Author Archives: Matt Kinley

New Tools to Help Providers Conduct Security Risk Assessments

The Office of the National Coordinator for Health Information Technology (ONC), in collaboration with the HHS Office for Civil Rights (OCR), recently released a jointly developed tool designed to assist small and medium sized practices (one to ten healthcare providers) in conducting  security risk assessments (the “SRA Tool”). This tool can be found at http://www.healthit.gov/providers-professionals/security-risk-assessment-tool.

The HIPAA Security Rule mandates that covered entities and business associates assess the potential risks and vulnerabilities to the confidentiality, integrity and availability of the electronic PHI they hold and take appropriate measures to minimize those risks and vulnerabilities.  These steps are a crucial part of an entity’s Security Management Process and considered by HHS to “form the foundation upon which an entity’s necessary security activities are built.”

The Rule does not specifically outline the steps entities should take in conducting a risk analysis or dictate how often it should be done.  In previous guidance, HHS indicated that covered entities could use, but were not required to use, any of the National Institute of Standards and Technology (“NIST”) publications, such as SP 800-30 – “Risk Management for Information Technology Systems.”  Others have used the OCR Audit Program Protocol to guide them in conducting risk assessments or developed home grown tools.

Use of the SRA Tool is not required by the Security Rule or by OCR, nor does it guarantee compliance with HIPAA or state privacy and security laws.  The purpose of this specific tool is to “assist healthcare practices in performing and documenting a Security Risk Assessment.”  Although small to medium practices are the target audience, larger organizations or practices can benefit from viewing the tool and tailoring it to their specific needs. The tool does not include provisions to assess for compliance with the Privacy Rule.

THE FEDERAL GOVERNMENT ISSUES IT REPORT; TUSTIN DOCTOR ARRESTED FOR FALSE CLAIMS UNDER THE FCA

The Department of Health and Human Services and The Department of Justice Health Care Fraud and Abuse Control Program Annual Report for Fiscal Year 2013

The HHS report details efforts to recover for fraud claims under the Federal False Claims Act, including convictions against physicians, hospitals, device manufacturers and drug manufacturers.

For California, the star of the report goes to this Tustin doctor and hospital.  As stated by the report:

‘In December 2012, a California physician was sentenced for his role in a hospital fraud scheme to 1 year and 1 day in prison and ordered to pay $11 million in restitution. He previously pleaded guilty to conspiracy to receive kickbacks. According to court documents, Tustin Hospital paid marketers to recruit patients and drive them from “Skid Row” around Los Angeles, past other hospitals, to be admitted to its facility. The physician admitted these patients and then he and the hospital billed Medicare for in-patient services, even if the services were not medically necessary. The physician admitted that many of the recruited patients had been coached to recite false symptoms, and that he falsified medical records to justify the admission of some patients. On average, he admitted approximately 60 patients per month to the hospital, even though some did not require hospitalization”

THE ACA AND NURSE PRACTITIONERS UNDER CALIFORNIA LAW

NURSE PRACTITIONERS REQUIRE SOME DUE DILIGENCE

The ACA utilizes the idea of non-physician professionals to help bridge the gap presented by having insufficient physicians to handle patients.  It is hoped that utilizing these professionals will help increase communications with patients, particularly chronic patients who could avoid hospital stays by seeing a nurse practitioner for an office visit or even email communication with a knowledgeable professional  Finally, utilizing non-physicians should lower costs.

In California, this presents some major issues.  California carefully regulates the use of such professionals, particularly nurse practitioners.    Specialists need to  pay attention to creating the right environment for such professionals.  Standardized Procedures should be updated to conform to the needs of the practice.  The California Code of Regulations (Title 16, section 1472) requires physicians to have “standardized procedures” before permitting registered nurses to perform treatments and procedures.  The purpose of the standardized procedures is to establish policies and protocols for NPs so that they are able to perform their authorized duties.  It is particularly important to update these standardized procedures because your NP will most likely be characterized as your employee, which will expand the scope of your liability for her acts.

