Compliance and Privacy Update - PWW Media Inc.€¦ · Example: ABC Ambulance’s billing software...

Compliance and

Privacy Update

© Copyright 2015-2016, PWW Media, Inc. All Rights Reserved.

All Use Subject to Attendee License Agreement.

2015-2016 Program Materials

Attendee License Agreement

Once you (Licensee) register for and/or attend any PWW Media, Inc. (Licensor, hereinafter “PWW Media) Event (including but not limited to abc360, The PWW Executive Institute and any PWW Media webinars), you agree to be bound by the terms of this License. This License covers

any information, materials or training that PWW Media provides, whether written, electronic or oral, and whether accessed directly or indirectly through attendance at a conference or access via the Internet (Licensed Materials). Licensee is permitted to print one copy of the Licensed Materials and/or keep one electronic copy as backup. Unless Licensee obtains Licensor’s prior written permission, Licensee may not:

Permit anyone but you to use a password or share a link to access Licensed Materials; Provide or forward any Licensed Materials in whole or in part to anyone else; Copy, duplicate or in any manner reproduce or rebroadcast any Licensed Material or use it to train anyone; Copy, modify, sell, distribute, rent, lease, loan or sublicense any Licensed Materials; Record any PWW Media Event (including presentations, questions and answers, individual consultations, etc.)

by audio, video, electronic or any other means; Use any Licensed Materials for any commercial purposes whatsoever.

All Licensed Materials are the Copyright of PWW Media, Inc. unless otherwise noted. All rights are reserved. No claim is made with regard to any governmental works or the works of any third parties used by permission. No part of this material may be duplicated, reproduced or distributed by any means.

Although Licensor attempts to provide accurate and complete information at all PWW Media Events, Licensor cannot guarantee it. Errors and omissions may occur. Therefore, Licensor presents all Licensed Materials “as is” and disclaims any warranties of any kind, express or implied. The Licensee acknowledges that the Licensed Materials are subject to change based on changes in law and agrees that Licensor is not responsible to update and/or supplement any of the Licensed Materials at any time. None of the Licensed Materials constitute legal advice or a definitive statement of the law and are not a substitute for individualized legal advice under an attorney-client relationship. Licensed Materials are for educational purposes only. Licensee is instructed to consult the official sources of materials from governmental agencies. Licensor is not responsible in any manner for any billing, compliance, reimbursement, legal or other decisions you make based in whole or in part upon any Licensed Materials, and Licensee hereby forever releases Licensor from any and all claims and liability of any kind related to Licensee’s use of any Licensed Materials. Any examples of documentation, coding scenarios and other teaching illustrations contained in any Licensed Materials are examples for illustrative purposes only. Licensor waives any and all claims, lawsuits or other actions against PWW Media, its principles and employees and all related entities. In all cases, you agree that the liability of PWW Media, Inc. is limited to any amounts paid by Licensee for registering for the PWW Media Event. This Agreement is governed by Pennsylvania law and any disputes hereunder shall be brought exclusively in the Commonwealth of Pennsylvania, County of Cumberland.

Licensee acknowledges that Licensor, nor anyone else on its behalf, made any representations or promises upon which you relied that are not in this Agreement. This Agreement constitutes the entire understanding between Licensee and Licensor and cannot be altered unless signed in writing by the principals of PWW Media, Inc. If any part of this Agreement is declared invalid, it will not invalidate the remaining parts. If Licensor does not enforce any part of this Agreement for any reason, Licensor does not waive its right to enforce it later.

License and Limitations of Use

Copyright Statement

Disclaimer

Entire Agreement

© Copyright 2015-2016, PWW Media, Inc.

Page 1pwwmedia.com ■ pwwemslaw.com ■ AmbulanceCompliance.com

Attendance is subject to the PWW Media Attendee Licensing Agreement. Please

refer to your handouts for a complete copy.

WARNINGThe unauthorized reproduction or

distribution of this copyrighted work is illegal. Criminal copyright infringement, including infringement without monetary gain, is investigated by the FBI, and is punishable by up to 5 years in federal

prison and a fine of $250,000.

THIS IS NOT LEGAL ADVICE

This information is presented for educational and general information purposes and should not be

relied upon as legal advice or definitive statements of the law. No attorney-client relationship is formed by the use of these

materials or the participation in this seminar. The user of these materials bears the responsibility for

compliance with all applicable laws and regulations.

