Unencrypted Laptop and a Bad Coding Audit in the Same Quarter
On March 3, the IT vendor for a six-physician orthopedic group confirmed that a stolen laptop contained an unencrypted export of 3,240 patients' names, dates of birth, procedure codes, and insurance identifiers, prepared for a payer audit. The billing manager created the export and has since left the practice. The laptop was taken from her car on February 27; the practice learned of the theft March 1. Separately, a compliance audit of 30 random Medicare established-patient claims found 24 billed 99214 where documentation supported 99213 or lower. The group billed $412,000 in 99214 claims to Medicare during the lookback year, at an average allowed amount of $128; the 99213 allowance is $92. The managing partner wants to 'wait and see if anyone notices' and to 'just refund the 24 charts.'
1. Is this a reportable breach, to whom, and by when? Address the managing partner's 'wait and see' position.
Read the worked answer
Unencrypted PHI is involved, so the encryption safe harbor at 45 CFR 164.514 does not apply and a breach is presumed unless a four-factor risk assessment rebuts it: the nature and extent of the PHI, the unauthorized recipient, whether the data was actually acquired or viewed, and the extent of mitigation. Names plus dates of birth plus procedure codes plus insurance identifiers is a strong identity-theft and insurance-fraud profile; a thief who takes a laptop from a car is an unidentified recipient. The presumption will not be rebutted.
Obligations:
- Notify affected individuals without unreasonable delay and no later than 60 days from discovery. Discovery is when the practice knew or by reasonable diligence should have known - argue for March 1, not March 3; either way the clock is running.
- Notify HHS contemporaneously via the portal (a <500-individual incident may be logged annually, but the 3,240 count is likely below the 500-per-state media threshold only if the patients are widely distributed - verify by state).
- Check state law: several states require attorney general notice and have shorter timelines than 60 days.
- Document the risk assessment, the notification list, and the method of notice.
'Wait and see' is the worst option: the practice cannot make a knowing-risk determination, and an undocumented decision not to notify is itself a violation and a likely aggravating factor in any OCR resolution. Also confirm whether the departed manager's access was terminated on her last day and whether the practice can still show the export's contents.
2. How much is actually owed on the coding findings, and should the practice refund 24 charts, extrapolate, or self-disclose?
Read the worked answer
Do not treat the whole claim as the overpayment. The overpayment is the difference between what was billed and what the documentation supported, not the full $128.
- Naive calculation: 80% × $412,000 = $329,600 - wrong, and it overstates exposure by a factor of three.
- Correct: $412,000 ÷ $128 ≈ 3,219 claims. At an 80% error rate, ~2,575 claims were miscoded. If the documentation supported 99213, the differential is $128 − $92 = $36, so the identified overpayment is ≈ 2,575 × $36 ≈ $92,700.
That figure assumes every miscoded claim supported a clean 99213. Re-review stratified by clinician and by month; some charts may support 99213, some 99212, and a few may be defensible (a prolonged-service or independent-historian element the coder missed). Use a certified coder who did not perform the original coding.
Process: the 60-day overpayment rule requires returning identified overpayments once quantified. Refunding the 24 sampled charts alone is not credible when sampling was random and the rate is 80% - the practice has reason to believe similar errors exist. Options are a voluntary refund with a statistically valid extrapolation, or the OIG Self-Disclosure Protocol if a Stark or Anti-Kickback issue emerges (for example, if the level-4 pattern correlates with a physician's ownership in an ancillary service). Engage health care counsel to direct the review so the work product is privileged, and fix the root cause - a coding pattern this uniform usually reflects either a template default or a productivity incentive, not random error.
3. The compliance program consists of a binder and an annual signature sheet. Should the group hire a part-time compliance officer at $85,000, or assign the duties to the existing practice manager? Advise.
Read the worked answer
The practice manager is the wrong choice, and not because of capability. The manager supervises billing, scheduling, and front-desk staff - the same functions being audited. A compliance function that reports to the person whose operations are under review cannot credibly investigate itself, and the OIG's and DOJ's effectiveness criteria emphasize independence, authority, and direct access to leadership (the governing body), not just the existence of a policy manual.
$85,000 against $2.45 million in collections is ~3.5% of revenue, which is high for a six-physician group. Practical middle options:
- Fractional compliance officer at 15–20 hours a month ($25,000–$35,000) with a written charter, direct reporting to the board, and authority to escalate.
- A compliance committee (one physician champion, the practice manager, the fractional officer) meeting quarterly with minutes.
- Keep the practice manager responsible for operations under the program and explicitly exclude them from auditing their own areas.
Whatever the structure, fund the basics: a code of conduct, documented training, a coding and billing audit plan with defined sampling and frequency, an anonymous reporting mechanism, a non-retaliation policy, and an investigation protocol with timelines. Any corrective action plan submitted to a payer or the OIG will be judged on whether these operate, not whether they are documented.