California Code of Regulations Title 16, section 1474 establishes specific guidelines for the standardized procedures and provides that each standardized procedure must:

v    Be in writing.

v    Specify which functions the nurse may perform and under what circumstances.

v    State specific requirements to be followed by the nurse in performing specific functions.

v    Specify experience, training, and education requirements for the performance of the procedure function.

v    Establish a method for initial and continuing evaluation of the competence of the registered nurse.

v    Provide for a method of maintaining a written record of who is authorized to perform standardized procedure functions.

v    Specify the scope of supervision required for performance of standardized procedure functions.

v    Set forth specialized circumstances under which the nurse is to immediately communicate with the patient’s physician concerning the patient’s condition.

v    State the limitations on settings.

v    Specify patient record keeping requirements.

v    Provide for a method of periodic review of the standardized procedure.

 

            (a)       Furnishing Scheduled Drugs

                        Of particular importance are the standardized procedures on Furnishing Scheduled Drugs.  California law requires that you specifically list “which drugs or devices may be furnished or ordered” and “under what circumstances.”  (Bus. & Prof. Code, § 2836.1(c)(1).)  We recommend to physicians that they review the “List of Scheduled Drugs” to ensure that it is consistent with the drugs that the NP may prescribe to patients.  

            (b)       Dispensing Hormonal Contraceptives

                        California law also has strict guidelines for a nurse’s dispensation of self-administered hormonal contraceptives.  In order to administer hormonal contraceptives, your practice must have standardized procedures developed in compliance with Business and Professions Code section 2725.2.  These standardized procedures must include, but are not limited to, the following:

v    Which nurse may dispense the hormonal contraceptive.

v    Minimum training requirements regarding educating patients on medical standards for ongoing women’s preventative health.

v    Competency in providing the appropriate prior examination of checking blood pressure, weight, and patient and family health history, including medications taken by the patient.

v    List of the contraceptives that may be dispensed or administered under specific circumstances.

v    Criteria and procedure for identification, documentation, and referral of patients with contraindications for hormonal contraceptives and patients in need of a follow-up visit to a physician and surgeon, nurse practitioner, certified nurse-midwife, or physician assistant.

v    The extent of physician and surgeon supervision requested.

3.         Ensure that Your Nurse Practitioner is “Clinically Competent”

           NPs  must be “clinically-competent” to treat a particular population.  Standardized procedures should establish a method for the continuing evaluation of the competence of your NP to perform the specified procedures.

Following these procedures will help you utilize nurse practitioners to help your patients.  You will also avoid accusations of failing to follow state law in guiding the NPs to perform as if they were an extension of your care.

BY:  Matt Kinley, Esq,

REPORT ON EHR COMPLIANCE: What Providers are Not Doing

The Department of Health & Human Services, Office of Inspector General, has issued a report entitled “CMS and Its Contractors Have Adopted Few Program Integrity Practices to Address Vulnerabilities in EHRs.

According to the OIG, few Medicare contractors were effectively utilizing EHRs, and most still utilized paper medical records.  Much of the report is devoted to guidance that can be offered t providers by CMS, especially on detecting fraud in the medical records.   CMS should also assist with providing information on what is necessary in the EHR file, and electronic signatures.

PRIVACY: BREACH NOTIFICATION UNDER CALIFORNIA AND FEDERAL LAW

WHAT HAPPENS WHEN A PROVIDER ACCIDENTALLY REVEALS PERSONAL HEALTH INFORMATION?

Let’s say someone in your office accidentally sends a patient the information about a different patient?  Or, your web portal  allows patients to see other patients information? What to do?

Notifying Patient of Revealed Information

Both under Federal and State Law, the covered entity must notify all individuals whose unsecured protected health information has been accessed as a result of a security breach.   Such notification may not be “unreasonably delayed” but must be within 60-days of the breach.  It must be specific as to content disclosed.  Also the Secretary of the Department of Health and Human Services must be notified.  (See, generally:  HSS Website.)

Review Your Policies

Security and Privacy procedures must be reviewed, and the review must be documented, and changes must be made to prevent reoccurrence.

California Law Has Additional Requirements

State law must be further consulted for further requirements. California’s general privacy laws and the Confidentiality of Medical Information Act apply.

