Test your knowledge with this week’s free quiz, which focuses on ICD-10-CM codes for general symptoms and signs. (View)
Click here for more sample CPC practice exam questions with Full Rationale Answers
Laureen shows you her proprietary “Bubbling and Highlighting Technique”
Download your Free copy of my "Medical Coding From Home Ebook" at the top right corner of this page
Category Archives: Cpc Exam Study Guide For Medical Coder Certification
Telehealth
Can a provider do telehealth visits from his home or does it have to be done from an "office" setting? I am looking specifically at Medicare and cannot find a definitive answer.
Thanks in advance for any advice or guidance on this matter.
Legal and regulatory news roundup
Find out what’s happening in the world of federal healthcare regulations by reviewing some recent head-lines from across the country.
Hospital pays to resolve Stark Law allegations
To resolve allegations that it maintained improper financial arrangements with physicians, Lexington Medical Center (LMC) in West Columbia, South Carolina, has agreed to pay $ 17 million.
According to the U.S. Department of Justice, LMC allegedly entered into purchase agreements to acquire physician practices and employment agreements with 28 physicians that violated the Stark Law. The law prohibits hospitals from billing Medicare for certain services if they referred from physicians with which they have
a financial relationship. The purchase and employment agreements between LMC and the physicians allegedly took the volume and value of physician referrals into account, provided compensation above fair market value, or were not commercially reasonable.
LMC will also enter into a corporate integrity agree-ment with the Department of Health and Human Services Office of Inspector General that will require it to institute measures to avoid similar conduct in the future.
Estate of patient forcibly removed from hospital sues for wrongful death
The estate of Barbara Dawson has named Calhoun Liberty Hospital in Blountstown, Florida, as a defendant in a wrongful death lawsuit. Dawson died at the hospital in December from a blood clot in her lung after she was arrested for failing to leave after being discharged.
During the early hours of December 21, Dawson arrived by ambulance to the hospital complaining of tomach pain, according to the Tallahassee Democrat. Although she was treated, cleared to leave, and dis-charged, Dawson complained of difficulty breathing and refused to leave the hospital.
Dawson argued for more than an hour with medical staff and a Blountstown police officer called to the scene before she was placed in handcuffs and arrested for disorderly conduct and trespassing. As Dawson was being escorted out of the hospital to a police cruiser, she continued to complain of breathing difficulty and pleaded for her oxygen machine. She then collapsed and was taken back into the hospital. She died an hour later.
The Agency for Health Care Administration (AHCA) subsequently launched an investigation and found 10 deficiencies related to Dawson’s death. The AHCA fined Calhoun Liberty $ 45,000 and ordered it to undertake a corrective action plan to address the deficiencies, which included staff training on the federal requirements of the Emergency Medical Treatment and Active Labor Act
(EMTALA). EMTALA aims to prevent the practice of “patient dumping”—discharging or transferring a patient to another hospital before stabilizing treatment is provided for emergency medical conditions—by requiring hospital emergency departments that accept payments from Medicare to provide medical screening examinations (MSE) to patients seeking treatment regardless of their ability to pay, citizenship, or legal status. Among the deficiencies identified by the AHCA investigation, the hospital failed to provide Dawson an appropriate MSE when she made her complaint and discharged her without stabilizing her emergency medical condition.
Three hospital employees—two nurses and a paramedic—were also fired following Dawson’s death. The paramedic and one of the nurses have also been named as defendants in the lawsuit, along with the city of Blountstown and the arresting officer. The lawsuit alleges counts of battery, civil rights violations, and false imprisonment.
Advocate Health Care pays to settle HIPAA violations
Advocate Health Care has agreed to pay $ 5.5 million to the U.S. Department of Health and Human Services Office for Civil Rights (OCR) to settle multiple potential data protection violations of HIPAA since 2013. Advocate will also adopt a corrective action plan.
The OCR began investigating Advocate, an Illinois-based health system with more than 250 treatment
locations and 10 hospitals, three years ago after the health system submitted three breach notification reports that, combined, affected the electronic protected health information (ePHI) of about 4 million patients. The ePHI included patient names, birthdates, addresses, credit card numbers, and clinical information.
The investigation found several failures by Advocate to secure ePHI, including failure to conduct an accurate and exhaustive assessment of potential risks and vulnerabilities and implementing policies and procedures, as well as a lack of facility access controls to limit physical access to electronic information systems housed within its data support center.