WE USE EVALS AND IMAGES FOR PROMOTIONAL

PURPOSES By attending this conference, you consent to being photographed by Page, Wolfberg & Wirth, LLC and

for your image to be used by PWW in future promotional materials. You also agree that we may in future promotional materials quote you on any statements you make in your program evaluation

form. If you do not consent to us using your name in this manner, please do not include your name on

your program evaluation.

WE’RE STILL NOT DONE BEING LAWYERS

The distribution of any materials and/or the solicitation of abc360

attendees is prohibited by anyone other than registered exhibitors.



NO AUDIO OR VIDEO RECORDING OF ANY

SESSIONS OR Q&A/CONSULTATION IS

PERMITTED

Con Ed CreditNAAC

• Certificates at NAAC booth after the conference

• Must attend entire conference to earn full 12 credits

• CACs: Log into your NAAC account enter your CEUs

• CACOs and CAPOs: Email completed certificates to: [email protected]

AAPC

• Each CE‐approved session has a CEU code and approved number of CEUs

• Codes will be given at each session

• Copy them down and enter on your CEU Code Card

Publications and Products

Available Today!

abc QuikGuide

Facility Contracting Tool Kit

Social Media Survival Kit

HIPAA TV

Ambulance Service Guide to HIPAA Compliance – 4th Ed.

And Our Latest

Publication…

Includes:

Model Compliance

Plan

Model Code of Conduct

Model Policies and

Forms

Model Compliance

Training



COMPLIANCE UPDATE

abc360 General Sessions

Our 2 Goals Today

1. Provide you with the latest about compliance and government enforcement

2. Give you the strategies you need to combat the risks you face

First, What’s the Government Doing?

NEW Regulations on the ACA’s 60 Day

Overpayment Rule

Two Provisions in the ACA1. Providers and suppliers must report

and return identified overpayments from Medicare and Medicaid within 60 days

2. Retaining an overpayment after the deadline constitutes a violation of the Federal False Claims Act (FCA)

Your Duty…

• Since March 23, 2010 ambulance services have been under a duty to report and return Medicare andMedicaid overpayments 60 days after identification



The New Regulations

• Published February 12, 2016

Effective:March 14, 2016

Regulations Apply to…

• Medicare overpayments • CMS said it will issue other rules for

Medicaid overpayments Even without Medicaid-specific rules, you

still have a duty under ACA to return Medicaid overpayments within 60 days of identification

Definition of “Overpayment”

• Any funds a provider has received or retained from Medicare to which the provider is not entitled

Clarifications About Overpayments from CMS

It’s An Overpayment - Even if It is Medicare’s Fault!

• Examples: CMS system error classifying a Medicare

beneficiary as FFS when the beneficiary was enrolled in a MA Plan MAC pays for a non-covered service due

to a contractor system edit problem MAC inadvertently pays a non-emergency

claim at the emergency rate

Overpayments Can be Partial

• Example: Provider paid $400 for a claim when it should have received $300 - the overpayment is $100

• A claim inadvertently coded and paid at a higher level of service does not mean the entire claim must be refunded - if coverage criteria for lower level of service is met



Overpayments May Include the Entire Claim

• Where payment is made for a service not payable under the Medicare e.g., claims resulting from Anti-Kickback Statute

violations or intentional upcoding (fraudulent claims)

• Overpayments are the entire amount paid in these situations

Meaning of “Identified”

The Regulation

• A provider has identified an overpayment if the provider has, or should have through the exercise of reasonable diligence Determined that an overpayment has been

received, and Quantified the amount of the overpayment

42 CFR § 401.305(a)(2)

The Regulation

• A provider should have determined that it received an overpayment and quantified the amount of the overpayment if the provider fails to exercise reasonable diligence and in fact received an overpayment.

42 CFR § 401.305(a)(2)

Here’s the Way it WorksYou determined

you’ve received an overpayment and

quantified it

You exercise “reasonable diligence”

You fail to exercise “reasonable diligence”

You have “identified” and overpayment

The overpayment is “identified” once you’ve determined

you’ve received it and you’ve quantified it

The overpayment is likely “identified”

when it was received

CMS Examples - When an Overpayment Has Been Identified

A provider reviews billing or payment records and learns that it incorrectly coded certain services, resulting in increased reimbursement

A provider learns that services were provided by an unlicensed or excluded individual on its behalf

A provider performs an internal audit and discovers that overpayments exist.