There are civil and criminal penalties and there is a private cause of action

Talk to a Lawyer

When making a decision about revealed health information, speak to an attorney.   The decisions about what to do should not be taken lightly as there can be major fines from both the federal and state government, as well as likely lawsuits by the patients involved.

Insurance

Make sure you have the right insurance.  This is usually not included with your normal civil insurance or your malpractice insurance.  Review your policies, talk to your broker.  These policies can save you from the high costs of attorneys and helping your patients deal with the problems.  

By Matthew L. Kinley, Esq. 

ALL THE AGENCIES THAT REGULATE HEALTHCARE ALL IN ONE PLACE!

Oversight of Health Care Industry

MEANINGFUL USE AUDITS TAKE BACK INCENTIVE PAYMENTS

EHR Incentive Programs/Supporting Documentation For Audits

Contact Matthew L. Kinley, Esq at Tredway, Lumsdaine & Doyle if you are subject to audit or need advice about your compliance program.

877.923.0971

According to the Centers for Medicare and Medicaid Services, about 10% of the healthcare providers who took advantage of the meaningful use incentives will be audited by a private contractor hired to look for errors.

THE MEANINGFUL USE PROGRAM

Under the 2009 HITECH Act, health care providers who demonstrate meaningful use of certified electronic health records will receive incentive payments through Medicaid and Medicare. States can receive a 90% federal funding match for incentive payments distributed to Medicaid providers who adopt EHRs under the meaningful use criteria.  Eigible physicians who see Medicare and/or Medicaid patients, as defined by the HITECH Act summary, will be compensated from $44,000 to $63,750 over a 5 year term for fulfilling the recently defined ‘meaningful use’ criteria. To further promote the use of certified systems, if these same physicians do not utilize healthcare IT that meets the Federal requirement by 2015, they will be faced with increasing penalties of up to 5%.

Providers started receiving Medicare or Medicaid bonuses for using certified EHR technology in 2011 and will get around $20 billion over five years. The meaningful use incentive program requires hospitals and eligible professionals (e.g., physicians) to use EHRs to improve patient safety, quality of care and patient-provider communication. Providers must buy EHRs from vendors on the Certified Health IT Product List (see http://healthit.hhs.gov/chpl). If they don’t, they face a Medicare payment reduction after 2015.

REQUIREMENTS FOR HITECH

Documentation to support attestation data for meaningful use objectives and clinical quality measures should be retained for six years post-attestation. Documentation to support payment calculations (such as cost report data) should continue to follow the current documentation retention processes.

MEANINGFUL USE AUDITS

States and their contractors will perform audits on Medicaid providers. When providers are selected for an audit, they will receive an initial request letter from the auditor. The request letter will be sent electronically from a CMS email address and will include the audit contractor’s contact information.

The initial review process will be conducted at the audit contractor’s location, using the information received as a result of the initial request letter. Additional information might be needed during or after this initial review process, and in some cases an onsite review at the provider’s location could follow. A demonstration of the the EHR system could be requested during the on-site review

If there is any deficiency in the audit, providers will have to give back their entire meaningful use incentive payment.  That means their payments for the audit period are at risk unless their electronic health records show they kept every promise they made to the government when they accepted the money.

One letter from the EHR HITECH Incentive Payment Center said a meaningful use audit had determined that “an overpayment of HITECH funds has been determined and is owed.” CMS gave the provider 30 days to repay the money, although it had the right to appeal.

Most providers are having negative audit findings and owing the money back, often because they thought they met most of the core elements, but they didn’t get them all done, or they weren’t all properly documented. If you miss a core element, they ask for all the money back.

HIPAA and PRIVACY POLICIES

The security risk analysis is a problem area in meaningful use. Providers must attest that they conducted a risk analysis, which is a core measure as well as required by the HIPAA security regulation.  Most providers fail to do such an analysis.

BEST PRACTICES TO AVOID AN AUDIT

The following practices should be employed as soon as possible by all providers.  Those who worked for and obtained benefits for meaningful use are particularly vulnerable.

Best Practices

• Enter accurate numbers when you attest to meaningful use of an electronic health record (EHR).