Tenet Healthcare pays to settle kickback allegations
To resolve a whistleblower lawsuit that alleged it paid illegal kickbacks in exchange for maternity referrals to four of its hospitals, Tenet Healthcare has agreed to pay the U.S. government $ 514 million.
The lawsuit alleged that four hospitals—Atlanta Medical Center; North Fulton Regional Hospital in Roswell, Georgia; Spalding Regional Hospital in Griffin, Georgia; and Hilton Head Hospital in Hilton Head Island, South Carolina—paid kickbacks to Clinica de la Mama for Medicaid patient referrals in violation of the federal anti-kick-back statute. The kickbacks were disguised as payments for services provided by Clinica de la Mama, which operated medical clinics that provided prenatal care to primarily undocumented Hispanic women. In return, Clinica de la Mama would refer pregnant women to the hospitals for their deliveries. Tenet has since sold Atlanta Medical Center, North Fulton Hospital, and Spalding Regional Hospital.
As part of the settlement, two of Tenet’s subsidiaries that had operated Atlanta Medical Center and North Fulton Hospital will also plead guilty to one count of conspiracy to violate the federal anti-kickback statute and defraud the United States. Tenet will also appoint a corporate monitor for three years as a condition of the settlement.
A related lawsuit was also recently settled when Health Management Associates (HMA) and Clearview Regional Medical Center in Monroe, Georgia, agreed to pay nearly $ 600,000. The lawsuit alleged that from 2008 to 2009, Clearview—then known as Walton Regional Medical Center—also paid kickbacks to Clinica de la Mama in exchange for patient referrals.
In announcing the settlement, Derrick L. Jackson, special agent in charge from the U.S. Department of Health and Human Services’ Office of Inspector General’s Atlanta Regional Office said, “Hospitals that pay kickbacks to clinics for referrals of undocumented pregnant patients are taking advantage of both these vulnerable women and the taxpayer-funded Medicaid program … Our agency is dedicated to investigating such corrosive kickback schemes, which undermine the public’s trust in medical institutions and the financial health of government health care programs.”
Stolen laptop triggers HIPAA breach notification, investigation
The University of Mississippi Medical Center (UMMC) will pay $ 2.75 million to settle alleged HIPAA violations uncovered by an OCR investigation. UMMC will also be required to adopt a corrective action plan to help avoid future violations.
In March 2013, UMMC notified OCR of a breach after a visitor stole a password-protected laptop from its medical ICU. OCR investigation found ePHI on UMMC’s network drive could be accessed without authorization through its wireless network, exposing a directory of 67,000 files; 328 of those files contained ePHI of approximately 10,000 patients. The investigation found that UMMC was aware of its system’s vulnerabilities eight years before the breach but did not undertake any significant risk management activities. Organizational deficiencies and insufficient institutional oversight were to blame.
The OCR investigation found that UMMC failed to secure ePHI by not implementing policies and procedures that would prevent, identify, contain, or correct security violations; restrict unauthorized access to ePHI by safe-guarding workstations; and notify the individuals whose ePHI was believed to have been accessed by the breach.
Avoid HIPAA breaches from ransomware attacks
Avoid HIPAA breaches from ransomware attacks
Although ransomware is not a new phenomenon, a recent increase in reported attacks along with several well-publicized cases have raised the public’s awareness of the threat it poses. Ransomware, a variety of malware, can be incredibly damaging because it is designed to infect a system, find and encrypt the system’s data, and lock out users until they pay a ransom–typically in an anonymous electronic currency like bitcoin–to regain access through a decryption key.
According to a U.S. government interagency report, there have been approximately 4,000 ransomware attacks each day since the beginning of the year, up from the 1,000 daily attacks reported last year. Further, a recent analysis by managed security services provider Solutionary found that 88% of ransomware attacks during the second quarter of this year targeted healthcare entities.
"Hospitals rely on data systems not only for the survival of their business, but the survival of their patients. Because of this, the perceived value of the data becomes much greater, meaning the criminals can charge premium ransoms against their victims," says Travis Smith, senior security research engineer at Tripwire, a Portland, Oregon-based cybersecurity firm.
The variants of ransomware that exist can complicate a hospital or other healthcare provider’s response, says Doron S. Goldstein, partner and co-head of privacy, data, and cybersecurity practice at Katten Muchin Rosenman, LLP, in New York City. In addition to the typical form of ransomware that infiltrates systems and locks users out of their data unless they make some form of payment, some types can also exfiltrate a copy of the locked data to the hacker, or delete the data but make it seem as though it’s encrypted and still present-tricking the user into paying for data that is actually gone.