A provider is informed by a government agency of an audit that discovered a potential overpayment, and the provider or supplier fails to make a reasonable inquiry.



Identified By Whom?• Generally anyone in the organization• CMS said an overpayment does NOT

have to be confirmed by management or “senior official”

Exercise Reasonable Diligence!• If you exercise reasonable diligence, you

get time to investigate and quantify the overpayment

• If you don’t exercise reasonable diligence, you don’t get the benefit of time to investigate and quantify

What is “Reasonable Diligence?” Reasonable Diligence is Proactive

• Proactive compliance activities conducted in good faith by qualified individuals to monitor for the receipt of overpayments

Proactive Compliance Activities

Track and Compare Medicare Revenue

• Should be part of your compliance monitoring activities

• Significant changes without an obvious cause such should be investigated

Potential Causes

More ALS than last year?

More BLS NE?

Higher average charges?

Higher mileage claims

New contract?

New billing company?



Compare to National Data

• Use of “Cadillac codes” ALS1-NE (2%) ALS2 (1%) SCT (1%)

• ALS vs. BLS utilization rates

Use Billing Edits

A0427HN = STOP

Perform 100% Audits of High Risk Areas

• Dialysis• High mileage trips (especially urban

providers)• Emergency trips going to nonhospital

destination

Reasonable Diligence is Reactive

Investigations conducted in good faith and in a timely manner by qualified individuals in response to obtaining “credible information” of a potential overpayment

Examples of “Credible Information” of a

Potential Overpayment

Learning About a Coding Error

Example: ABC Ambulance’s billing software has a default in the ambulance certification questions which automatically populates “Yes” to a question about whether the transport was medical necessity.



Unlicensed or Excluded Provider

• Example: ABC Ambulance learns from another provider that an EMT’s certification may have been revoked

• Example: ABC Ambulance finds out that one of the physicians signing its PCS forms was on the OIG’s List of Excluded Entities and Individuals

You Learn About A Potential Issue Though an Audit

Example: During a quarterly claims audit, ABC Ambulance discovers that one of its billers billed 2 claims as A0427 – ALS Emergency on trips where there was no ALS assessment or ALS intervention performed.

A Single Overpaid Claim

• CMS says that after finding a single overpaid claim it is appropriate to determine whether there are more overpayments on the same issue

Hotline Complaints• Repeated hotline calls regarding the

same issue• One detailed hotline compliant

Unexplained Increase in Revenue

CMS said an “unexplained increase in Medicare revenue” could be enough to trigger an investigation to determine if an overpayment exists

How Much Time to “Identify” an Overpayment?



CMS on Time to Investigate

• When investigations are necessary as part of “reasonable diligence,” CMS says that the investigation should take at most 6 months from the receipt of the credible information except in extraordinary circumstances

Given 6 Months to Investigate…

8 months would be an outer limit from the start of the investigation to reporting and returning

6 months maximum to investigate + 60 days to refund the overpayment

May Depend on the Circumstances

• Clear cut cases - the ambulance service determines it was paid for 10 additional miles on a claim during an audit No further investigation needed 60 days likely begins from the date it was

discovered in the audit

May Depend on the Circumstances

• Less clear cut- ABC Ambulance realizes one of its paramedics may have lapsed in his CPR certification because another coworker reported it through the compliance hotline Need time to investigate and potentially consult

with legal counsel about the implications 60 days likely begins once ABC Ambulance confirms

the certification had lapsed and legal counsel determines coverage criteria were not met

Best Practices - Investigation

• Where little or no investigation is required – report and return 60 days from date you discovered the issue

• If you need to investigate: Proceed with “reasonable diligence” Don’t take longer than 6 months to investigate Don’t take more than 8 months from discovery to

repay

If You Don’t Exercise Reasonable Diligence

• 60 day time period begins when the provider received credible information of a potential overpayment but failed to conduct reasonable diligence



OIG Self-Disclosure• Use of OIG Self-Disclosure Protocol

(SDP) tolls the 60 day requirement• If reasonable diligence determines that

use of the SDP is the proper action only the initiation of the protocol needs to take place within 60 days, not the actual repayment

Quantifying the Overpayment

If Actual Amount Readily Determined

• Refund the actual amount• Remember, only the difference between

the amount you got paid and the amount you should have been paid needs to be refunded

In More Complicated Cases

• Often a 2-step process Probe sample Extrapolation

Cases where:

• Large or indeterminate number of claims involved

• Long term issue

• Cannot determine with 100% certainty the exact amount

In More Complicated Cases• “It is not appropriate…to only return a

subset of claims identified as overpayments and not extrapolate the full amount of the overpayment.”

