25.29 — Measuring Quality, Paying for Value, and Fighting Fraud

Two family doctors have panels of about two thousand patients each. In the first practice, 82 percent of diabetic patients have had their blood sugar control checked in the past year, 71 percent have had their eyes examined, and readmissions after hospital stays are below the regional average. In the second, the equivalent figures are 54 percent, 38 percent, and above average.

Under traditional payment, both are paid the same way: per visit, per procedure. The second doctor may earn more, because uncontrolled diabetes generates more visits.

Everything in the first half of this chapter is the attempt to fix that. Everything in the second half is what happens when people game whatever measurement you build.

What a quality measure actually is

A measure is a defined calculation: a numerator, a denominator, exclusions, and a time window. The specification has to be exact enough that two organisations computing it from the same data get the same answer.

Measures come in four types and the distinction matters when someone argues about them.

Process measures count whether a recommended action happened — the eye examination, the vaccination, the follow-up call after discharge. They are easy to compute from claims data, quick to influence, and their weakness is that doing the action is not the same as helping the patient.

Outcome measures count what happened to patients — readmissions, complications, control of blood pressure, mortality. They are what people actually care about, and they are hard, because outcomes depend heavily on who your patients were to begin with.

Patient experience measures come from standardised surveys asking patients about access, communication and coordination.

And structural measures describe capability — whether the practice has an electronic record, whether the hospital has a particular service available.

Two adjustments make the comparison fair, and both generate substantial engineering work.

Risk adjustment. A hospital treating sicker patients will have worse raw outcomes, so measures are adjusted for the case mix. The adjustment model is always contested, because it determines who looks good.

Attribution. Deciding which clinician or organisation is accountable for a patient who saw eleven different providers this year. Attribution rules are usually based on who delivered the most primary care, and they are a recurring source of dispute — clinicians object, reasonably, to being measured on patients they barely saw.

HEDIS: the measurement set that runs American health plans

HEDIS — the Healthcare Effectiveness Data and Information Set, maintained by the National Committee for Quality Assurance — is the dominant quality measurement set for health plans. The great majority of American health plans report it, which makes it the standard vocabulary for plan quality.

It covers around ninety measures across domains such as effectiveness of care, access and availability, experience of care, and utilisation. Familiar examples: control of blood pressure and blood sugar in the relevant populations, screening for breast and colorectal cancer, childhood immunisation status, follow-up after a mental health hospitalisation, and medication adherence.

How the data is collected is the part that determines what your project looks like.

The administrative method computes the measure from claims and enrolment data alone. Cheap, complete, and blind to anything not billed.

The hybrid method takes a sample of the eligible population and supplements claims with information pulled from medical records — historically a large, seasonal, manual chart-chasing operation.

And the electronic method computes measures from structured clinical data taken directly from records and health information exchanges. This is where the field is heading: measures defined so they can be computed digitally from standardised clinical data rather than reconstructed from billing. The migration towards digital measures built on standard health data formats is the most significant current change in this area, and it converts an annual chart-abstraction scramble into a data engineering problem.

Reporting is annual, on a defined cycle: a measurement year, then compilation and an independent audit, then submission. The audit exists because these numbers determine money and reputation, and it examines both the data and the processes that produced it — which means the systems that compute HEDIS measures are subject to their own scrutiny.

And the reason it is used for longitudinal profiling — following the same population year over year — is that consistent specifications make trends meaningful. A plan can see whether its diabetic population's control is improving, which providers are improving fastest, and where a care management programme actually changed something. That is a genuinely useful analytics platform to build, and it is one of the more common healthcare data engagements.

Star ratings, and why plans care so much

Medicare Advantage and Part D plans receive an overall rating from one to five stars, built from around forty measures spanning clinical quality drawn largely from HEDIS, patient experience surveys, complaints and appeals, and administrative performance.

The reason plans reorganise themselves around it is money and market position. Plans achieving high ratings receive quality bonus payments, which are substantial, and the rating is displayed to consumers choosing a plan. A drop of half a star can move hundreds of millions of dollars for a large plan, which is why star performance is a board-level topic and why the analytics around it are so heavily invested in.

Measures are weighted, with outcome and patient experience measures generally counting more than process measures, and the thresholds move each year based on how everyone performed. That last detail is the operationally cruel part: a plan can improve on a measure and still lose stars because everyone else improved more.

Value-based payment, in its actual varieties

"Value-based care" covers a spectrum from mild adjustments on top of fee-for-service to full responsibility for a population's total cost. The distinctions are what your data models have to represent.

Pay for performance. Fee-for-service plus a bonus or penalty based on quality measures. The lightest touch, and the most common.

Shared savings. A group of providers is accountable for the total cost of a defined population against a benchmark. Come in under it while meeting quality standards, and they keep a share of the difference. Accountable care organisations work this way.

Shared risk. The same, but they also owe money when spending exceeds the benchmark. This is where organisations start needing real actuarial capability.

Bundled payments. One payment covering an entire episode — a joint replacement including the surgery, the implant, the hospital stay and the recovery period. The incentive is to reduce complications and unnecessary post-acute care.

And capitation. A fixed amount per member per month for all their care. Maximum incentive to keep people healthy, maximum financial risk, and maximum concern about the temptation to withhold care — which is why capitation is always paired with quality measurement.

