OIG Intensifies Scrutiny of Telehealth Services in Medicare and Medicaid Work Plan

The Office of Inspector General (OIG) for the U.S. Department of Health and Human Services (HHS) plays a critical role in protecting the integrity of federal healthcare programs, including Medicare and Medicaid. Each year, the OIG publishes its Work Plan, outlining the audits, evaluations, and investigations it plans to conduct during the upcoming fiscal year. A consistent and increasingly prominent theme in recent OIG Work Plans has been the rigorous oversight of telehealth services, reflecting the dramatic expansion of virtual care delivery, particularly since the COVID-19 Public Health Emergency (PHE).

The OIG's Mandate and Telehealth Oversight

The OIG's mission is to detect and prevent waste, fraud, and abuse in HHS programs and to promote economy, efficiency, and effectiveness. With the rapid adoption of telehealth, the OIG recognized the necessity of ensuring that these services are provided appropriately, are medically necessary, and are billed correctly. While telehealth offers undeniable benefits in terms of access and convenience, its rapid expansion also introduced new vulnerabilities for fraud and abuse, which the OIG is committed to addressing.

Key Areas of OIG Scrutiny

The OIG's work in telehealth typically focuses on several key areas, which are regularly highlighted in their annual Work Plans and subsequent reports:

• Medical Necessity and Appropriateness of Services: The OIG examines whether telehealth services billed to Medicare and Medicaid were medically necessary and appropriate for the patient's condition. This includes scrutinizing services that may have been overutilized or provided without sufficient clinical justification.
• Billing and Coding Compliance: Audits frequently review claims data to identify incorrect billing practices, such as upcoding (billing for a more expensive service than provided), unbundling (billing separately for services that should be billed together), or billing for services not rendered. The correct use of telehealth modifiers (e.g., GT, GQ, 95) and place of service codes is also a focus.
• Compliance with Telehealth Requirements: This involves verifying adherence to specific program rules, such as patient consent requirements, the use of appropriate technology, and, where applicable, originating and distant site requirements (though many of these were relaxed during the PHE).
• Provider and Patient Eligibility: The OIG investigates whether providers furnishing telehealth services are appropriately licensed and whether patients receiving services are eligible for Medicare or Medicaid benefits.
• Telehealth Prescribing Practices: With the expansion of telehealth, the OIG also examines prescribing patterns, particularly for controlled substances, to ensure compliance with federal and state regulations and to prevent diversion and abuse.
• Impact of PHE Flexibilities: A significant part of the OIG's recent work has been evaluating the impact of the temporary telehealth flexibilities granted during the COVID-19 PHE. This includes assessing the extent to which these flexibilities were utilized, their effect on program expenditures, and identifying potential areas of fraud that emerged during this period.

Evolution of OIG Telehealth Work Plan Priorities

Prior to the PHE, OIG's telehealth oversight was more limited, often focusing on specific services or geographic areas. However, with the dramatic increase in telehealth utilization during the PHE, the OIG significantly expanded its focus. For example, the Fiscal Year (FY) 2021 Work Plan explicitly stated plans to review Medicare telehealth services provided during the PHE to identify program integrity risks. This included audits of services with high utilization and those that posed a greater risk for fraud, such as evaluation and management (E/M) services and behavioral health services.

In subsequent Work Plans, such as for FY 2022 and FY 2023, the OIG continued and deepened its commitment to telehealth oversight. The OIG announced reviews of Medicare Part B telehealth services for appropriateness and medical necessity, particularly focusing on the rapid increase in certain service types. They also initiated evaluations of Medicaid telehealth services, recognizing the unique challenges and opportunities within state-administered programs.

Recent OIG publications and statements reinforce this ongoing priority. For instance, the OIG has published reports detailing vulnerabilities in Medicare telehealth services, identifying millions in potentially inappropriate payments. These reports often recommend actions for the Centers for Medicare & Medicaid Services (CMS) to strengthen oversight and implement new safeguards.

Examples of OIG Telehealth Audits and Reports

• Review of Medicare Telehealth Services During the COVID-19 Public Health Emergency: This audit examined the types of services provided, billing patterns, and potential program integrity risks associated with the significant increase in telehealth use. (Source: OIG.hhs.gov, A-01-20-00002)
• Evaluation of Medicare Part B Telehealth Services for Appropriateness and Medical Necessity: This ongoing work assesses whether certain telehealth services, such as E/M visits and mental health services, meet program requirements. (Source: OIG.hhs.gov, A-01-21-00500)
• Audits of Specific High-Risk Telehealth Services: The OIG has also targeted specific services, such as remote patient monitoring or certain behavioral health services, where billing complexities or high utilization may indicate fraud vulnerabilities.

Implications for Healthcare Businesses

The OIG's consistent prioritization of telehealth oversight means that healthcare providers and organizations engaged in virtual care delivery must prioritize compliance. This is not a temporary measure but a fundamental shift in the regulatory landscape.

For Telehealth Providers and Platforms:

• Robust Compliance Programs: Implement and regularly update a comprehensive compliance program that specifically addresses telehealth risks. This should include policies and procedures for billing, documentation, medical necessity, patient consent, and data security.
• Meticulous Documentation: Ensure all telehealth encounters are thoroughly documented, clearly justifying the medical necessity of the service, the patient's condition, the treatment plan, and the time spent. Documentation should reflect that the service provided via telehealth was equivalent to an in-person service where applicable.
• Billing Accuracy: Train staff on correct CPT/HCPCS codes, modifiers (e.g., 95, GT, GQ), and place of service codes for telehealth. Conduct regular internal audits of billing practices.
• Provider Credentialing and Licensing: Verify that all providers delivering telehealth services are appropriately licensed in the state where the patient is located and are credentialed with the relevant payers.
• Fraud Detection Systems: Implement systems to monitor for unusual billing patterns, high utilization rates for specific services, or other indicators of potential fraud or abuse.

For Medspas, Dental Practices, and Chiropractic Offices:

While these specialties may not always bill extensively to Medicare or Medicaid for all services, any services they do bill to federal programs via telehealth will be subject to OIG scrutiny. Furthermore, the OIG's focus on medical necessity and appropriate documentation sets a precedent that can influence state regulatory bodies and private payers for all telehealth services.

• Understand Scope of Practice: Ensure that any telehealth services offered comply with state scope of practice laws for the specific specialty and provider type.
• Medical Necessity for Ancillary Services: If offering telehealth for consultations related to procedures or services, ensure the medical necessity for the telehealth encounter itself is well-documented.
• Partnerships: If partnering with other providers or telehealth platforms that bill federal programs, ensure those partners also have robust compliance programs to mitigate your own risk.

Conclusion

The OIG's persistent focus on telehealth in its annual Work Plan underscores the agency's commitment to safeguarding federal healthcare programs from fraud, waste, and abuse in the evolving landscape of virtual care. Healthcare businesses engaged in telehealth must view this as a permanent fixture of the regulatory environment. Proactive investment in robust compliance infrastructure, meticulous documentation, and continuous monitoring of billing practices is not merely advisable; it is essential for mitigating risk and ensuring long-term operational integrity.