Part one of this series provided a brief overview of the U.S. Department of Health and Human Services (HHS) Office of the Inspector General’s (OIGs) List of Excluded Individuals and Entities (LEIE), and discussed the importance of exclusion list checks.  

Part two will provide an overview of States that maintain exclusion lists. 

How often are these lists updated? How often should these State exclusion lists be checked? 

State Specific Requirements   

A State Medicaid Director letter advised states of their obligation to direct providers to screen their employees and contractors for excluded persons to prevent Medicaid payments from being made for items or services furnished or ordered by excluded individuals and entities. It further advised States to require that providers search OIG’s LEIE database monthly to capture new exclusions or reinstatements that have occurred since the last search.

There are two important State Program Integrity Activities and Compliance with Federal Programs projects:

1. OIG will determine the extent to which States collect required ownership information for provider entities enrolled in Medicare and Medicaid, and will describe the extent to which they verify the collected information.  OIG will also determine whether States and CMS checked exclusions databases for enrolling and enrolled providers, as required. 
2. OIG will review whether States are conducting enhanced screenings that assess risk for fraud, waste, and abuse for moderate- and high-risk enrolling and revalidating Medicaid providers and suppliers. OIG will also determine the extent to which States have screened moderate- and high-risk providers and suppliers using these risk-based screenings.

The combination of this increased scrutiny on States and their compliance with Federal regulations that require “oversight of provider ownership information” and “provider screening,” will demand increased diligence in checking for excluded individuals.  As mentioned in our previous article, if the task force finds that you have employed or contracted with excluded individuals or entities, you could face fines and penalties (42 CFR 1001.1901).

States that maintain a separate, State specific List  

According to a CMS, some States maintain their own exclusion lists which include individuals and entities that the State has barred from participating in State government programs, such as Medicaid.  

At last count, 38 States currently maintain a “separate” exclusion list: 

• Alabama
• Alaska
• Arizona
• Arkansas
• California
• Connecticut
• Florida
• Georgia
• Hawaii
• Idaho
• Illinois
• Iowa
• Kansas
• Kentucky
• Louisiana
• Maine
• Maryland
• Massachusetts
• Michigan 
• Minnesota
• Mississippi
• Missouri
• Montana
• Nebraska
• Nevada
• New Jersey
• New York
• North Carolina
• North Dakota
• Ohio
• Pennsylvania
• South Carolina
• Tennessee
• Texas
• Washington
• Washington, DC
• West Virginia
• Wyoming
  

How often do States update their lists? 

It depends. We took a look at each State exclusion list and found that some of the States are more diligent than others providing updates – some states only update periodically, while others provide updates at least monthly.   For example, Nevada maintains a “Nevada Exclusions/Sanctions List” that is periodically updated (last update October 2015) and can be checked in addition to the LEIE; New York maintains a ”List of Restricted and Excluded Medicaid Providers”  that is updated on a monthly basis and can be checked in addition to the LEIE.  

What is consistent is that each of these 38 states relies on the OIG LEIE for a comprehensive list. 

Recommendations to ensure compliance 

The OIG’s LEIE is by far the most comprehensive listing of all excluded individuals and entities.  Regardless of which State you are located in, if you participate in Medicare, Medicaid or any other Federal health care programs, all employees/vendors/subcontractors should be checked against the exclusion list – prior to hiring or contracting and monthly thereafter.  If you are located in one of the 38 States above, you should check your State exclusion list.  

Each year in August, National Immunization Awareness Month (NIAM) provides an opportunity to highlight the value of immunization across the lifespan. National Immunization Awareness Month presents a great opportunity to educate seniors and other people with Medicare on the importance of disease control and prevention through immunization and the vaccines covered by Medicare that help prevent disease. 

