New HIPAA Audits May Prove Troublesome...If Not Prepared

The long-awaited next round of HIPAA audits has started, and providers may face a host of compliance and enforcement challenges, say health-care attorneys.

For example, the Health and Human Services Office for Civil Rights said it may conduct additional compliance reviews if an audit uncovers “serious issues,” which could lead to civil monetary penalties, Daniel Gottlieb, an attorney with McDermott Will & Emery in Chicago, told Bloomberg BNA on March 23, 2016.

Gottlieb said it's unclear how the OCR will define what constitutes a “serious issue,” and that uncertainty will be a burden to providers.

Certain policies that haven't been updated recently could become the grounds for additional compliance reviews outside the audit process, depending on the OCR's definition of a serious issue, Gottlieb said.

OCR Director Jocelyn Samuels announced the start of the phase two audits at a March 21 conference.

The compliance audits are intended to determine if health-care organizations and their contractors are complying with the Health Insurance Portability and Accountability Act's Privacy, Security and Breach Notification rules.

While the first round of audits focused solely on covered entities, phase two will address covered entities and business associates.

The audits are being conducted by FCi Federal, a government services provider in Ashburn, Va., that was awarded the contract in October 2015 .

Gottlieb said some covered entities, such as small physician practices, might have some HIPAA compliance issues involving their comprehensive risk assessments, which can be very data intensive and complicated for organizations with limited resources.

However, Gottlieb said he expected larger covered entities and business associates would be up-to-speed on HIPAA compliance.

“Organizations that prioritize HIPAA compliance should do pretty well, but no one is perfect,” Gottlieb said.

Data security is an ongoing process, Gottlieb said, and organizations should continuously make changes to their policies to meet a changing threat environment, including hacking attempts and patient data shared via social media channels.

Justified Enforcement

The next round of audits has been characterized by the OCR as a compliance improvement exercise, but covered entities and business associates may be in store for more enforcement actions as the OCR uncovers serious issues, Eric Fader, an attorney with Day Pitney LLP in New York, told Bloomberg BNA March 24, 2016.

“At this point, the OCR could be excused for calling almost any HIPAA violation a serious issue,” Fader said.

HIPAA has been around a long time and the OCR has provided plenty of warnings over the last few years, Fader said.

James Bowers, an attorney with Day Pitney in Hartford, Conn., said the OCR is likely to ramp up HIPAA enforcement after the criticism it received from the HHS Office of Inspector General in a September 2015 report (pdf).

The OIG said in the report that the OCR wasn't investigating enough small data breaches or keeping track of all health-care organizations it finds in violation of federal privacy laws.

“OCR's knuckles were rapped pretty hard, so going forward there's going to be a no-nonsense enforcement policy,” Bowers told Bloomberg BNA March 24.

Bowers said he expected to see steeper fines and more corrective action plans.

Audit Priority Items

Gottlieb said the OCR's phase one audits, which were conducted in 2011 and 2012, identified several areas of concerns regarding HIPAA compliance, and he said the upcoming phase two audits are likely to focus on them.

For example, a significant portion of audit subjects from phase one hadn't performed a comprehensive security risk assessment, Gottlieb said.

“Organizations should review their risk assessments and see if they comply with the HIPAA Security rule as well as OCR guidance,” Gottlieb said.

Gottlieb said he expected the second round of audits will also focus on the HIPAA Security rule's provisions concerning the secure disposal of electronic devices and encryption of data in transit and at rest.

“A lot of recent OCR enforcement has focused on stolen unencrypted laptops,” Gottlieb said.

The OCR reached two multimillion-dollar settlements in March 2016 with providers over stolen unencrypted laptops .

Audit Preparation

Also See: What to Expect in a HIPAA Audit for 2016 (Webinar Video)

In preparation for a potential HIPAA audit, organizations should identify and gather all of their documentation related to the OCR's phase one-identified priority areas and should ensure their security policies are reasonable and updated, Gottlieb said.

Kevin Page, an attorney with Waller Lansden Dortch & Davis, LLP in Nashville, told Bloomberg BNA March 23, 2016 that covered entities should maintain a list of all their business associates as well as have written HIPAA compliance policies and procedures in place.