On the physician side, the American Medicare programme runs a scheme where clinicians are scored across quality, cost, improvement activities and use of technology, with payment adjusted up or down accordingly, and an alternative track for those taking on genuine financial risk through advanced payment models.

And hospitals face several linked programmes: payment adjustments tied to quality performance, penalties for excess readmissions, and penalties for hospital-acquired conditions.

Risk adjustment, and its dark side

When you pay a plan a fixed amount per member, you must pay more for sicker members or every plan will chase healthy ones. That is risk adjustment, and in Medicare Advantage it works through hierarchical condition categories: documented diagnoses map to categories, which produce a risk score, which scales the payment.

The legitimate consequence is that accurate diagnosis documentation matters financially, so plans invest in ensuring conditions their members genuinely have are recorded each year.

The illegitimate consequence is an incentive to record diagnoses that are not supported. This has produced major enforcement actions and audits in which regulators sample records and require documentation supporting the diagnoses submitted, with extrapolated recovery of overpayments.

For an engineer the lesson is precise: any system that surfaces potential diagnoses for documentation must be built to support clinical accuracy and must retain the evidence chain — what was suggested, on what basis, what the clinician decided, and what supported the final coded diagnosis. A system that simply maximises the risk score is building an enforcement case against its owner.

Fraud, waste and abuse

The three words are used together and mean different things, and the difference is intent.

Fraud is intentional deception for unlawful gain — billing for services never provided, falsifying diagnoses, kickbacks for referrals.

Waste is overuse or inefficiency without intent to deceive — the duplicate scan because nobody could find the first one, the unnecessary test ordered defensively.

Abuse sits between them: practices inconsistent with sound medical or business practice that result in unnecessary cost, without the clear intent that defines fraud.

Estimates of the total lost to all three run to tens of billions of dollars a year in the United States, with commonly cited figures in the range of a few percent of total health spending. Precision is impossible by the nature of the problem, and any single quoted number should be treated as an estimate with wide bounds.

The laws that define the boundaries

Four instruments do most of the enforcement work, and knowing what each prohibits keeps you out of trouble when designing systems.

The False Claims Act makes it unlawful to submit false claims to the government, with damages of multiple times the amount claimed plus penalties per claim. It allows private individuals — usually employees — to bring suits on the government's behalf and share the recovery, which is why so many cases begin with an insider.

The Anti-Kickback Statute makes it a crime to offer or receive anything of value to induce referrals of items or services paid for by federal healthcare programmes. It is intent-based, criminal, and broad, and it is the reason for the copay restrictions in Chapter 25.25 and the advisory board controls in Chapter 25.23.

The physician self-referral law, known as Stark, prohibits a physician from referring certain services to an entity they or a family member have a financial relationship with, unless an exception applies. It is a strict liability statute, meaning intent does not matter — which makes it a documentation and structuring problem rather than an ethics problem.

And exclusion. Individuals and organisations can be excluded from participation in federal healthcare programmes, and employing an excluded person in a role paid for by those programmes creates liability. Which is why checking staff and vendors against the published exclusion lists is a routine, automatable compliance obligation, and one of the simplest useful systems you can build for a provider client.

How detection actually works

Payers run special investigations units, and government programmes run their own contractors for audit and program integrity. The methods stack in a sensible order.

Rules and edits catch the impossible and the obviously wrong: a service billed for a deceased patient, a procedure inconsistent with the patient's sex, mutually exclusive codes on the same day, a provider billing more hours in a day than exist.

Peer comparison finds outliers: this provider bills the highest-intensity office visit for 90 percent of encounters where their peers average 40 percent. An outlier is not proof of anything — it can reflect a genuinely different patient population — but it is where investigation starts.

Network analysis finds relationships: the same handful of patients travelling between a specific clinic, laboratory and pharmacy, or providers sharing addresses and billing patterns. This is where the largest organised schemes are found, and it is a graph problem.

Predictive models score claims before payment.

And investigation, which is human: records requested, patients interviewed, sites visited.

The strategic decision every payer faces is prepayment versus postpayment. Stopping a claim before paying it avoids the near-impossible task of recovering money afterwards, but every false positive delays payment to a legitimate provider and generates appeals and ill will. That trade-off is exactly the precision-versus-recall conversation you already know, with the twist that the cost of a false positive is a doctor's cash flow and the cost of a false negative is public money and sometimes patient harm — because the most damaging schemes involve real patients receiving unnecessary treatment.

What to remember

Three things carry into any project in this area.

A measure changes behaviour, including in ways you did not intend. Measure the eye examination and eye examinations rise; some of that is patients being properly cared for, and some is documentation. Design measurement so the easiest way to score well is to do the right thing.

Risk adjustment is where quality measurement and payment fraud meet, and any system touching diagnosis capture needs its evidence trail built in from the start.

And the boring compliance systems — exclusion checking, coding audits, documentation trails — are cheap to build, easy to sell, and prevent problems that end careers. They are unglamorous work with an unusually clear value argument, which is a good description of a large share of what a services company should be pitching.

Next: Chapter 25.30, Medicaid in detail — eligibility, plan types, and the renewal machinery that decides whether millions of people keep their coverage.