• “The supplier should not report and return overpayments on specific claims form the probe sample until the full overpayment is identified.”

• 81 Federal Register 7664 (February 12, 2016)

In More Complicated Cases• This entire process (probe sampling +

extrapolation) must all be completed within the 6-month outer limit for investigating potential overpayments



The “Lookback” Period CMS Went With 6 Years Instead of 10

• Overpayments must be refunded only if provider identifies the overpayment within 6 years of the date the overpayment was received

• When investigating potential overpayments – may need to go back 6 years!

Amending Reopening Rules

• CMS is amending the reopening rules to have a reopening period that accommodates the 6-year lookback period

• Currently: 48 months (4 years)

Reporting Overpayments

• HHS will likely develop a standardized form in the future for repayments

• Currently, most MACs have an Overpayment Refund Form

• Requesting an offset instead of submitting an actual refund is acceptable

Financial Hardship

• Providers may request an “Extended Repayment Schedule” when true financial hardship can be demonstrated

Ambulance Overpayment Examples



Examples of Overpayments• Claims paid at a higher level of service

than is justified by the documentation

• Claims paid for transports performed or billed by an excluded individual

• Claims paid without a valid signature are overpayments

• Invalid or missing PCS forms

6 Essential Tips for Complying With the New Rules

1. Monitor for Overpayments on a Daily Basis

• Easier to deal with small overpayments on 1 or 2 claims at a time than to deal with 6 years’ worth at once

• Ensure those who perform daily EFT and posting activities are trained on how to spot potential discrepancies

• Don’t wait for audits - make it a daily part of the revenue cycle process

2. Conduct Internal Audits• Verify the accuracy of claim submission

and payments Investigate detected overpayments to

determine if it is a one-time mistake or a larger issue

• At least yearly have an external claims review Can also have monthly or quarterly external

reviews

3. Establish Multiple Reporting Outlets

• Options to report potential overpayments and compliance concerns Hotline Suggestion box Employee surveys

• Empower staff members to speak up through a “Culture of Compliance”

4. Monitor and Investigate

• Consistently monitor compliance data and investigate when unexplained changes occur Level of service mix Medicare revenue Credit balances



5. Have a Policy!

• Clearly outline the procedures for detecting, investigating, and refunding overpayments Monitor the process to make sure that

overpayments are being refunded within 60 days If you outsource your billing, your agency must

have a clear, written understanding of responsibilities in these situations so overpayment refunds do not fall through the cracks

6. Train Staff Members

• Train staff members so that overpayments can be prevented Thorough and truthful documentation Accurate coding and claim submission Through immediate reporting of issues

The Take Home

• Have a system to detect and preventoverpayments

• Once on notice of a potential overpayment, you must investigate without delay

• Once you’ve determined that an overpayment exists, follow procedures to immediately refund it!

The Stuff That Makes Headlines

$27.8 Billion To Date! Administration Recovers $7.70 for Every Dollar

Spent to Fight Health Care Fraud and Abuse

=



Revalidation

• As a result of revalidation efforts CMS has Deactivated over 470,000 enrollments Revoked nearly 28,000 enrollments

Keep Your 855B Up to Date

• Authorized and delegated officials• Geographic information • Vehicle information • Billing company information• Record storage information• State licensure • Ownership and managing control

Largest Takedown in Medicare Strike Force History

“Very few investments have a 10:1 return on taxpayer

money."

• Advanced analytics to identify “aberrant and suspicious billing patterns”

• Shifting from “pay and chase”• Real time claims analysis

CMS Fraud Detection System States are Suspending Medicaid Payments

• State governments are suspending Medicaid payments based on pending investigations of “credible allegations of fraud”



What’s a Credible Allegation of Fraud?