Vaccine-preventable disease levels are at or near record lows, yet many adults remain under-immunized, missing opportunities to protect themselves against diseases such as hepatitis B, seasonal influenza, and pneumococcal disease. Vaccines are even more important for people with chronic health conditions. An underlying health condition can make a person more susceptible to contracting a disease or have a more serious outcome if they do contract a disease. 

Medicare Part B Immunization Benefits 

Medicare provides coverage for seasonal influenza, pneumococcal, and hepatitis B vaccines and their administration for qualified beneficiaries as preventive immunizations. 

• Seasonal Influenza Immunization: Medicare covers one seasonal influenza virus vaccine per influenza season; a beneficiary could get more than one seasonal influenza virus vaccination in a 12-month period. Medicare may cover additional influenza vaccinations, if medically necessary. * 
• Pneumococcal Immunization: Medicare generally covers pneumococcal vaccination once in a lifetime for all Medicare beneficiaries. Medicare may cover additional vaccinations based on risk or uncertainty of beneficiary pneumococcal vaccination status. 
• Hepatitis B Immunization: Medicare covers the hepatitis B vaccinations that are reasonable and necessary for the prevention of illness for those individuals who are at high or intermediate risk of contracting hepatitis B virus. 

CMS asks healthcare providers who provide care to seniors and others with Medicare to join them during National Immunization Awareness Month to help protect your Medicare patients from vaccine-preventable diseases. This can be done by ensuring their immunizations are up-to-date, educating them on risk factors, and encouraging their use of appropriate Medicare-covered immunizations.

The Occupational Safety and Health Administration (OSHA) issued one serious and one other than serious violations to a residential health care facility for exposing employees to hazards related to workplace violence.  

As a result, OSHA has proposed $12,000 in penalties for the facility (Integrated Life Choices Inc. Lincoln, Nebraska). 

According to the announcement the citations follow an October 2015 OSHA investigation by the agency’s Omaha Area Office that found agitated clients have bitten, scratched, kicked and thrown objects at staff members. The client’s aggression exceeded the threshold of training workers had received to deal with potential violent clients and compromised their personal safety and ability to control the situation. 

Workplace violence is any act or threat of physical violence, harassment, intimidation, or other threatening disruptive behavior that occurs at the work site. It ranges from threats and verbal abuse to physical assaults and even homicide.  OSHA has guidelines for preventing workplace violence for health care and social workers.  

Last week while attending a conference I was asked about my responsibilities as a Compliance Specialist Manager.  I briefly provided an overview, and discussed how keeping up-to-date with rules and regulations in healthcare are some of my most taxing responsibilities. Then, someone quickly responded to me saying: “You are one of those abbreviation guys – responsible for keeping up with all the abbreviations in healthcare! Aren’t you?!?”

I responded in the affirmative. In many ways, her remark is true. In the world of healthcare compliance, abbreviations are similar to a bowl of proverbial alphabet soup – constantly keeping track of them becomes a daily chore.

Of all the abbreviations, perhaps there isn’t one more important (or at least more prevalent today) than HIPAA. This conversation prompted me to address what many administrators, providers, and business associates sometimes mistake when they think of this Act. In Part 1 of this series, we will provide a brief overview of HIPAA.

Part 1 – HIPAA vs “HIPPA”

HIPAA is the abbreviation for the Health Insurance Portability and Accountability Act of 1996.

The goals of HIPAA include:

• Information efficiency by creating a simpler more standardized system
• Reduction of paper claims
• A reduction of errors through safe and universally accepted electronic transactions
• Lowered health care costs
• Privacy and security in the US health care industry

HIPAA provided the framework for the evolution of HIPAA rules including the HIPAA Privacy Rule and the HIPAA Security Rule. The HIPAA Security Rule and the HIPAA Privacy Rule are two distinct rules.

• The Privacy Rule covers the policies and procedures that must be in place to ensure that the patient’s health information is protected and their rights are upheld.
• The Security Standard accompanies the Privacy Rule. In order to protect the health information security entities will be expected to have security safeguards in place.

