No Surprises Act Called Out as Top Management Risk

A new report calls out the risk found within the No Surprises Act, including the civil monetary penalties for each violation in which a patient receives a surprise medical bill.

A new report, “25 Top Management Risks for Healthcare in 2023,” published by Crowe LLP, outlines the leading risks internal audit professionals and compliance departments are facing at their healthcare organizations. One highlighted risk has been on the radar of revenue cycle leaders for years now: the No Surprises Act.

For the report, Crowe identified 25 top management risks facing healthcare organizations in 2023 using input from executive management and board members at many of the largest U.S. health systems. The report also used input from risk assessments conducted by the company at hundreds of health systems, hospitals, and other healthcare provider clients during 2022.

One of the biggest risks tied to the No Surprises Act is compliance and monetary penalties, the report said.

CMS has begun to audit providers and payers for noncompliance with certain requirements.

Because of the added oversight from CMS, the report says risks associated with the NSA include the civil monetary penalties for each violation in which a patient receives a surprise medical bill, and the negative reputational risks resulting in lost revenue for facilities and providers.

The report says that auditing process effectiveness and compliance can help organizations mitigate those risks.

The use of technology can also help to expand NSA risk coverage, the report says. For example, using data analytics to determine whether actual billed charges are within $400 of a good faith estimate (GFE), analyzing compliance with GFE timing requirements, and using data analytics to identify potential balance billing exceptions, are all positive uses of technology to mitigate risk.

In the report, Crowe defined a risk area as anything that might impede a healthcare organization’s ability to achieve its goals in critical areas such as patient care, regulatory compliance, operations, strategic growth, and financial performance.

To manage an environment of increasing risks and limited resources, healthcare internal audit and compliance departments must align their risk assessments and audit work plans to areas most vital to achieving the strategic goals and business objectives of their organizations. The departments must do so while staying in compliance with critical regulatory and other requirements, the report said.