Page said the audits will likely look to see if organizations have conducted a comprehensive, enterprisewide security risk analysis and if they've implemented a risk management plan based on the results of the analysis.

“I suspect we'll be seeing more audits, and what they learn from these current audits will inform future audits,” Page said.

Page said it would be smart for business associates to be make sure they're up to speed on the HIPAA Privacy and Security rules, as this will be the first time they're having to open their books to the OCR and demonstrate compliance.

Day Pitney's Bowers said business associates are increasingly holding large amounts of patient data either in electronic health records or in cloud storage.

“These vendors have to make certain the data is secured six ways to Sunday,” Bowers said.

Little Cause for Alarm

While the upcoming phase two audits may be inconvenient for organizations as they gather their HIPAA policies and procedures, there's little cause for alarm, Colin Zick, an attorney with Foley Hoag LLP in Boston, told Bloomberg BNA March 24, 2016.

Zick said the audits are trying to encourage good compliance and aren't designed to be punitive.

If you haven't pulled the HIPAA compliance binder off the shelf in a while, this would be a good time to start!

When it comes to HIPAA compliance, no one's perfect and breaches will happen, Zick said.

Organizations with strong underlying HIPAA compliance policies and procedures are less likely to face enforcement action if compliance problems are found, Zick said.

Zick also said covered entities are likely to fare better in HIPAA audits than business associates, which are organizations that contract with health-care organizations.

“There's such a variety of business associates, it's a much greater challenge for them to stay in compliance,” Zick said.

Looking to the future, a big question is what the next phase of audits will look like, Zick said.

“Will they decide not to do any more because the results show everyone's OK with compliance, or will they will ratchet up enforcement?” Zick said.

Planning Ahead

Before any potential HIPAA audit, covered entities and business associates should:

locate all HIPAA Privacy and Security compliance policies and procedures, and find out when you last updated them;

review your risk analysis/assessments and risk management plan;

update any policies and proceedures/documentation as necessary; 

update and organize all Business Associate Agreements/contracts; and

schedule annual and ongoing training.

Organizations need to cooperate completely with an audit request.

Reece Hirsch, an attorney with Morgan, Lewis & Bockius LLP in San Francisco, echoed Zick's comments and said it's crucial for audit subjects to respond within the mandated 10-day period.

“Make sure the audit-related address verification letter doesn't end up in your spam folder,” Hirsch told Bloomberg BNA March 24, 2016.

Organizations should create audit response teams to ensure they meet the response deadline, and should perform document-gathering dry runs to determine how fast the process is, Hirsch said.

Hirsch said it's important that an organization's HIPAA compliance policies and procedures are updated.

“If you've done your updating prior to the audit start, you're OK, but if you do your updating after you receive an audit request, that's a different story,” Hirsch said.

Also See: What to Expect in a HIPAA Audit for 2016 (Webinar Video)

Source(s): James Swann, http://www.bna.com/, HCSI, What to Expect in a HIPAA Audit for 2016

To subscribe to this blog, enter your email address:


Delivered by FeedBurner

What to Expect in a 2016 HIPAA Audit (video)

Let's begin your Audit! What to Expect in a HIPAA Audit in 2016

Would you be surprised if OCR showed up for a HIPAA audit?

Who does this impact?
A Fine from OCR does not just impact the physician, but also the
office manager, the staff, and the reputation of the practice for years to come!

In this webinar, HCSI guides healthcare practices and business associates
on what to expect during a HIPAA audit, with our webinar.

3 main points of reference in the webinar:
1. Penalties for HIPAA Violations
2. Areas covered in an audit
3. Let's begin your Audit!

Additional resources at the end of the presentation:

1.       The change being made with OCR’s HIPAA Audit protocol

2.       Start to finish expectations for 2016 HIPAA audits

3.       HIPAA audit planning recommendations

Click here for the webinar or view below:

Contact support@hcsiinc.com or call 801-947-0187 for questions related to HIPAA, OSHA, etc.

If you are responsible for integrating a culture of compliance, then consider visiting and Liking our Facebook Page for supporting articles:

HCSI Facebook Page

http://hcsiinc.com

To subscribe to this blog, enter your email address:


Delivered by FeedBurner

Don't Write Off Patient Copays

Before waiving patient copays, consider the legal consequences first.