“HIPAA” is often misspelled “HIPPA”

At one point or another, many of us have accidentally mis-typed HIPAA as “HIPAA”. Maybe subconsciously, we relate the term to the infamous hippopotamus which many of us call a “hippo” and this has played a role in our misspelling. Whatever the reasoning, today, I am going to argue in defense of this misspelling.

Being “one of those abbreviations guys” I thought it would be fun to look at what “HIPPA” as an abbreviation could represent:

“H”

In HIPAA the “H” represents “Health.”  This also works for our new HIPPA abbreviation since this act is providing protection within healthcare; however, it could also represent Human. Sometimes, for healthcare professionals, we forget that the Privacy Rule gives you (“human”) rights over your health information and sets rules and limits on who can look at and receive your health information.

“I”

Our new “I” could easily stand for “Information” as in “Health Information.”  With the privacy rule covering policies and procedures that must be in place to ensure that patient health information is protected, “information” makes a whole lot of sense.

“P”

As mentioned above the “P” in HIPAA is for “Portability.”  In HIPPA, “Portability” also makes sense. Would it also make sense for the “P” to stand for “Patient?”

At this point you can probably see where this is going.

“P”

For the purposes of this section, the second “P” will represent “Privacy.”

“A”

Finally, the “A” could easily stand for “Amendment” or “Announcement,” especially given the many changes, interpretations, and additions made to the HIPAA act over the past two decades. I think it is safe to say that we that these amendments and announcements are not going to end any time soon given the speed of technological innovations and changing pace of society.

What does it all mean?

As mentioned above, HIPAA provided the a framework for the evolution of HIPAA’s two distinct and critical rules: the HIPAA Privacy Rule; and the HIPAA Security Rule. Our new acronym continues that evolution and defines a key aspect of this commonly misspelled act, which is the protection of sensitive patient healthcare information.

In part 2 of our article series, we will aim to clear up HIPAA Privacy Rule confusion, including a discussion about modifications provided by the HIPAA/HITECH Act and Omnibus Final Rule.

Understanding documentation and medical necessity is critical to avoid denied claims and overpayment recovery. According to the CMS Medicare Claims Processing Manual:

Medical necessity of a service is the overarching criterion for payment in addition to the individual requirements of a CPT code. It would not be medically necessary or appropriate to bill a higher level of evaluation and management service when a lower level of service is warranted. The volume of documentation should not be the primary influence upon which a specific level of service is billed. Documentation should support the level of service reported.

Therefore, you must make an effort to document enough, not more. This means you should clearly document enough information to support the principal and contributing diagnoses.  And no longer is listing a condition on a problem list enough. 

To help you with your documentation efforts, we have asked one of Healthcare Compliance Pros Coding Auditors to provide some tips. Here are her recommendations: 

1. Documentation should support medical decision making; medical decision making drives documentation and coding.
2. Specificity – you should document as specifically as possible when describing your patient’s condition.
3. Co-morbidities – make the link between co-morbidities and the condition you are seeing for optimum medical decision making.
4. Analyze your billing /coding process to ensure accurate information is being submitted to reduce risks that that occur as result of over-coding, under-coding, and flat-coding.
5. Regular audits will help you make sure you have proper documentation and are receiving accurate reimbursements. Under- coding and flat-coding are generally more common than over-coding.

Record keeping is at the core of successful care business. It is a legal requirement, and several laws govern it. These laws also spell out the exact information stored in the records. Care businesses must consider these laws as part of their day to day business practice.

Keeping records helps in keeping all the information about the customers and clients who visit that business or facility. As a result, there is a serious need to ensure that the recordkeeping systems in such care businesses like hospitals are up to date by regularly reviewing them. In this article, we are going to focus on 5 ways care businesses can improve their record keeping.