"In each scenario, you don’t know if there is intention to release the data if you pay or not. You may pay and still get nothing. Or you may get it back. There is no certainty to it. Some victims have gotten access back; others have not," says Goldstein, a former software developer and network administrator. "The general guidance from law enforcement, such as the FBI, is not to pay ransom. But if everything you have is locked out, you may not feel like you have a choice."
HHS guidance
In light of the increased prevalence of ransomware threats, the U.S. Department of Health and Human Services (HHS) recently released guidance to help covered entities understand the risks associated with these types of attacks and how complying with HIPAA can help identify, prevent, and recover from ransomware.
"The HHS is just reacting to what is happening in the marketplace. The sustained increase in the number of successful ransomware attacks is proof that the ransomware problem is going to get worse before it gets better. Issuing guidance is raising awareness of the issue at hand," Smith says.
The HHS guidance states that healthcare entities can better protect against ransomware by implementing security measures required by the HIPAA Security Rule. According to the guidance, these measures include limiting access to electronic protected health information (PHI) to personnel and software that require it; and conducting risk analyses to identify threats and vulnerabilities to PHI.
"You have to do the risk analysis. Ransomware is just another form of malware; it’s particularly insidious, but they all require doing the risk analysis," says Goldstein.
A big takeaway from the HHS guidance is the importance of taking appropriate actions beforehand to mitigate the potential of damage caused by ransomware, he adds. Unlike malware that simply transfers PHI without authorization, ransomware makes the PHI unavailable or destroys it altogether.
"For a healthcare provider in particular, having data exfiltrated means there’s damage to the patients, but likely not to their immediate health. Being locked out of your health data or your patients’ health data is a potential threat to the life and health of patients," he says.
HIPAA breaches
The guidance provides clarification on whether a ransomware infection constitutes a HIPAA breach. A breach under HIPAA is any acquisition, access, use, or disclosure of PHI in a manner that is not permitted under the HIPAA Privacy Rule and that compromises the PHI’s security or privacy.
Prior to the release of the HHS guidance, instances of data exposure that revealed individuals’ PHI would be considered a HIPAA breach, says Justin Jett, director of compliance and auditing at Plixer International, a Kennebunk, Maine-based security analytics company. However, at that point, one could have made the argument that ransomware wouldn’t technically be considered a breach since it encrypts data rather than exposing it.
Now, according to the new guidance, if a ransomware infection encrypts electronic PHI that was not encrypted prior to the incident, a breach has occurred. The guidance reasons that the PHI has been "acquired" because hackers have taken control or possession of it. In these cases, the hospital must then undertake a risk analysis and, when applicable, comply with the breach notification requirements and notify individuals affected, HHS, and the media.
However, if the hospital had previously (prior to the ransomware attack) encrypted the PHI in a manner that would render it unusable, unreadable, or undecipherable to an unauthorized individual, there is a possibility the ransomware attack wouldn’t be considered a breach.
"I interpret this guidance as removing the loophole of ransomware not actually looking at the data. Since malware changes over time, it’s within the realm of possibility that ransomware will target [PHI] and exfiltrate the data once found. The new guidance states that if the ransomware is unable to actually see the protected healthcare information in cleartext (not encrypted), then it is not a reportable breach," Smith says.
Even in these cases, the guidance says additional analysis would be required to determine if the PHI was sufficiently encrypted prior to the attack. Goldstein says this emphasizes the need for a risk analysis whenever there is a security incident. He further noted that HHS may have included this guidance so covered entities could not view the ransomware’s own encryption of the data as protection against that data being compromised.
"In those cases, the data is technically encrypted by virtue of the ransomware, but it’s not encrypted by the covered entity; it’s encrypted by someone else who controls that encryption. It shouldn’t be viewed as encryption for the purposes of your risk analysis," Goldstein says."
Prevention and recovery
To better prevent ransomware, Jett says all staff should be appropriately trained on email and web security as most malware and ransomware comes from those sources. Additionally, companies should invest in heightened email security solutions, like anti-spam firewalls, which will help prevent the most obvious attacks from getting to employees’ inboxes.