Allegations From any Source

• May include, but not limited to: Fraud hotline complaints Claims data mining Patterns identified through provider audits,

civil false claims cases, and law enforcement investigations

• Have “indicia of reliability”

Providers Now Have to Speculate

Presume it’s criminal

The Yates Memo

Yates Memo: No More DOJ Settlements Without

Individual Responsibility

Focus on Individuals

• Criminal and civil corporate investigations should focus on individuals from the inception of the investigation



Communication

• Criminal and civil attorneys handling corporate investigations should be in routine communication with one another

A Cozy Relationship

No Release of Liability Unless Approved

• Absent extraordinary circumstances or approved departmental policy, the DOJ will not release culpable individuals from civil or criminal liability when resolving a matter with a corporation

• Individuals on the hook even if the agency settles

• Officials can’t ignore the owners, officers, and others

What The Memo Means

Case of the Convicted Biller And the Convicted EMT…



Medicare Fraud Strike Forces

• Current conviction rate around 95%

• Average term of incarceration 4 years

“Criminalization” of Medical Necessity

• Several recent criminal cases convicted providers for performing “medically unnecessary” services and billing for them

Providing “Medically Unnecessary Services” = Fraud

The Problem With Medical Necessity Regulations

When Is “Transport By Other Means Contraindicated?”

Utilization Rates Compared to Other Providers



Be Able to Justify Why Your

Utilization Rates Are Different

• All 911

• Primarily dialysis

• Super rural area

• Older population

What’s the Government Looking at in 2016?

OIG’s 2015 Mid-Year Update

1. Transports to dialysis facilities that potentially Never occurred Were medically unnecessary

2. Improper ALS-E payments

“We will examine Medicare claims data [for]”

And Remember This Report?• “Ghost transports” • High mileage urban transports• High number of transport services per

beneficiary

On the OIG’s Radar



On the OIG’s Radar

• SCT trips not between facilities• Emergency trips not going to hospitals• Different providers furnishing dialysis

transports to same patient• Transports to/from partial hospitalization

The Media Picked up on This Report

And, the Media Picked up on the 2013 Medicare Ambulance Data

Release Your Action Items

• Document mobility assessments

• Regularly obtain facility records

• Patient video (with permission)

• Log of daily activities• Improve call intake screening

If You Do Dialysis Transports

• Documenting reasons why patient went to a particular facility Remember, “closest appropriate facility”

is the rule Consider the “locality” rule carefully

• Onboard documentation of mileage• Using shortest distance as measure

for mapping programs

If You’re in An Urban Area



• If the patient is going home or to a nursing facility, it’s not an emergency

If You’re Doing a Discharge If You Are in a Fraud “Hot Spot”

• Likely that other providers could go down, especially for “AKS suspect behavior”

Ambulance Moratoria Extended, Again!

Philadelphia Area

Houston Area

Houston and Philadelphia Ambulance Moratoria

• Effective January 29, 2016 CMS extended moratoria for an additional 6 months

Why the Extensions?

• CMS says the circumstances warranting the moratoria (high number of suppliers compared to similar areas) have not yet abated

Are YOU Next on the Moratorium List?



Now You Can Predict It!

• No. of fee for service beneficiaries• Avg. no. of users per provider• % of users out of FFS beneficiaries• Avg. no. of providers per county

Recent OIG Guidance for Boards

Small Organizations

• Must demonstrate the same degree of commitment to compliance as larger organizations

• May use less formality and fewer resources



More Involvement

Boards of smaller organizations should become more involved in the organization’s compliance efforts

Recent AmbulanceFraud Cases

The $11.5M Settlement

• FCA lawsuit filed by competitorWhistleblower will receive $1.7M

• 5 ambulance services allegedly charged deeply discounted rates – often below cost – on Part A transports to hospitals and SNFs for exclusive rights to Part B patients

Regent Management Services Case

“This settlement sends a message to the health care industry that both sides of a swapping arrangement can be held responsible for their improper actions, not just the entity that actually bills Medicare or Medicaid for the services”-Gregory Demske, Chief Counsel to the Inspector General

Another “Swapping” Case

• Ambulance service paid $8 million to resolve FCA allegations

• Allegedly entered into numerous below-cost contracts with SNFs

• Government determined that all the contracts constituted prohibited “swapping” arrangements

Competition Doesn’t Always Yield the Right Thing



Market This… The Jacksonville Case

• Nine hospitals and one ambulance company paid $7.5M to settle FCA allegations Hospitals paid bulk of settlement

• Government alleged hospitals routinely certified medical necessity of BLS non-emergency transports that were not medically necessary

The Jacksonville Case

• Even though the facilities were the primary target, remember that it is the ambulance service that submits the claims

• Ambulance service must scrutinize PCS forms from hospitals

The Jacksonville Case• Focus on “throughput” - hospitals

benefited by speeding up admissions and discharges

• First case to look at facility liability for ambulance medical necessity certifications

• BUT, burden on ambulance service to scrutinize PCS forms from hospitals

Remember . . .