1. Identify the Documentation Needed for Every Activity

To improve record keeping in a care business, you should first identify the required kind of documentation for every performed activity. Establish the exact documents that require filing. The filing can either be manual or electronic, and it assists in information retrieval when the need arises.

Identification of documentation required assists in the reduction of information load. The reason is that it categorically puts information in a way that the business knows what documents to discard and what to file. It saves on space and money.

“While broadly speaking dementia patients may present similarly, all dementia patients will have varying symptoms because the affected parts of the brain vary from one person to another.” says Jane Byrne at FirstCare.ie

2. Close Old Files and Open New Ones Every Year

It is advisable to close old files and open new ones every year. It is a practice that assists in reducing the overloading of the files in the care business. It also ensures the flexibility of the filing system. However, there is a need to keep the old records for reference purposes.

The advantage of having this practice is that you don’t spend a lot of time in retrieving information for the client or the customer.

3. File References Differently

Sometimes accessing the right files of information in a whole records system is complicated and tedious. For this reason, you require to have a reference material filing section. The references should also be filed so that when a patient comes in a hospital or any other care business, you can first consult the reference file.

The reference file enables you to quickly locate the file you are looking for in a records system.

4. Keep Updating the Records Regularly

One of the best practice that will improve your records management in a care business is a constant update of the information system. The regular updating ensures that no files of information have been left out knowingly and unknowingly.

If a regular update is not done, there is a possibility that crucial information about the clients in a business will be left out.

5. Carry Out A clean –Up of the Records Annually

A sound record system needs to be cleaned regularly. The clean-up ensures that mistaken and misplaced chunks of information and files are kept in the right places. It also ensures that a file contains up to date information by eliminating very old files to the archives.

The clean-up is an excellent way of ensuring that care businesses retain the most accurate, reliable and useful records about the clients or customers.

In conclusion, it is always good for care businesses to ensure that they check their records to ensure that they are valid. They should incorporate all the above practices in their day to day information errands to improve record keeping. They can work in insurance, banking, hospitals and in many other care businesses.

Determination – Is it a Breach?

In the event of a suspected breach caused by unauthorized access, or any other number of causes of a suspected breach, there are steps covered entities must take to determine if each incident is a breach.

Prior to the HIPAA Final Omnibus Rule, covered entities were required to determine risk of harm to affected individuals.  Now, covered entities must determine if there was a risk of compromise to Protected Health Information (PHI). A covered entity must determine:

1. The nature of the PHI involved;
2. The unauthorized person who used or received the information;
3. If PHI was actually acquired or viewed;
4. How the risk to the information has been mitigated.

It’s important to note, these four factors must be considered in combination in determining the likelihood that PHI was inappropriately used or disclosed.  And, making this determination can be a challenging process for entities.

Notification & Mitigation

Just as challenging for entities is ensuring proper notification to affected individuals, HHS, and in the event of a larger breach, notification to the media, is provided in a timely manner.

In addition, and perhaps two of the most important steps a covered entity must take, is to mitigate the risk of harm to the affected individuals; and to mitigate the risk of compromise to data.  

HIE has been mentioned in articles, podcasts, trainings, and for some us, as a topic of everyday conversation. In this article we will provide answers to some common questions about HIE:  What is HIE? Is HIE a Meaningful Use requirement? What are the benefits of HIE?

What is HIE?

Health Information Exchange (HIE) is the transmission of healthcare-related data among facilities, health information organizations and government agencies, according to national standards for interoperability, security and confidentiality. Electronic health information exchange (HIE) allows doctors, nurses, pharmacists, other health care providers and patients to appropriately access and securely share a patient’s vital medical information electronically.  

Think of HIE in terms of “pushing” and “pulling” information. For example, in directed exchange providers can securely send (pushing) patient information directly to another health care professional. In a query-based exchange providers can search and discover accessible clinical information by obtaining (pulling) a patient’s medical record.

Is HIE a Meaningful Use requirement?

