outsourcing arrangements, resulting in significant potential liability.
State Privacy Law Compliance
The healthcare provider also must validate whether the potential business associate has adequate policies and procedures in place to comply with any additional requirements due to privacy rules for states in which they practice. This is true regardless of where the potential business associate is located.
Too often, to the extent the business associate has implemented effective policies and procedures at all, the business associate is focused only on the federal HIPAA regulations, overlooking additional obligations under the state laws that apply where their clients are located. This oversight could expose the healthcare provider to potential liability.
Outsourcing Risk: Fraud and Abuse
Fraud and abuse are two additional concerns for healthcare providers considering outsourcing their coding and billing.
Because small physician practices generally do not have the resources for proper implementation, a formal fraud and abuse compliance plan is not required for these healthcare practices under guidance from the Department of Health & Human Services Office of Inspector General (HHS OIG).
Such guidance does, however, exist for third-party billing companies and, as a result, legal experts highly recommend engaging with an outsourced third-party only if the entity can demonstrate implementation of effective fraud and abuse compliance policies and procedures.
Coding and billing services often receive payment based on the value of the reimbursement obtained through claims, so there is an incentive for the outsourced billing service to code inappropriately to increase revenue. This is not to say that coding and billing service companies generally engage in such conduct.
The point is that a healthcare provider considering hiring a coding or billing company needs to minimize potential risk. It is therefore reasonable for providers to require assurance in this regard by demanding that outsourced coding and billing contractors demonstrate implementation of appropriate fraud and abuse compliance policies.
Outsourcing Risk: Scope of Work and Staff Competence
When considering hiring a coding or billing company, healthcare providers need a clear picture of what they want the company to be responsible for.
To define precisely the scope of work expected by the potential business associate, the healthcare provider should ask certain questions. For example:
Does the healthcare provider intend for the potential business associate to review documentation and assign appropriate CPT®, HCPCS Level II, and ICD-10-CM codes for billing, as well as prepare and submit claims? Or, in the more common alternative, will the contractor only be responsible for submitting claims using the CPT®, HCPCS Level II, and ICD-10-CM codes assigned by the provider?
What is the healthcare provider’s expectation about handling collection work, such as resolution of denials and patient billing?
Too often, there is confusion regarding the scope of work. The healthcare provider may have the expectation that the potential business associate will code, or at least correct the provider’s coding, and perform all necessary collection work, even when the coding and billing service agreement says otherwise.
Regardless of the scope of work defined in the agreement, the healthcare provider must ensure that the potential business associate’s staff is competent to do the work called for under the agreement. Where correct coding is the obligation of the outsourced contractor, the healthcare provider should confirm the coding staff will perform such work in accordance with the coding guidelines and payment policies established by each payer involved rather than taking a one-size-fits-all approach.
While all payers must accept the CPT® and HCPCS Level II codes, individual payers can implement their own code selection policies and their own reimbursement rules. Therefore, a one-size-fits-all approach to coding and billing will no doubt lead to errors.
Validating individual staff member credentials should be sufficient for the healthcare provider to confirm the competence of the staff. But the provider also should verify that the credentialed individuals are actually doing the work. To help support this goal, healthcare providers may consider including compliance metrics as a component of the compensation schedule. Such metrics would be evaluated through concurrent auditing of the claims prepared by each member of the outsourced service’s team.
The accuracy rate achieved, as defined in the compensation schedule, can then be a factor in the amount of payment the service is entitled to receive for the work performed. As an example, a billing service might only be entitled to 5 percent of the collected amount as compensation where the accuracy rate falls below 90 percent but could earn 6.5 percent for achieving an accuracy rate between 90-95 percent and 7.5 percent for achieving an accuracy rate above 95 percent.
Outsourcing Risk: Loss of Control
Any time a function is outsourced, the healthcare provider loses control over that function. The result is the inability to effectively identify and correct issues before they become big problems.
Coding and billing functions performed in-house suffer the same potential problem if periodic internal auditing is not performed, but the geographic displacement of outsourced coding and billing activities exacerbates the potential for such a problem. Consequently, outsourcing creates an enhanced obligation to validate that work is being performed correctly.
In other words, while healthcare providers can outsource the obligation to perform the actual coding and billing functions, the provider does not eliminate the obligation to validate that the work is being performed correctly. Therefore, outsourcing creates an enhanced obligation to create an effective internal audit program, especially where the outsourced entity’s compensation is tied to their accuracy rate.