• Keep your supporting documentation.

• Know that dated screen shots provide a good source of documentation.

• Save paper or electronic copies of reports used to attest if the practice’s EHR automatically changes numerator and denominator values after the reporting period ends.

• Turn on, for the entire reporting period, EHR features that track functionality issues, such as drug interaction checks and clinical decision support.

• Understand that the security risk analysis must be specific to the EHR and the practice and is required every year.

By Matthew L. Kinley

Human Resources is for Physician Offices, too

2ND ANNUAL EMPLOYER HR SUMMIT
CA EMPLOYMENT LAW & HEALTH CARE REFORM

TUESDAY  •  JANUARY 21, 2014

Matt Kinley, Tredway, Lumsdaine & Doyle
Audrianne Adams Lee, HR NETwork, Inc.

Location/Sponsored by:

Long Beach City College
4901 Carson St, Long Beach, CA 90808
Room # – TBA upon Registration

No cost to attend this event.
A box lunch is included.

Format/Schedule
8:30         Registration
9:00-12:00     2014 Workplace Compliance – New Laws and Trends
12:00-12:30    Box Lunch – Presentation by
10,000 Small Businesses
12:30-2:30     Health Care Reform – What Now?
2:30-3:00     Health Care/Vendor Panel for Q&A

To register, call 714.799.1115 or email to michelleb@hrnetworkinc.com
2014 Workplace Compliance –
New Laws and Trends
A wave of new employment legislation, case law developments, and other employment law trends stand to significantly impact the California workplace in 2014. With many of these new laws taking effect on January 1, employers with California operations must take prompt action to ensure compliance and to mitigate workplace law risk.

We discuss the critical changes in law, the impact of the new regulations, and recommendations for employers. Topics covered will include:

•     Legislative developments
•     Trends and significant decisions in California employment law
•     Cases to watch for 2014

Health Care Reform –
What Employers Need to Know

In this portion of the seminar, we will respond to these and many other questions you have surrounding Health Care Reform:

•    Meeting the threshold in 2015
•    What are my options to offer/not offer coverage (Under/over 50 employees)?
•    Calculating my FTE count
•    HIPAA Compliance – What I am responsible for?
•    Reporting requirements for Employers
•    How to assist and communicate the ACA to your employees

EMPLOYER STRATEGIES: NEW TAXES UNDER THE AFFORDABLE CARE ACT

OBAMACARE’S TAXES AND THE WORKPLACE

There is a tremendous amount of information about the Patient Protection and Affordable Care Act (ACA) and it is difficult to understand what the tax implications are.  Essentially under the ACA, health insurance is now tied to taxes.  There are two important tax implications of the ACA to individuals: 1) there is a tax credit to help pay for insurance premiums if one qualifies and 2) there are tax penalties if one does not have health insurance. For employers, the same basic principal applies and the tax implications vary depending upon whether the employer is small or large.

Individuals

Beginning in 2014, ACA provides a Premium Tax Credit, which is a refundable credit to help offset the cost of health insurance premiums for qualifying taxpayers.  A qualified taxpayer can take an advance payment of the advanced credit based upon his/her estimated income and family size for the year.  An equal portion of the estimated credit is paid directly to the insurance company each month during the tax year.

When filing his/her tax return, the taxpayer must compare the prepaid credit against the actual credit allowed.  If there is a difference in the prepayments and the actual credit, the taxpayer could be owed more Premium Tax Credit or alternatively, the taxpayer could be required to repay the IRS the amount of any excess prepaid credit.  A qualified individual could also choose to pay premiums out-of-pocket each month and collect the full credit when he/she files taxes.

The amount of credit available for prepayment is calculated by the Health Insurance Marketplaces, known as the Exchanges.  During enrollment through the Marketplace, using information that the taxpayer provides about his/her projected income and family composition for 2014, the Marketplace will estimate the amount of the Premium Tax Credit he/she will be able to claim for the 2014 tax year that he/she will file in 2015.  It is important to report changes and income to the Marketplace through the year.  Reporting changes will help assure a taxpayer that they will have the accurate amount of credit.  Changes in family size can include the birth or adoption of a child, a child moving out of the household, parents moving into the household, marriage or divorce.