• The presence of the signed physician certification statement does not alone demonstrate that the ambulance transport was medically necessary.

42 CFR 410.40(d)

The PCR is Critical!



What About Holding Physicians Responsible?

Is There Any Hope?

Letter Issued by MichiganMedicaid to Practitioners and

Facilities

Excerpt:

• “The physician is held responsible for excessive orders or unnecessary services regardless of who actually renders or who receives payment for the services. The physician may also be subject to any corrective action related to these services, including recovery of funds paid to the physician.”

So Are Ambulance Services Off the Hook in Michigan?

The Bottom Line

• The ambulance service receives the reimbursement

• But this reasoning may be helpful for ambulance providers in medical necessity appeals

There’s No Excuse



He Was Excluded

• Operator and “de facto owner” of ambulance and wheelchair van service Convicted in 2003 on a New Jersey state

health care charge, and was excluded federal health care programs for 11 years

How He Concealed it

• Never reported on 855B

• Everyone was in on it• Paid employees off

the books

This was a clear case where they knew he was excluded,

but…

Ambulance Services Have Been Hit With Other Exclusions

• Paramedic excluded for offense related to nursing license

• Owner excluded for defaulting on student loans

We mean here…

exclusions.oig.hhs.gov



Screen Everyone

• Providers• Managers• Billers• Drivers• Vendors• Dispatchers• Owners• Chiefs, etc.

Anyone Who Signs PCS Forms

When?

• Prior to hiring or engaging the employee, volunteer or contractor

• Every 30 days

Watch Less Obvious Kickbacks to Beneficiaries

• Routine waivers of copays

• Discounted wheelchair van services

• Waiver of excess mileage costs

Compliance Risk Management for 2016



2016 Risk Management• Know unique issues for each type of

transport: dialysis, discharges, SCTs, emergency response, excess mileage Focus on compliance weak spots for each

• Avoid the OIG exclusion quagmire Tune up initial screening and hiring

process Check your people – regularly

2016 Risk Management• Be ready for greater scrutiny of medical

necessity ICD-10 coding and Medicare contractors demand

more detail and specificity Clinical Documentation Improvement (CDI)

program a must

• Aberrant billing patterns Implement system to detect and monitor Audits (internal and external) Continual education

2016 Risk Management• Reduce “whistleblowing” likelihood Anonymous reporting and multiple

channels to report Exit interviews and supervisory training

on people management

• Establish the “Right Culture” The culture must exude compliance every

single day

PRIVACY UPDATE


Data Breaches

Continue to Abound

Multi-Factor Authentication on the Rise



Body Camera Use OIG Says OCR Should Do Better Follow-up of Breaches

OCR Didn’t Always Document Things

• 23 percent of cases had incomplete documentation of corrective actions

• OCR also did not record small breach information in its case-tracking system

OCR Didn’t Always Check for Prior Breaches

• 39 percent of staff reported they rarely or never checked to see if a provider had reported a prior large breach Treated providers as if it was first offense

OCR Has Been Cracking Down in 2015-16 • Allowed employees to

leave office with PHI and no policy

• Ex-husband of manager said former wife left documents in his car



• University of Washington Medicine

• UWM did not ensure that all of its affiliated entities were properly conducting risk assessments

• Employee downloaded malware

• They went much further than just investigating the small breaches the company reported

Provider Fined for File-Sharing

• Massachusetts hospital using an internet file-sharing program to save and share patient data

• Hospital workers reported this practice to HHS

$218,400 fine

Using File-Sharing Apps

• Analyze the risks of using the app and document the “risk analysis”

• Have a business associate agreement in place with cloud provider

Failure to Do Risk Analysis

• OCR received breach notification from a Cancer Care group after unencrypted laptop was stolen from an employee’s car

55,000 current and former patients’ info

$218,400 fine



Does PHI Leave Your Agency?