It comes naturally to want to help your patients; especially the ones struggling to get by on a meager income or retirement. At first blush, it may make sense to waive the patient portion of a medical bill after the insurance has paid. But before you waive a patient's financial responsibility, consider the legal consequences of doing so. Nowadays, patient discounts, if given incorrectly, can run awry of insurance regulations or even violate federal anti-kickback statutes.

John Meigs, Jr., has practiced as a solo, family physician in rural Alabama for over 30 years. During that time he says the business of medicine has changed drastically. Prior to the institution of health insurance, physicians would often discount their services for patients who struggled to pay or even give free care for the worst cases. Now, however, waiving the patient portion of a physician's fee could potentially land a kind-hearted physician in hot water, as failing to collect insurance copays and deductibles could violate contracts with private and federal insurance companies. It could also negatively impact a practice's bottom line.

"To be legal, you can't charge less than what Medicare would pay ... Obviously, if you discounted everybody you couldn't stay in business. You have to collect," says Meigs, who is now an employed physician at Bibbs Medical Associates, a rural health clinic in Bibbs County, Ala. and president-elect for the American Academy of Family Physicians.

LEGAL CONSIDERATIONS

In its "Code of Medical Ethics, Opinion 8.03, Conflicts of Interest" the AMA writes, "Under no circumstances may physicians place their own financial interests above the welfare of their patients. … If a conflict develops between the physician's financial interest and the physician's responsibilities to the patient, the conflict must be resolved to the patient's benefit."

But as a businessman or woman who has also entered into legal contracts with multiple insurance payers and the federal government, this ethical dictate is not always as simple as physicians might wish.

Attorney Michael Sacopulos, founder and president of Terre Haute, Ind.-based Medical Risk Institute, says in the vast majority of cases, the physicians he works with are not intent on defrauding payers or the government. "You've got a group of people that care about others, or they wouldn't have gone into healthcare, and they want to provide services," he says.

But the impulse to help patients by waiving copays is one a physician should resist for several reasons, says Sacopulos. Patient cost sharing is viewed as an important component of holding down the rising cost of medical care by commercial and government payers. The insurance companies reason if patients have more "skin in the game," they may make better informed decisions about when and where to seek medical treatment, and potentially reduce their demands for expensive diagnostic testing and procedures that may not be necessary.

Aside from the fact that collecting copays and deductibles is a contractual obligation for physicians, if a physician were to routinely waive the patient portion of his fee, the insurance company could take that to mean that his usual and customary fee was really “x” percent less than originally stated. There have been cases, says Sacopulos, where insurance companies have sued physicians for fraud and won. "[Payers and physicians] entered into a contract where they said these are the fees you normally charge … and in fact, what you have done is systematically ignored that. And that is a breach of contract … so you've defrauded [the payer]," he says.

Another pitfall that could trip up physicians is violating the federal Anti-Kickback Statute (AKS). There is no lack of news about shady physicians or medical suppliers who exchange money in return for referrals of new Medicare patients. But even physicians who have more altruistic motives could run afoul of federal laws. HHS' Office of the Inspector General (OIG) makes clear in "A Roadmap for New Physicians, Fraud & Abuse Laws" that routinely failing to collect patient copays in any instance other than for individual determination of patient hardship is illegal:

"The kickback prohibition applies to all sources of referrals, even patients. For example, where the Medicare and Medicaid programs require patients to pay copays for services, you are generally required to collect that money from your patients. Routinely waiving these copays could implicate the AKS and you may not advertise that you will forgive copayments."

FINANCIAL CONSIDERATIONS

Given declining payer reimbursements, failing to collect patient copays and deductibles could also have serious consequences for practice revenue. Barbara Dunn, president of Houston-based MedRecovery Solutions, a medical billing company, says many practices can't afford not to collect patient balances. "In today's medical environment, [physicians] are really hurting themselves [if they don't collect] because a lot of times the insurance company is paying less than the copay," she says.

