The Hotline Report About the Billing Manager
An anonymous hotline report alleges that a billing manager 'upcodes' visits to the highest-level E/M code when physicians leave documentation thin, and that she 'has been doing it for years and everyone knows.' The compliance officer pulls a sample: the manager's own accounts show 71% level-5 E/M codes versus a peer average of 22%. The manager is well-liked, has 19 years of tenure, and is the only person who knows the legacy billing system. The reporter's identity is unknown. The COO asks the compliance officer to 'just have a conversation and get it straightened out' before involving HR or legal.
1. Assess the COO's proposed approach. What are the risks of an informal conversation first?
Read the worked answer
The COO's suggestion is well-intentioned but creates several risks:
- Evidence destruction/tipping off. An informal conversation alerts the subject before documents, system logs, and audit trails are preserved. The manager controls the billing system - the very place evidence lives.
- Retaliation exposure. Even a 'conversation' can become the basis for a retaliation claim if the subject later faces discipline; and if the reporter is identified through the process, whistleblower protections are implicated.
- Undocumented process. An informal chat produces no reliable record, undermining the organization's ability to demonstrate a good-faith investigation (relevant to DOJ/OIG cooperation credit under the ECCP and to the FCA's reverse false claims/60-day repayment analysis).
- Conflict/independence. The COO directing the compliance response blurs independence; the compliance officer should own the investigation with counsel.
The right move: preserve first (litigation hold on billing records and system logs), then investigate under privilege with counsel, then decide on interviews. The tenure and 'only person who knows the system' facts are a business-continuity issue, not a reason to skip process.
2. Outline the investigation plan, including how to handle the single-point-of-failure risk.
Read the worked answer
Plan:
- Preserve. Issue a litigation hold; image/export the manager's billing-system activity, override logs, and the sampled claims. Do not delete or 'clean up.'
- Scope and quantify. Expand the sample across the manager's accounts and peer benchmarks; compare documentation to code levels; estimate overpayment exposure. Determine whether others knew or participated ('everyone knows' - test it).
- Privilege and independence. Engage counsel to direct the investigation; compliance runs the workstream; keep the COO informed but not directing.
- Interviews. Interview the manager last, after documents are secured; interview peers and supervisors about knowledge and pressure. Preserve anonymity of the reporter as far as possible.
- Single-point-of-failure. Treat the legacy-system dependency as a separate risk: document the manager's system knowledge, arrange cross-training and access controls, and ensure the investigation does not depend on her cooperation to retrieve records. Do not let the business-continuity concern become leverage to soften the inquiry.
- Outcome. Decide discipline consistent with policy and past practice; assess overpayment/repayment and self-disclosure; document root cause (documentation pressure, coding oversight) and corrective action (coder audits, edit checks, training).