The HHS guidance suggests that since HIPAA requires the workforces of covered entities to receive security training on detecting and reporting malware, employees can assist with early detection of ransomware by spotting indicators of an attack. These warning signs could include unusually high activity in a computer’s CPU as the ransomware encrypts and removes files, or an inability to access files that have been encrypted, deleted, or relocated.
Even if hospitals are vigilant, ransomware attacks may still occur. Again, the guidance suggests that HIPAA compliance may help hospitals recover from ransomware attacks due to HIPAA’s mandate for frequent backups of data.
Goldstein warns, however, that some variants of ransomware can lie dormant for a period of time in order to migrate across systems, including into data backups. Many hospitals and companies keep hot backups as part of their disaster recovery plan. These backups can be automatically or manually switched on if a system goes down. If ransomware has infiltrated a backup, the backup’s data could also become compromised and encrypted by the ransomware as soon as it’s activated.
"The important thing about dealing with the impact of ransomware is that it may require additional or different protections compared to what other malware requires to avoid or mitigate its ill effects," he says.
Recent ransomware attacks
All types of malicious software attacks are on the rise,but ransomware has recently received more high-profile media coverage, says Doron S. Goldstein, partner and co-head of privacy, data, and cybersecurity practice at Katten Muchin Rosenman, LLP, in New York City. "Ransomware has certainly gotten more coverage lately because of the potential damage, and the sophistication of some of these attacks has increased," he says.
The following are a few of the recent ransomware attacks that made headlines:
Hollywood Presbyterian Medical Center: In February, this Los Angeles hospital paid hackers the equivalent of $ 17,000 in bitcoins to regain access to its computer system, according to the Los Angeles Times. The malware prevented hospital staff from accessing their system for 10 days by encrypting its files; once the hospital paid the ransom, it was given a decryption key to unlock the files. In a statement, CEO Allen Stefanek said paying the ransom was the quickest way to restore the hospital’s systems.
Chino Valley Medical Center and Desert Valley Hospital: In March, hackers targeted these southern California hospitals by infiltrating their computer systems with ransomware. A spokesman for the two hospitals, which are part of Prime Healthcare Services, Inc., said technology specialists were able to limit the attacks so both hospitals remained operational, no data was compromised, and no ransom was paid.
MedStar Health: Also in March, this Columbia, Maryland-based system was targeted with ransomware that encrypted the system’s data. According to the Baltimore Sun, the hackers demanded that MedStar pay three bitcoins, worth approximately $ 1,250, to unlock a single computer, or 45 bitcoins, the equivalent of about $ 18,500, to unlock all of its computers. MedStar refused to pay the ransom, and staff at its 10 hospitals and more than 250 outpatient centers resorted to using paper records while system access was restored.
Kansas Heart Hospital: In May, hackers infected the network system of this Wichita hospital with ransomware. According to local CBS affiliate KWCH12, the hospital paid an undisclosed portion of the ransom demanded but the hackers refused to return full access and demanded a second payment. The hospital announced that it had refused to make the second payment and would work with its IT team and external security experts to restore access to the rest of the system.
Mini-poll: Which option best describes the type of facility for which you primarily code?
Which option best describes the type of facility for which you primarily code?
- Large hospital or healthcare system (more than 300 beds)
- Medium-sized hospital or clinic (100-300 beds)
- Small hospital or clinic (fewer than 100 beds)
- Critical access hospital (fewer than 25 beds)
- Provider-based clinic
- Physician’s office
Last week’s mini-poll
Does your hospital have an inpatient or outpatient clinical documentation improvement (CDI) program?
- Yes, we have a CDI program that reviews inpatient records: 66%
- Yes, we have a CDI program that reviews inpatient and outpatient records: 10%
- Not applicable, I work in a physician office setting: 12%
- No, we do not have a CDI program: 13%
Thank you to the readers who participated in last week’s mini-poll!
Briefings on HIPAA, November 2016
HIPAA enforcement
Small breaches could become a big problem
In a year of high-profile, multimillion dollar settlements for large HIPAA breaches, OCR raised the stakes in a big way?by taking a harder line on small breaches. OCR announced plans to crack down on smaller breaches?those affecting fewer than 500 individuals?in August. Although all breaches must be reported to OCR, generally only breaches affecting 500 or more individuals are regularly investigated, while small breaches are investigated only as resources permit. OCR instructed its regional offices to increase investigations of small breaches to discover the root causes. Identifying common root causes will help the agency better measure HIPAA compliance throughout the industry and address industrywide compliance gaps, OCR said. Regional offices may obtain corrective action if an investigation of a smaller breach reveals noncompliance.