To participate in Meaningful Use physician practices are not required to be part of a health information exchange.  However, providers will have to make information available for exchange as part of Stage 2 Meaningful Use. For example, for Stage 2 Meaningful Use Core Objectives for Eligible Professionals (EP), objective 15 includes the following measure:

”The EP who transitions or refers their patient to another setting of care or provider of care provides a summary of care record for more than 10 percent of such transitions and referrals either (a) electronically transmitted using CEHRT to a recipient or (b) where the recipient receives the summary of care record via exchange facilitated by an organization that is a NwHIN Exchange participant or in a manner that is consistent with the governance mechanism ONC establishes for the NwHIN.”

NwHIN: Nationwide Health Information Network also referred to as eHealth Exchange  

What are the benefits of HIE?

Electronic health information has several benefits, such as:

• Avoid readmissions
• Avoid medication errors
• Improve diagnoses
• Decrease duplicate testing
• Engage healthcare consumers regarding their own personal health information
• Improve public health reporting and monitoring
• Reduce health related costs

Conclusion

HIE allows doctors, nurses, pharmacists, other health care providers and patients to appropriately access and securely share a patient’s vital medical information electronically, by either pushing or pulling necessary information.  When used properly, HIE should improve the speed, quality, safety and cost of patient care.

Occasionally we answer questions regarding what constitutes a reportable breach. Questions such as: Isn’t it only a reportable breach if the incident involves electronic protected health information (ePHI)? What about paper? Should these types of incidents be handled internally and not require reporting?

Based on a recent U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announcement, both timely reporting and hard copy (paper) PHI are to be taken seriously. Moreover, this was the HIPAA settlement based on the untimely reporting of a breach of unsecured PHI.

OCR received a breach notification report on January 21, 2014 from Presence Health indicating that on October 22, 2013 Presence discovered that paper-based operating room schedules, which contained the PHI of 836 individuals, were missing from the Presence Surgery Center. The information consisted of the affected individuals’ names, dates of birth, medical record numbers, dates of procedures, types of procedures, surgeon names, and types of anesthesia.

OCR determined that Presence failed to notify, without unreasonable delay and within 60 days of discovering the breach, each of the 836 individuals affected by the breach, prominent media outlets (as required for breaches affecting 500 or more individuals), and OCR.

Ultimately, Presence health agreed to pay $475,000 and implement a corrective action plan to settle potential violations of the HIPAA Breach Notification Rule. 007A

Key Takeaways from OCR’s Announcement

1. OCR believes the settlement amount balanced the need to emphasize the importance of timely breach reporting with the desire not to disincentive breach reporting altogether.
2. Whether the impermissible access or disclosure of PHI is oral, electronic, or paper, you should ensure all incidents, breaches and complaints are properly researched.
3. Notice must be provided without unreasonable delay within 60 days of discovering a breach to affected individuals, to OCR, and for breaches involving 500 or more individuals – to prominent media outlets.

Recently, the OCR released guidance on HIPAA Privacy Rule and Sharing Information Related to Mental Health. The guidance addresses when it is appropriate for a health care provider to share PHI of a patient being treated for a mental health condition.  

Communication with Family, Friends, or Others

HIPAA allows a health care provider to communicate with a patient’s family, friends or other persons who are involved in the patient’s care. The Privacy Rule allows routine and often critical communications between health care providers and these persons, as long as the patient is present, has the capacity to make health care decisions, and as long as the patient does not object.

A provider may choose to ask for the patient’s permission, may explain to the patient he or she plans on discussing information, giving the patient an opportunity to agree or object; or if necessary, may infer from the circumstances, using professional judgment, that the patient does not object.

Extra Protections for Mental Health Information

The Privacy Rule applies uniformly to PHI without regard to the type information, except for psychotherapy notes, which receive special protections. With few exceptions the Privacy Rule requires a covered entity to obtain a patient’s authorization prior to a disclosure of psychotherapy notes for any reason, including a disclosure for treatment purposes to a health care provider other than the originator of the notes. Exceptions are when a disclosure is required by law or in mandatory “duty to warn” situations. State laws vary if a warning is mandatory or permissible.