The Premium Tax Credit is not allowed if the taxpayer files using the Married Filing Separately status, if they are eligible for coverage under their state’s Medicaid program (which is free), or if they are enrolled in an insurance plan through their employer.

If a taxpayer does not have insurance after February 15, 2014, he/she may be assessed a tax penalty under the Shared Responsibility Provision, which allows a penalty assessment on certain taxpayers and qualified employers who do not offer insurance.  In 2014, the penalty is either $95 for adults and $47.50 for children or one percent of taxable income, whichever is greater.  The penalty will increase annually and by 2016, it will be the greater of $695 or 2.5 percent of the total household’s taxable income, whichever is greater. The penalty will show up as tax owed when the taxpayer files his/her income tax return.

For tax year 2013, contributions to flexible spending accounts are limited to $2,500, which previously had no cap.  However, employers can offer employees a choice between rolling over up to $500 to use in the next year or a 2.5 month grace period to spend it.  In 2014 and after, the contribution cap will increase with inflation.

For those who itemize deductions for out-of-pocket medical expenses, the expenses must total 10 percent of their adjusted gross income, which is up from 7.5 percent in prior years.  There is an exception until 2016 for taxpayers age 65 and older or if one spouse reaches age 65 for married couples filing jointly.

Furthermore, there is an additional 0.9 percent Medicare tax for married couples filing jointly earning above $250,000, $200,000 for single filers, and $125,000 for married couples filing separately. This applies to wages, compensation and self-employment income.

For high income taxpayers, there is an additional 3.8 percent net investment income tax, which includes interest, dividends, and rental income.  Tax is owed if the taxpayer has net investment income and modified adjusted gross income over $250,000 (married filing jointly); $125,000 (married filing separately); $200,000 (single); $200,000 (head of household with a qualifying person); and $250,000 (qualifying widow or widower with a dependent child).  It applies only to net profits that exceed $500,000 for married couples filing jointly and $250,000 for single filers.

Small Employers

Small employers are defined as fewer than 50 full-time employees or equivalents.  Fewer than 25 full-time equivalent employees may be eligible for a Small Business Health Care Tax Credit to help cover the cost of providing coverage.  Generally, employers with 50 or fewer employees may be eligible to buy coverage through the Small Business Health Options Program (SHOP).  Small businesses may be eligible for tax credits up to 50 percent of their cost of employee premiums through the SHOP.

Large Employers

For large employers, who are generally defined as those with 50 or more full-time time equivalent employees, effective for calendar year 2015, they may be subject to a non-deductible excise tax under Internal Revenue Code §4980H.  Full-time employee is defined as an employee who is employed on average 30 hours of service per week, per month.

Although the ACA does not require an employer to offer coverage to its employees, a large employer can be subject to the excise tax if at least one full-time employee receives a premium tax credit for Exchange coverage, and the employer:

•    Fails to offer coverage to full-time employees and their dependents (tax equals $2,000 times the total number of full-time employees)

Or

•    Offers coverage to full-time employees that does not meet the law’s affordability or minimum value standards (tax equals $3,000 times the number of full-time employees receiving tax credits for Exchange coverage) To be considered affordable, an employee’s share of the self-only premium for the employer’s lowest-cost plan that provides minimum value cannot exceed 9.5 percent of household income, or the employee may be eligible for a premium tax credit to purchase health insurance exchange coverage. The Treasury Department has proposed a safe harbor based on the employee’s current W-2 wage.
Employers also will face a host of new reporting requirements to the IRS under the ACA in order to demonstrate the value of coverage offered to employees, communicate to employees’ their coverage options, and certify compliance with the employer coverage provisions. Large employers will need to file an annual return reporting whether and what health insurance they offered employees. In addition, they are subject to the Employer Shared Responsibility provisions.  Many employers are undertaking compliance reviews to have their health plan offerings audited and certified to mitigate the potential risk for tax penalties.

 By Pamela Tahim of Tredway, Lumsdaine & Doyle

 

 

COVERED CALIFORNIA: WHAT’S A PROVIDER TO DO?