• If so, have you documented the risks and do you have policies and procedures? Encrypted devices and storage media Physical storage while in transit Reporting breaches immediately

The Dreaded Dumpster, Again

• Cornell Pharmacy paid $125,000 after media outed them for tossing PHI in the dumpster

But despite these fines, the OIG says OCR is not cracking down

enough

OCR is Still Too Reactive

• OCR’s still investigates possible noncompliance primarily in response to complaints

OCR Isn’t Auditing

• Hasn’t fully implemented the required audit program Only did a pilot audit program in 2011-12

• HITECH Act required permanent audit program as of 2010

OCR Isn’t Documenting Corrective Actions

• Did not have complete documentation of corrective actions taken by covered entities in 26 percent of closed privacy cases



The Theme for 2016 OCR’s Response

• Updated case-tracking system• Working on policies that ensure staff

check enforcement history• Educating staff to maintain

documentation• Will start permanent audit

program in 2016

Phase 2 HIPAA Audits Are Finally Coming in 2016

OCR is Making Moves

• Office for Civil Rights (OCR) sent pre-audit screening surveys to covered entities that could be selected for Phase 2

The Audit Process

• Data requests and selected entities have 2 weeks to respond OCR will only consider timely responses

• Then OCR will conduct either a desk or on-site audit

Who Will be Audited?

• Approximately 350 covered entities 232 providers

• Approximately 50 business associates



Primary Focus Areas of Phase 2

Identified Issues From 2011‐12 Pilot Audit

HITECH Act Requirements

Risk Analysis Breach Notification

NPP Right to Pay Out‐of‐Pocket

Patient Access Electronic Access to PHI

Device and MediaControls

Right to Request Transmission of PHI to

Third Party

Transmission Security NPP Updates

Reasonable Safeguards BAA Updates

Steps to Prepare

1. Recent documented risk analysis? –Do one!

2. Updated inventory of your BAs and current BAAs

3. You’ve at least considered encryption4. Breach notification policy

Steps to Prepare

5. Updated NPP (does it mention breach)

6. Training records in order7. Inventory of system assets (ePCRs,

servers, etc.)8. Physical and technical security in

place (keypads, cameras, etc.)

New Guide

https://www.healthit.gov/sites/default/files/pdf/privacy/privacy-and-security-guide.pdf

Recent Advice on Patient Rights



Patient’s Have a Right to Get Records Via Email

Even, Unencrypted Email

And, you Can’t Do This Stuff…

Make the Patient Physically Come In to Request PHI

Make the Patient Use a Web Portal to Access Their

Records

Make Them Mail a Request for Records



Notarize an Access Request

HEALTHCARE REFORM UPDATE


The 2015 SCOTUS Ruling on ACA

The Issue

• The ACA stated that tax credits were available to those who purchased insurance in “an Exchange established by the State”

• IRS regulations interpreted that to mean any exchange, State or Federally run

The Ruling

• Supreme Court ruled 6-3 that tax credits are available to individuals who purchase insurance in State or Federal Exchange

• The ACA remains intact



The Latest on the Employer Mandate

Mandate Phased in for Large Employers

• Employers with 100 or more FTEs: Must offer insurance to at least 70% of

full-time workers in 2015 Must offer insurance to 95% of full-time

workers in 2016 and beyond

Medium-Sized Employers

• Employers with 50-99 FTEs need to start insuring workers by 2016 or risk paying penalties under ACA

Small Employers

• Employers with up to 50 FTEs are not subject to employer mandate Can offer any coverage or no coverage

without penalty

• Tax credits have been retroactively available to small employers

Small Employer Tax Credits

• Employers with 25 or less FTEs and average annual wages of less than $50K are eligible for credits if: Employer contributes at least 50% of the

total healthcare premium cost

Find Out Much More in This Session



The Latest on Medicaid Expansion

Source: Kaiser Family Foundation Current as of August 28, 2014

AAPC CODE

The abc360 Compliance and Privacy Update

45111KAK

Compliance and Privacy Update - PWW Media Inc.€¦ · Example: ABC Ambulance’s billing software...

Documents

Transcript of Compliance and Privacy Update - PWW Media Inc.€¦ · Example: ABC Ambulance’s billing software...