Outsourcing Risk: Notices and Record Requests
When a healthcare provider outsources coding or billing, correspondence from the payer, such as explanations of benefits (EOBs), may be directed to the contracted coding or billing service. Healthcare providers should be sure the contractor understands that they must forward any request for records, especially postpayment record requests from third-party insurance carriers, to the provider immediately.
Many such insurance carrier audit-related requests are time sensitive. In some instances, healthcare providers have been subject to a postpayment record request, but the coding or billing service ignored it. This may be because handling such requests wasn’t within the service company’s defined scope of work. As a result, the healthcare providers missed a submission deadline and became subject to substantial financial liability.
Offshore Outsourcing Risks
Healthcare providers must consider the additional risks that arise when a potential business associate is operating in another country. This includes communications difficulties when both parties operate in substantially different time zones.
Beyond that, when the coding or billing entity is in a foreign country, it is more difficult for the healthcare provider to validate whether representations about expertise, compliance, and the locations where work is actually being performed are accurate. While the company may indicate that coding and billing staff are certified and working from a defined business location, can the healthcare provider really be sure that those individuals are the ones doing the work and working where the company says they are?
Validating that such representations are accurate to a sufficient degree of certainty is virtually impossible without a site visit. Healthcare providers should also consider the additional difficulty associated with conducting a legitimate analysis of that entity’s HIPAA Privacy Rule and Security Rule compliance.
Healthcare providers also should think about the additional level of difficulty associated with raising a breach of contract claim in a local court for a foreign entity. Assuming a positive verdict for the healthcare provider, the next difficulty is enforcing such a judgment. Dealing with notices from contracted payers is also a potentially enhanced problem.
The same concerns exist relative to post-termination obligations. The offshore coding or billing service may be obligated under the terms of the agreement to return the provider’s PHI when the contract terminates, but what if they don’t or do so in an unusable format?
Unfortunately, there is no surefire way to enforce contract terms, let alone effectively or efficiently litigate for and collect damages, if the offshore coding or billing service does not perform to expectations. Without the ability to enforce the promises made by such an entity in an agreement, the contract provides no real protection.
How to Mitigate the Risks of Outsourcing Coding and Billing
Healthcare providers who determine that the cost benefits outweigh the risks and decide to outsource their coding, billing, or both to an onshore or offshore contractor can take steps to prevent issues by working with experts in compliance and the law.
As a first step, healthcare providers should strongly consider the engagement of a compliance auditor. The auditor should evaluate the healthcare provider’s privacy and security policies and procedures, particularly in relation to allowing access to or disclosure of PHI to the potential business associate. The auditor also should evaluate the sufficiency and effectiveness of the potential business associate’s policies and procedures in terms of privacy and security.
Engaging legal counsel is also beneficial when considering outsourcing. Healthcare providers often enter into coding and billing service agreements that are drafted by the business associate. As such, those agreements tend to be very one-sided, protecting the coding and billing service while providing little protection to the provider. The provider should engage counsel to negotiate the terms of the arrangement fairly.
This step will help ensure that the provider is appropriately protected. Healthcare providers should consider including the items below in any outsourcing agreement for coding or billing functions.
Require HIPAA Compliance
Outsourcing agreements should include provisions that impose an affirmative obligation by the potential business associate to comply with HIPAA privacy and security regulations, as well as any identified state privacy laws. This obligation should be subject to validation by the healthcare provider and require the potential business associate to demonstrate compliance by sharing the results of its own audit conducted by a competent compliance auditor.
Spell Out Responsibility for Breaches
The agreement between the healthcare provider and the potential business associate should detail who is responsible for responding to a breach. This is often an included provision in the HIPAA business associate agreement. Where the healthcare provider retains the obligation and, therefore, control of messaging to its patients, the agreement should include an indemnification provision. Indemnification provisions in contracts are a means of shifting potential damages associated with a breach to the party that caused the breach.
In such contractual provisions, the potential business associate should agree to indemnify (compensate) the healthcare provider for costs and any potential penalties imposed by the HHS Office for Civil Rights or any state agency if the business associate is responsible for the breach.
A word of caution is appropriate here, however. Healthcare providers should be certain the potential business associate has the financial resources (either in cash or from liability insurance coverage) to back up their agreement to indemnify the providers of such costs.