Adding another wrinkle, new high-deductible health plans are making it harder for patients to afford services. Patients may feel unable or unwilling to pay their copays and/or deductibles or skip out on necessary treatment or testing, says Meigs. When patients do not pay their insurance premiums, health exchange insurance companies are asking physicians for refunds for services already rendered, Dunn says, leaving practices to collect from patients who have already demonstrated that they cannot pay. 

In cases of true financial hardship, practices can discount treatment. The key, Dunn says, is not to make it a regular practice; it must be an isolated incident that is documented in the patient chart. "As long as you bill out the full amount, you can discount anybody's bill. Just document that the patient has a hardship, and therefore they would discount the patient portion by ‘x’ number of dollars," she says.

HOW TO DO IT RIGHT

To protect your practice's revenue stream, comply with contractual obligations, and make your front-desk/billing staff's job easier, it is vital to establish a clear financial policy that spells out provisions for collecting patient copays and deductibles and establishes your policy on patient discounts and charity care.

It doesn't need to be "page and pages in a policy manual," says Sacopulos. "But, I think if [practices] are ever intending to waive off copays and deductibles, it should be done pursuant to a policy with documentation." He says many consultants can provide a template that practices can adopt for their own use.

Here are a few guidelines to follow when creating your own financial policy:

• Develop, publish, and train staff on your practice's financial policy.

Establish the circumstances and qualifying criteria when your practice will discount patient care, and disseminate that information to staff. By outlining your policies on helping low-income patients, patients without insurance, or cancer patients who may need expensive treatments such as reconstructive surgery, for example, staff will have a consistent policy to follow and will treat all patients the same. This will also protect your practice from embezzlement disguised as waived copays or discounts to staff friends and family members.

• Develop a system for establishing and documenting financial hardship in the patient chart.

Many physicians are uncomfortable with discussing money and often pass that task off to front-desk staff. But it shouldn't be done willy-nilly. "If you are going to have someone on your staff deal with it, then you need to give them the guidance and the tools to do that in a fair way," says Sacopulos. He gives his clients a form to use to document patient financial hardship. Because Meigs' practice is designated as a rural health clinic, he says they use a sliding fee schedule for patients who can demonstrate financial need, usually by supplying a tax return.

• Make sure that a section is devoted to your policy on professional courtesy.

It used to be a common occurrence to extend discounts to physician colleagues as a professional courtesy, says Meigs. But given contractual obligations to collect patient copays that tradition has fallen by the wayside for many practices. The key, says Dunn, is to make sure that waiving copays is not a routine policy. "More times I see that [practices] will take that patient portion and discount it. And that discounted part is a professional courtesy, but there is still a balance that is billed to the patient," she says.

• Institute a system to consistently make a fair effort at collecting outstanding patient accounts.

A typical policy is to send out three patient statements, says Dunn. If there is no patient response, follow statements with a phone call and/or a collection letter and document your efforts in the patient chart. If done properly and consistently your practice may safely write-off uncollectible copays and/or deductibles, or turn them over to a collections agency. And if the practice is ever audited by Medicare or a private payer, you will have a paper trail easily retrieved from the patient chart.

DISCOUNTING STAFF TREATMENT

Providing practice staff with "insurance only" medical care (waiving the patient copay and accepting the insurance reimbursement as payment in full) would likely violate the practice's insurance contracts. However, practices do sometimes discount staff care as a professional courtesy or an employee benefit. While the custom is well-meaning, it can be problematic, according to Michael Sacopulos, a healthcare attorney. "I think [discounting care] is an employee benefit; I've not seen anyone have trouble with that. … The question is do you have to report it as compensation? Technically you are giving them the value of [treatment]," he says.

One way for practices to help staff with medical expenses and avoid running afoul of the IRS is to fund a financial vehicle like a Medical Expense Reimbursement Plan (MERP) that reimburses staff for a portion of their out-of-pocket medical expenses like copays and deductibles, say experts.

Source(s): Erica Sprey, http://www.physicianspractice.com, http://www.hcsiinc.com

To subscribe to this blog, enter your email address:


Delivered by FeedBurner

Is Two Weeks Notice Necessary?

This is a discussion: Should you or should you not accept an employees two weeks notice when they quit?

