Two audit letters that came across her desk from the Medicare administrative contractor (MAC) in late August raised red flags for Vera Phillips, compliance specialist at Olympic Medical Center in Port Angeles, Washington. Because these are strange times as it is, between the COVID-19 pandemic generally and subsequent regulatory and audit changes, her antennae are up more than usual, and Phillips decided not to produce the requested records without additional due diligence.

For one thing, the audit letters from the MAC, Noridian Healthcare Solutions, were written by a department she’d never heard from before: the Benefit Protection Team. For another, although they requested the usual stuff, including medical records, the MAC letters also wanted something that made Phillips uncomfortable: a copy of the driver’s license and Medicare card of the two patients whose services are the subject of the audits.

Her first thought was, “With all the fraud and COVID-19 fraud, is this letter legit? I’m not sending that unless I find out.” The letters also were a little vague, simply saying, “Due to an audit of Medicare files, we are requesting additional information regarding services provided to the following Medicare patient …” The pressure was on for an answer, because the letters gave the hospital 15 days to send the records back, which is half the time providers usually have in Medicare audits.