Several issues arise from the proposed agreements for providers from Qualified Health Plans (“QHP”) under Covered California. Some issues that physicians and other providers should be watching out for:

1. Payment Schemes. Initial contracts from the various QHP’s are offering low payment options, particularly the “80% of Medicare” option. Physicians should be wary of such agreements. Under QHP contacts with Covered California, the plans have agreed to work on value-based payments in the future, making future contracts even less attractive for providers.

2. Hospital Contracts. There still is no clarity on which hospitals will take part in Covered California and under what plans. Covered California has no listing of participating hospitals at this time. The prospect of narrow networks (fewer providers offered to consumers) makes it troublesome to predict the future on hospital participation.

3. Administrative Burdens. QHPs are imposing difficult and legally thorny administrative tasks on providers, particularly providing information about patients and payments.

4. Populations. Get information on the types of patients expected under contracts. The initial rounds of patients are predicted to be populations that are in fair to poor health. Since they are not used to traditional medical care, they are expected to have a large percentage of missed appointments and compliance issues.

5. Collections. What is the providers obligations to collect? Some Covered California plans leave high deductibles and copays for enrollees. Yet, the newest enrollees are not used to paying such amounts. Also, determine risk for patients who fail to pay premiums to Covered California QHPs. Providers may be on the hook.

With all the problems with exchange products, providers may want to sit out this first round

Several issues arise from the proposed agreements for providers from Qualified Health Plans (“QHP”) under Covered California. Some issues that physicians and other providers should be watching out for:

1. Payment Schemes. Initial contracts from the various QHP’s are offering low payment options, particularly the “80% of Medicare” option. Physicians should be wary of such agreements. Under QHP contacts with Covered California, the plans have agreed to work on value-based payments in the future, making future contracts even less attractive for providers.

2. Hospital Contracts. There still is no clarity on what hospitals will take part in Covered California and under what plans. Covered California has no listing of participating hospitals at this time. The prospect of narrow networks (fewer providers offered to consumers) makes it troublesome to predict the future on hospital participation.

3. Administrative Burdens. QHPs are imposing difficult and legally thorny administrative tasks on providers, particularly providing information about patients and payments.

4. Populations. Get information on the types of patients expected under contracts. The initial rounds of patients are predicted to be populations that are in fair to poor health. Since they are not used to traditional medical care, they are expected to have a large percentage of missed appointments and compliance issues.

5. Collections. What is the providers obligations to collect? Some Covered California plans leave high deductibles and copays for enrollees. Yet, the newest enrollees are not used to paying such amounts. Also, determine risk for patients who fail to pay premiums to Covered California QHPs. Providers may be on the hook.

With all the problems with exchange products, providers may want to sit out this first round of patients.

FORNIA: WHAT’S A PROVIDER TO DO?

Several issues arise from the proposed agreements for providers from Qualified Health Plans (“QHP”) under Covered California. Some issues that physicians and other providers should be watching out for:

1. Payment Schemes. Initial contracts from the various QHP’s are offering low payment options, particularly the “80% of Medicare” option. Physicians should be wary of such agreements. Under QHP contacts with Covered California, the plans have agreed to work on value-based payments in the future, making future contracts even less attractive for providers.

2. Hospital Contracts. There still is no clarity on what hospitals will take part in Covered California and under what plans. Covered California has no listing of participating hospitals at this time. The prospect of narrow networks (fewer providers offered to consumers) makes it troublesome to predict the future on hospital participation.

3. Administrative Burdens. QHPs are imposing difficult and legally thorny administrative tasks on providers, particularly providing information about patients and payments.

4. Populations. Get information on the types of patients expected under contracts. The initial rounds of patients are predicted to be populations that are in fair to poor health. Since they are not used to traditional medical care, they are expected to have a large percentage of missed appointments and compliance issues.

5. Collections. What is the providers obligations to collect? Some Covered California plans leave high deductibles and copays for enrollees. Yet, the newest enrollees are not used to paying such amounts. Also, determine risk for patients who fail to pay premiums to Covered California QHPs. Providers may be on the hook.

With all the problems with exchange products, providers may want to sit out this first round of patients.