Amanda works in a healthcare office. She is responsible for billing patients and has just given her supervisor, Jessica, her two weeks notice. Jessica knows that she will not be able to fill Amanda's position within the next two weeks, however, she begins her search. During the next two weeks, Amanda continues with her work and talking with her co-workers. She is no longer afraid of loosing her job for what she says, so she is more open about some of her negative feelings about the office, her supervisor, and some of her co-workers. In addition, Amanda accesses the billing records of some of her family members and "settles" their open accounts. Soon after, Amanda's two weeks are up and she is no longer with the healthcare office. However, what she did during those two weeks will be felt for sometime longer. Morale is lower, there is contention in the office, and the billing records are not matching up.

Giving a two weeks notice is a courtesy and not a legal requirement. It is intended to ease the burden on an employees current employer when that employee has decided to leave. Not giving a two weeks notice could cause excessive additional responsibilities on an employees current co-workers and cause some resentment or harsh feelings.

There is room for discussion for either choice:

Giving Two Weeks Notice - By giving a two weeks notice, an employer would have time to train a permanent or temporary replacement. This is also a time of closure for many of the people who have worked together for many years. During these two weeks, an employer is usually able to gather some honest and open feedback about the position, its responsibilities, and suggestions from the employee who is leaving. However, this is also a time that could make the employer vulnerable to theft, sabotage, or creating discord among the remaining employees.

Not Giving Two Weeks Notice - By not giving a two weeks notice, an employer must quickly assign responsibilities to other employees that were not originally theirs. This would add an extra burden on each of the employees and will have a negative effect on their original responsibilities. However, many times after an employee gives their two weeks notice, their loyalty, heart, and passion for the position no longer exist. The employees mind and focus is now on their new job. The employees effort and focus will not be on their current employer.

We are back to our original question: Should you or should you not accept an employees two weeks notice?

My suggestion - In my personal experience, I have seen many scenarios of what could happen during a two weeks notice period play out. An employer needs to decide weather or not to accept an employees two weeks notice based on the individual employee and the scope of their responsibilities. If the employee has access to sensitive information or an employers does trust an employees actions, then the employer may not want to accept an employees two weeks notice. Some companies have begun taking a different route. When an employee gives their two weeks notice, and that employee falls under the category mentioned above, the employer could offer to pay the employee for the next two weeks, but tell them that their office presence is no longer necessary.

Please share your experiences and opinion on this topic by leaving a comment.

Related article:
An Effective Termination Procedure Will Help Protect Your Office

To subscribe to this blog, enter your email address:


Delivered by FeedBurner

Share Your Opinion - Is This a HIPAA Breach or Merely an Accidental or Incidental Disclosure?

Emails Exposed BJC HealthCare Patients’ Data

What is the difference between an Incidental and an Accidental disclosure of protected health information (PHI) or a HIPAA Data Breach? Can you give examples of each? How do you handle each in your practice for an accounting of disclosures as required in the HIPAA privacy rule regulations?

The difference between an "incidental" and an "accidental" disclosure of PHI is the difference between complying with the privacy rule and violating it.

In a recent story, BJC HealthCare, a not-for-profit health system based in St. Louis, MO., has started notifying 2,393 of its patients that some of their protected health information has been exposed as a result of an email error that occurred on December 30, 2015.

An email containing sensitive data covered by HIPAA was emailed to another medical group. While HIPAA permits the sharing of healthcare data for certain healthcare operations, the Security Rule requires any shared data to be protected in transit.

If ePHI is to be shared electronically with another covered entity or business associate, it must be adequately protected to prevent unauthorized access and to protect the integrity of those data. Controls to protect the integrity of ePHI are addressable issued under 45 CFR § 164.312(e).

In this case, the data were not encrypted to the standards required by the Security Rule, and consequently the data could potentially have been intercepted in transit.

HIPAA requires covered entities to notify individuals when their PHI has been exposed or viewed by a third party to allow them to take precautions to protect their identities and reduce the risk of loss or harm.

Patients have been advised by mail that their name, date of birth, gender, and Medicare Beneficiary information were included in the email, although Social Security numbers were not exposed, and no financial or medical data were contained in the email. Patients affected by the email error were part of the healthcare provider’s accountable care organization.