Regional offices were instructed to take several factors into consideration when investigating smaller breaches and determining potential corrective action. These are:
- The size of the breach
- Whether a single entity reports multiple small breaches with a similar root cause
- Whether the breach involves theft or improper disposal of PHI or hacking
A closer look
OCR has come under fire for its handling of small breaches. In late 2015, a joint Pro Publica/NPR investigation analyzed federal data on HIPAA complaints and requested documents from OCR, including letters sent to entities that were the subject of HIPAA complaints (www.propublica.org/article/few-consequences-for-health-privacy-law-repeat-offenders). The investigation identified the top serial HIPAA violators, including the Department of Veterans Affairs and CVS. OCR generally responded to these complaints by sending letters reminding the entity of its obligation to protect patient privacy and follow HIPAA, and warned that if OCR received another complaint it may take more serious action. However, OCR rarely took any further or more serious action.
One reason could be that many of these breaches affect fewer than 500 individuals. Both large and small breaches must be reported through OCR’s web portal (www.hhs.gov/hipaa/for-professionals/breach-notification/breach-reporting/index.html) but there are different deadlines for reporting each and, previously, they were not equally prioritized by OCR.
But that asymmetric enforcement policy left many frustrated and means that OCR may be missing data vital to creating an overall picture of HIPAA compliance and effectiveness. An NPR report released in conjunction with Pro Publica’s investigation revealed the lasting and personal harm done by small breaches (www.npr.org/sections/health-shots/2015/12/10/459091273/small-violations-of-medical-privacy-can-hurt-patients-and-corrode-trust).
Massive breaches caused by hackers will put patients at risk for medical and financial identity theft, but, considering the amount of personal data stored by entities across all industries and the sheer number of data breaches, it’s difficult to tie a specific breach to identity theft (see the July and August issues of BOH for more information on breaches and medical identity theft). Small breaches, however, often expose PHI to people in the community the patient lives and works in, leaving the patient at risk for far more personal harm.
But OCR hasn’t ignored all small breaches. In July, the agency reached a $ 650,000 HIPAA settlement with Catholic Health Care Services of the Archdiocese of Philadelphia (CHCS), a business associate (BA), for a 2014 breach affecting 412 individuals after an unencrypted mobile device was stolen (www.medicarecompliancewatch.com/news-analysis/business-associate-agrees-650000-hipaa-fine).
The agency’s strong action may have been spurred by CHCS’ long-standing organizationwide HIPAA noncompliance. CHCS hadn’t conducted a risk analysis since September 23, 2013, the compliance date of the Security Rule for BAs, and therefore had no risk management plan. CHCS also lacked any policies regarding the removal of mobile devices from its facility. OCR suggested that, due to CHCS’ widespread neglect of basic security measures, the fine could have been even higher and only a consideration of the role CHCS plays in delivering care to at-risk populations, including the elderly, disabled individuals, and individuals living with HIV/AIDS, tempered its decision.
Getting perspective
Implementing OCR’s directive may be a tall order for resource-strapped regional offices and it’s difficult to predict what the outcome will be, Kate Borten, CISSP, CISM, HCISSP, founder of The Marblehead Group in Marblehead, Massachusetts, says.
"I’m not sure it’s actually going to make a huge difference, but I think, from the beginning, those of us who were watching HIPAA enforcement were concerned that, while HHS had good intentions, they just didn’t have the resources," she says.
That’s not surprising: HHS is a huge department with many major priorities, including CMS. But, given that HHS and OCR work with limited resources, the new focus on small breaches could be a significant sign of things to come, Borten says. The agency likely recognizes that small breaches are a huge unknown: There’s no "Wall of Shame" for small breaches and little in the way of accountable reporting.
"I just have the sense that there’s an enormous volume of under 500 breaches that get reported that we don’t hear much about," she says. "So I think it’s very important that they take this step."
Some organizations may have been inclined to brush off small breaches: 499 patients is still shy of the 500 mark, she points out, and an organization could easily add it to the end of the year small breach report and forget about it. Those organizations are the ones that will be in for the biggest wake-up call. "Hopefully they’ll hear this and they’ll think again," she says.
