Medicare and Medicaid have consistently been targets for fraudulent conduct because of their size and complexity. Private health care insurance carriers are also vulnerable to fraud due to the immense volume of claims they receive and process. Those who commit fraud against public health insurers are also likely to engage in similar conduct against private insurers. The Coalition Against Insurance Fraud estimates that in 1997 fraud in the health care industry totaled about $54 billion nationwide, with $20 billion attributable to private insurers and $34 billion to Medicare and Medicaid. In addition to losses due to fraud, the Department of Health and Human Services’ OIG has reported that billing errors, or mistakes, made by health care providers were significant contributors to improperly paid health care insurance claims. The OIG defined billing errors as (1) providing insufficient or no documentation, (2) reporting incorrect codes for medical services and procedures performed, and (3) billing for services that are not medically necessary or that are not covered. For fiscal year 2000, the OIG reported that an estimated $11.9 billion in improper payments were made for Medicare claims. In a March 1997 letter to health care providers, the Department of Health and Human Services’ IG suggested that providers work cooperatively with the OIG to show that compliance can become a part of the provider culture. The letter emphasized that such cooperation would ensure the success of initiatives to identify and penalize dishonest providers. One cooperative effort between the IG and health care groups resulted in the publication of model compliance programs for health care providers. The OIG encourages providers to adopt compliance principles in their practice and has published specific guidance for individual and small group physician practices as well as other types of providers to help them design voluntary compliance programs. A voluntary compliance program can help providers recognize when their practice has submitted erroneous claims and ensure that the claims they submit are true and accurate. In addition, the OIG has incorporated its voluntary self-disclosure protocolinto the compliance program, under which sanctions may be mitigated if provider-detected violations are reported voluntarily. Evaluation and management services refer to work that does not involve a medical procedure—the thinking part of medicine. The key elements involved in evaluation and management services are (1) obtaining the patient’s medical history, (2) performing a physical examination, and (3) making medical decisions. Medical decisions include determining which diagnostic tests are needed, interpreting the results of the diagnostic tests, making the diagnosis, and choosing a course of treatment after discussing the risks and benefits of various treatment options with the patient. These decisions might involve work of low, medium, or high complexity. Each of the key elements of evaluation and management services contains components that indicate the amount of work done. For example, a comprehensive medical history would involve (1) determining a patient’s chief complaint, (2) tracing the complete history of the patient’s present illness, (3) questioning other observable characteristics of the patient’s present condition and overall state of health (review of systems), (4) obtaining a complete medical history for the patient, (5) developing complete information on the patient’s social history, and (6) recording a complete family history. A more focused medical history would involve obtaining only specific information relating directly to the patient’s symptoms at the time of the visit. Providers and their staffs use identifying codes defined in an American Medical Association publication, titled Current Procedural Terminology (CPT), to bill for outpatient evaluation and management services performed during office visits. The CPT is a list of descriptive terms and identifying codes for reporting all standard medical services and procedures performed by physicians. Updated annually, it is the most widely accepted nomenclature for reporting physician procedures and services under both government and private health insurance programs. The CPT codes reported to insurers are used in claims processing, and they form the basis for compensating providers commensurate with the level of work involved in treating a patient. Accordingly, the higher codes, which correspond to higher payments, are used when a patient’s problems are numerous or complex or pose greater risk to the patient, or when there are more diagnostic decisions to be made or more treatment options to be evaluated. The CPT has two series of evaluation and management codes for outpatient office visits, one series for new patient visits and another for established patient visits. Each series of CPT codes has five levels that correspond to the difficulty and complexity of the work required to address a patient’s needs. The code selected by the provider to describe the services performed in turn determines the amount the provider will be paid for the visit. For example, under the current Medicare fee schedule for the District of Columbia and surrounding suburbs, a provider would be paid $39.30 for a new patient who is determined to have received services commensurate with a level 1 visit and $182.52 for a level 5 visit. Similarly, payments for level 1 and level 5 visits by an established patient are $22.34 and $128.03, respectively. The two workshops we attended