An investigation into the incident showed that the email was received by the intended recipient and no other individual appeared to have gained access to any patient data, although the possibility cannot be ruled out. Out of an abundance of caution, all affected individuals have been offered complimentary credit monitoring services for a period of one year.

In order to prevent similar errors from occurring in the future, BJO HealthCare will be conducting further staff training to ensure that staff members are aware of the protocols that must be followed when transmitting data covered by HIPAA.

---

So with all information considered, would you say this incident is a Data Breach, an Accidental disclosure or an Incidental disclosure?  Please post a comment with your feedback.

Additional Information:

Certain "incidental" disclosures are a permitted use of PHI and, therefore, are not a violation of the regulations. (See Section 164.502(a)(1)(iii).) On the other hand, an "accidental" disclosure is not permitted under the regulations and would subject the organization to penalties for the violation. (See Section 164.502(a)(1) and (2) of the regulations.) The HIPAA statute would limit the penalties for an accidental disclosure to civil penalties alone. 

An "incidental" use and disclosure occurs as a by-product of another permissible or required use or disclosure under the privacy rule. It is a limited disclosure that cannot reasonably be prevented.   Examples of "incidental" disclosures include a hospital visitor overhearing a provider's confidential conversation with another provider or a patient, or a visitor catching a glimpse of a patient's information on a sign-in sheet or nursing station whiteboard.

An incidental use or disclosure may result from any use or disclosure permitted under the privacy rule. It is not limited to treatment communications or to communications among healthcare providers or other medical staff. An incidental use or disclosure may occur, for example, when a provider talks with an administrative staff member about billing a patient for a particular procedure and is overheard by 1 or more persons in the waiting room. 

An incidental use or disclosure is not a violation of the HIPAA medical privacy regulation provided the covered entity has applied reasonable safeguards (see Section 164.530(c) of the regulation) and implemented the minimum necessary standard (see Sections 164.502(b) and 164.514(d) of the regulation), where applicable, with respect to the underlying use or disclosure. (See Section 164.502(a)(1)(iii) of the regulation). If the underlying use or disclosure violates the privacy rule, however, the incidental use or disclosure would be a violation of the rule. 

Incidental disclosures do not have to be included in the accounting of disclosures provided at the patient's request. (See Section 164.528(a)(1)(iii) of the regulation.) 

Source(s): www.hipaajournal.com, www.medscape.com, www.law.cornell.edu, hhs.gov

To subscribe to this blog, enter your email address:


Delivered by FeedBurner

New OCR FAQ Addresses Patients' Rights To Access Health Information Under HIPAA

New HIPAA Guidance Reaffirms Patients’ Rights in Health Data

On February 25, 2016, the U.S. Department of Health & Human Services Office of Civil Rights (“OCR”) issued new guidance in the form of FAQs, reaffirming patients’ rights to direct their personal health care data to third parties.  The guidance is good news for medical researchers, mobile health app developers, and others in the industry trying to harness the power of “big data” and personalized care.

While HIPAA has always permitted patients to share their own protected health information, the FAQs are aimed at health care providers, hospitals, and plans who are directly subject to HIPAA’s restrictions and requirements (also known as “covered entities”) and who are often, and understandably, hesitant to send health information to a third party.  Covered entities are required to send protected health information to a third party upon the individual’s written request; electronic copies of signed requests or electronically executed requests are sufficient under HIPAA.  The FAQs confirm that covered entities are not liable for what happens to the individually-directed information once it is in the hands of the third party, eliminating a concern that is a frequent obstacle to accessing health information.

These new FAQs emphasize the importance of developing “seamless communication” in a “health care ecosystem of the future,” where patients are engaged and empowered in their care.  Nevertheless, covered entities must still be vigilant in protecting health information in their possession and obtaining assurances from business associates that information is protected.  Covered entities are encouraged to establish procedures to respond to requests to forward data to third parties.  Third parties will also benefit from developing a readily-available individual written request form for data that complies with HIPAA’s requirements.

The FAQs, including answers to questions regarding the patient’s “Right to Have PHI Sent Directly to a Designated Third Party,” are available here.

Source(s): Buchalter Nemer, http://www.lexology.com, http://www.hhs.gov/

To subscribe to this blog, enter your email address:


Delivered by FeedBurner