Large breaches often grab the headlines, and with good reason. But massive incidents like the Anthem breach may not provide the most useful data for either OCR or other covered entities (CE) and BAs. Massive breaches are statistically unlikely, according to a June 2015 report by researchers at the University of New Mexico and the Lawrence Berkeley National Laboratory (www.econinfosec.org/archive/weis2015/papers/WEIS_2015_edwards.pdf).
"Certainly, you could get hit by one of those big ones," Borten says. "But it’s much more likely, far more likely, you’re going to suffer smaller breaches."
Big breaches come with the risk of big settlements. OCR makes a point of publicizing HIPAA breach settlements and putting the dollar signs front and center. This year alone the agency has levied millions of dollars in HIPAA settlements fines for large breaches. But even as HIPAA breach settlement fines are getting bigger, the numbers don’t stack up against the amount of breaches that are reported each year. Many more organizations get away with little more than a strongly worded letter from OCR. A multimillion dollar fine may be significant for most organizations, but the odds are currently in their favor, Rick Kam, CIPP/US, president and co-founder of ID Experts, says.
"The likelihood that an organization will get fined is so low," he says. "They only catch the big ones, but there are millions of others that are losing data everywhere because nobody’s looking at them."
Too often, organizations assume that if the volume of patients affected by a breach is low, the impact is also low, Borten says, and that’s simply not true. Even a breach involving a single individual’s record can have serious consequences.
As physician practices and local hospitals are absorbed into large corporate health systems, executive perspective on small breaches can become even more skewed, Borten cautions. Executive officers overseeing multiple hospitals, clinics, and physician practices may be more interested in overall numbers and the big picture. A clinical summary handed to the wrong patient at a physician office across the state may simply not register and the impact on the patient will be invisible.
But it’s the duty of privacy and security officers to avoid making that same mistake, she says. "They should be wiser than to fall into that thinking. It falls to them to take a case to the senior leadership or the board of directors and make them recognize that it isn’t just the big breaches," she says. "We worry about the little ones, too."
Privacy and security officers should help provide C-suite the perspective to recognize small breaches and give them the proper weight. A small breach can be just as serious as a large one, Borten says. If an employee posts a patient’s PHI on a social media site, for example, the organization could find itself fighting a lawsuit; even if the case is dismissed, direct legal expenses and time and resources spent preparing documents add up fast. And, as the NPR report showed, it’s not only the patient’s reputation in the community that may suffer; an organization can easily earn a reputation as careless and unconcerned with its patients’ well-being after a small breach.
Small breaches, little data
Because small breaches aren’t investigated to the same standards as large breaches, it’s difficult to measure just how HIPAA-compliant most organizations are and what the real HIPAA pain points are. Another problem is the underreporting of small breaches, Borten says. In 2013 when the HIPAA omnibus rule was released, HHS strengthened the language describing what constitutes a reportable breach. However, HHS also commented at the time that it was concerned there was a significant amount of underreporting. Borten says her experience working with CEs and BAs proves HHS was right to be concerned.
"I think there’s a tendency for underreporting to be more common when there are just one or two patients involved," she says.
In the early days of HIPAA breach notification, some may have been under the impression that CEs and BAs were not required to report breaches affecting fewer than 500 individuals at all, she adds. But that’s never been the case. Although large and small breaches are reported to OCR according to different systems and time frames, organizations are required to treat any breach the same regarding notification to patients.
Adding up
Small breaches are likely more typical than large ones, Kam says. Since 2009, roughly 230,000 breaches have been reported to OCR. But only approximately 1,000 have been breaches affecting over 500 individuals and subject to the more stringent investigation procedure. Investigating all HIPAA breaches would be a daunting task for any agency, but by almost exclusively looking at large breaches, OCR left the door open for repeat HIPAA offenders. Small breaches are reported to the agency at the end of the year, but each breach is counted separately, meaning an organization could experience multiple small breaches that add up to well over 500 individuals affected?yet still not be investigated because no single breach hit the 500 mark.
"It turns out that for breaches in healthcare, most of the time, the record count is under 500 records," Kam says. "So you have these organizations that are breaching multiple times and not really correcting the situation because it doesn’t get highlighted or investigated."
OCR’s instructions to its regional offices appear aimed to close that loophole. Along with phase two of the HIPAA audit program, this could be a sign that OCR is getting serious about collecting facts on HIPAA compliance in the real world and improving education and enforcement. The agency might be realizing that it’s time to change if it expects organizations to take HIPAA compliance seriously.