Communication with Adult Patient’s Parents or Other Family Members

A health care provider is permitted to discuss an adult patient’s mental health information with a patient’s parent’s or other family if a patient is given the opportunity and does not object.

Health care providers may share or discuss only the information the person involved needs to know about the patient’s care or payment for care. There may be other applicable laws or professional ethics that impose stricter limitations on sharing PHI, especially where the information related to a patient’s mental health.

Mental Health Illness or Mental Condition Constitutes Incapacity

The HIPAA Privacy Rule permits a health care provider, when a patient is not present or is unable to agree or object to a disclosure due to incapacity (e.g. patient is unconscious) or emergency circumstances, to determine whether disclosing a patient’s information to the patient’s family, friends, or others involved in the patient’s care or payment for care, is in the best interests of the patient.

A Patient Stopped Taking Prescribed Medications

The doctor must respect the wishes of the patient with respect to the disclosure. If a patient does not object, a provider may discuss a patient’s mental health information with the patient’s family members. The provider may also discuss information if based on the provider’s professional judgment, the patient does not have the capacity to agree or object the sharing of the information, and the sharing of that information is in the patient’s best interests.  In both cases, only the information that the family member involved needs to know about the patient’s care or payment for care should be disclosed.

The sharing of information must be consistent with applicable law and standards of ethical conduct. An exception is if a provider has a good faith belief a patient is a high risk for committing suicide. A doctor may believe a good faith disclosure is necessary. A provider is allowed to disclose health information if there is a good faith belief that the disclosure is necessary to prevent a serious and imminent threat to the health safety of the patient or others.

Discussion of a Minor Child Patient’s Mental Health Status and Needs

HIPAA defers to state law to determine the age of majority and the rights of parents to act for a child in making health care decisions. A parent, guardian, or other person acting in loco parentis usually is the personal representative of the child under the Privacy Rule with respect to general treatment situations.

Exceptions of this general rule in the Privacy Rule include:

(1) State or other law does not require the consent of a parent or other person before a minor can obtain a particular health care service, the minor consents to the health care service, and the minor child has not requested the parent be treated as a personal representative;

(2) someone other than the parent is authorized by law to consent to the provision of a particular health service to a minor and provides such consent; or

(3) a parent agrees to a confidential relationship between the minor and a health care provider with respect to the health care service.

In situations where a minor patient is being treated for a mental health disorder and a substance abuse disorder, additional laws may be applicable.  

Copy of Psychotherapy Notes about a Child’s Mental Health Treatment

A parent does not have a right to receive a copy of psychotherapy notes about a child’s mental health treatment. The Privacy Rule distinguishes between mental health information in a mental health professional’s private notes and the information contained in the medical record. It does not provide a right to access psychotherapy notes. Psychotherapy notes are primarily for personal use by the treating professional and generally are not disclosed for other purposes.

Parents generally are the personal representatives of their minor child. Parents are able to receive a copy of their child’s mental health information contained in the medical record, including information about the diagnosis, symptoms, treatment plans, etc.  

What if a Patient is Going to Hurt Self or Others?

The Privacy Rule permits a health care provider to disclose necessary information about a patient to law enforcement, family members of the patient, or other persons, when the provider believes the patient presents a serious and imminent threat to self or others.  

What about Mental Health Information Held by a School?

Student health information held by a school generally is subject to the Family Educational Rights and Privacy Act. In limited circumstances the HIPAA Privacy Rule and not the Family Educational Rights and Privacy Act may apply in a school setting. The Rule allows disclosures to parents of a minor patient or to law enforcement in various situations. For example, disclosures to prevent or lessen serious and imminent threats to the health and safety of the patient or others are permitted.