If the potential business associate asserts they have insurance coverage, the healthcare provider should have counsel review the policy language and potentially require the healthcare provider to be listed as an additional insured party on the policy.
Confirm Qualified Staffing
Coding and billing services contracts should require disclosure of the names of all individuals who will be performing work under the services agreement, including periodic affirmations that staff have not changed.
The agreement should also impose an affirmative obligation to provide immediate notification to the provider when a change in staff does occur. This is important for ensuring that the outsourced contractor is not using any individual who has been excluded by Medicare if Medicare billing is involved.
The healthcare provider should also consider conducting periodic background checks of the vendor’s employees, the same as it would for direct employees. Alternatively, the services agreement could impose an affirmative obligation to share the results of the vendor’s own background investigation, as well as periodic updates. If such information cannot be provided, it likely means they have not performed such checks.
Ensure All Staff Are Certified
Another reason for identifying the individuals who will be performing the medical coding and billing work is to confirm that they are competent to do the work. To meet the growing demand for outsource work, vendors may hire new, inexperienced staff. Service contracts should require all outsourced staff to be certified and hold an active, recognized credential.
Such a provision prevents the service from listing qualified individuals when, in fact, the work is delegated to unqualified and noncertified staff members. Certification demonstrates proven competence and ensures that staff are keeping current with annual code set updates, guidelines, and regulatory requirements. Partnering only with certified professionals upholds the same high standards providers expect from an in-house team.
Include Compliance Metrics in Compensation Schedule
Healthcare providers should negotiate to include compliance metrics as a component of the compensation schedule for coding and billing services. Such provisions should impact compensation significantly to incentivize compliance efforts by the contracted service company.
Such provisions should involve performance of regular compliance audits (by the healthcare provider or its compliance auditor) to ensure that the billing or coding service is performing the contracted work accurately. Remember, it is ultimately the healthcare provider that is responsible for the accuracy of claims submissions.
Hoping that the contracted coding or billing service is doing its job provides little assurance, let alone protection against postpayment allegations of error and associated repayment demands. Figuring out two or three years down the road that there was an error rate causing liability to the healthcare provider is too late. The compliance of coding and billing activities performed by contracted services should be evaluated routinely no differently than if these activities were performed in-house.
Outline Breach of Contract Obligations
The agreement between the healthcare provider and coding or billing service should outline clear actions that both parties are responsible for when one party alleges a breach by the other party. A written contract truly becomes necessary only when the relationship breaks apart due to allegations of a breach. As such, the contract must address the obligations of each party when a breach is alleged so the issue can (hopefully) be resolved without litigation.
The breaching party should be given the opportunity to cure any noncompliance or, alternatively, demonstrate that no breach of the agreement occurred. To prepare for resolving continuing disagreements, healthcare providers also should consider including mediation obligations followed by a binding arbitration provision, if necessary. These steps can help ensure that resolution of disputes can occur efficiently.
Healthcare providers also should establish jurisdiction for any alleged breach under their local state laws and, in the absence of a binding arbitration provision, in their local courts.
Weighing the Risks and Benefits of Outsourcing
The justification for outsourcing medical coding and billing is often the expectation of cost reductions. If all goes well, the healthcare provider might realize such cost reductions (as compared to the cost of maintaining competent in-house staff to do these tasks). Too often, however, the healthcare provider overlooks costs associated with identifying and qualifying a responsible out-of-house coding or billing service.
To mitigate the risks of outsourcing, the healthcare provider should engage counsel to negotiate the agreement with the external contractor. The healthcare provider also should engage compliance auditors to evaluate whether the coding or billing service has the capability and competence to perform as expected.
During the term of the agreement, the healthcare provider will need compliance assistance to ensure that the coding and billing services meet obligations related to the HIPAA Privacy and Security Rules and state privacy rules, as well as compliance with rules to prevent fraud and abuse.
Healthcare providers should not overlook these costs when evaluating whether outsourcing coding and billing functions will be cost effective. Any providers who ignore these mitigation strategies must consider the cost associated with lost revenue due to poor collection performance, coding errors, and postpayment recovery liability if a payer detects errors.
Only after careful consideration of the risks and potential benefits can the healthcare provider make a responsible decision about outsourcing medical coding and billing.