provided certain advice that is inconsistent with the OIG guidance and that, if followed, could result in violations of criminal and civil statutes. Specifically, at one workshop the consultant suggested that when providers identify an overpayment from an insurance carrier, they should not report or refund the overpayment. Furthermore, consultants at both workshops suggested that providers attempt to receive a higher-than-earned level of compensation by making it appear, through documentation, that a patient presented more complex problems than he or she actually did. Additionally, one consultant suggested that providers limit the services offered to patients with low- paying insurance plans, such as Medicaid, and that they discourage such patients from using the provider’s services by offering appointments to them only in time slots that are inconvenient to other patients. One workshop focused on the merits of implementing voluntary compliance programs. The consultant who presented this particular discussion explained that a baseline self-audit to determine the level of compliance with applicable laws, rules, and regulations is a required step in creating a voluntary compliance program. Focusing on “how to audit- proof your practice” and avoid sending out “red flags,” the consultant advised providers not to report or refund overpayments they identify as a result of the self-audit. The consultant claimed that reporting or refunding the overpayment would raise a red flag that could result in an audit or investigation. When asked the proper course of action to take when an overpayment is identified, the consultant responded that providers are required to report and refund overpayments. He said, however, that instead of refunding overpayments, physician practices generally fix problems in their billing systems that cause overpayments while “keeping their mouths shut” and “getting on with life.” Such conduct, however, could result in violations of criminal statutes. According to the most recent OIG Medicare audit report, the practice of billing for services that are not medically necessary or that lack sufficient diagnostic justification is a serious problem in the health insurance system. The OIG estimated that during fiscal year 2000, $5.1 billion was billed to insurance plans for unnecessary services. Intentionally billing for services that are not medically necessary may result in violations of law. Moreover, based on advice given at workshops that we attended during this investigation, we are concerned that insurers may be paying for tests and procedures that are not medically necessary because physicians may be intentionally using such services to justify billing for evaluation and management services at higher code levels than actual circumstances warrant. Specifically, two consultants advised that documentation of evaluation and management services performed can be used to create, for purposes of an audit, the appearance that medical issues confronted at the time of a patient’s office visit were of a higher level of difficulty than they actually were. For example, a consultant at one workshop urged practitioners to enhance revenues by finding creative ways to justify bills for patient evaluation and management services at high code levels. He advised that one means of justifying bills at high code levels is to have nonphysician health professionals perform numerous procedures and tests. To illustrate his point, the consultant discussed the hypothetical case of a cardiologist who examines a patient in an emergency room where tests are performed and the patient is discharged after the cardiologist determines that the patient has a minor problem or no problem at all. To generate additional revenue, the consultant suggested that the cardiologist tell the patient to come to his office for a complete work-up, even when the cardiologist knows that the patient does not have a problem. He advised that the work-up be performed during two separate office visits and that the cardiologist not be involved in the first visit. Instead, a nurse is to perform tests, draw blood, and take a medical history. During the second visit, the cardiologist is to consult with the patient to discuss the results of the tests and issues such as life style. The consultant indicated that the cardiologist could bill for a level 4 visit, indicating that a relatively complex medical problem was encountered at the time of the visit. The consultant made clear that the cardiologist did not actually confront a complex problem during the visit because the cardiologist already knew, based on the emergency room tests and examination, that the patient did not have such a problem. Another consultant focused on how to develop the highest code level for health care services and create documentation to avoid having an insurer change the code to a lower one. The consultant engaged in “exercises” with participants designed to suggest that coding results are “arbitrary” determinations. His emphasis was not that the code selection be correct or even that the services be performed, but rather that it is important to create a documentary basis for the codes billed in the event of an audit. He explained that in the event of an audit, the documentation created is the support for billing for services at higher code levels than warranted. During the exercises, program participants—all were physicians except for our criminal investigator—were provided a case study of an encounter with a generally healthy 14-year-old patient with a sore throat.