"If you’re seeing the same problem over and over, you’ve got to do something to change," Kam says. "So far, nobody’s listening."
Data breaches
The cost of a data breach
Complicated Medicare, Medicaid, and private insurer reimbursement rules can easily throw a hospital for a loop and leave it running dangerously low on revenue. An organization’s leaders know they must work better and smarter and make strategic investments that will pay off in savings, while privacy and security officers may sometimes struggle to make the connection between their concerns and those of leadership.
But sound information security programs act as a kind of insurance: money spent up front to protect against an even greater financial loss down the road. Getting that message across can be challenging, but may transform the way an organization approaches information security.
Getting the numbers
Prevention is better than a cure, but privacy and security officers will be expected to back up conventional wisdom with hard numbers. So just how much does a data breach cost on average? The answer depends on the industry, according to the Ponemon Institute’s 2016 Cost of Data Breach Study: Global Analysis (www-03.ibm.com/security/data-breach). The study, sponsored by IBM Security, tracks and analyzes data breach costs and mitigation factors in industries around the world. The average per record cost of a data breach is $ 158 in the U.S., but in the healthcare industry that cost is more than double that at $ 355 per record. That can add up quickly if an organization experiences multiple breaches a year.
Several factors play into the higher costs seen in the healthcare industry, Diana Kelley, executive security advisor at IBM Security, says. Highly regulated industries such as healthcare typically see higher costs for breaches in a combination of fines and administrative costs.
"Whenever there’s a fine coming into play, that could lift up the total cost of recovery post-breach because in addition to all of the work you have to do to eradicate the threat, help your customers, and deal with the cleanup and recovery, you have to pay these fines," she says.
A surprising factor driving breach costs is the cost of breach notification. At more than half a million dollars, the U.S. has higher breach notification costs than any of the other countries in the 2016 Ponemon survey. The U.S. has strong data breach notification laws, Kelley says, and there are both federal and state breach notification laws that organizations must comply with.
What drives that cost? Simply the price of first class postage can quickly add up when breach notification letters must be mailed to hundreds or even thousands of affected patients, Kate Borten, CISSP, CISM, HCISSP, founder of The Marblehead Group in Marblehead, Massachusetts, says. In fact, the rising cost of postage is one way state and federal governments hope to encourage organizations to spend money on prevention rather than remediation.
"The threat of such costs is intended to be a deterrent to lax security and to spur healthcare organizations to do their best to avoid breaches," Borten says. "Some breaches are not avoidable, but many or most are with better, yet still reasonable, security."
Some organizations may only look at fines when calculating how much a breach could cost, but by overlooking the seemingly smaller costs of a breach they may be missing the bigger picture. Breach notification is only one of the smaller individual and indirect costs of a breach that can add up to significant losses. Legal fees, security forensics, and any necessary security replacements or upgrades are only some of the indirect costs. Indirect costs may not be immediately apparent but they hit an organization’s bottom line all the same, Borten says.
"The indirect costs of a breach are probably not well understood by many healthcare organizations, especially smaller organizations that don’t have a good grasp of the Breach Notification Rule and a comprehensive incident response program," she says.
The value of a medical record
Information security may not be a traditionally strong point for some healthcare organizations. Previously, financial and retail organizations were hot targets for hackers after identity and financial information, but healthcare is quickly overtaking those industries. In comparison to the financial industry, healthcare isn’t known for strong security, Borten says.
"One reason is that organizations have been slow to recognize the value of their data. After all, it’s not like money in a bank account or credit card details that can be used for financial identity theft," she says. "Ironically, healthcare data now has a much higher street value than credit card information."
Healthcare organizations are in a unique position because of the amount of data they hold. A retail organization like Target, which experienced a massive data breach in 2013, likely only stores payment card information and mailing addresses, but most healthcare organizations also store insurance information along with sensitive details of an individual’s health. A 2015 survey by the Ponemon Institute and the Medical Identity Fraud Alliance (MIFA), the Fifth Annual Study on Medical Identity Theft, found that more than two million adults were the victim of medical identity theft and fraud in 2014 and according to Ann Patterson, senior vice president and program director of MIFA, that number will only go up.
That prediction may be supported by some of the biggest breaches this year. In July, a hacker offered millions of patient records for sale and posted samples of the records, showing names, contact information, and Social Security numbers, so interested buyers could verify the records. Other incidents this year have seen hackers offering similar teasers. Some of that data is bound to fall into the wrong hands and be used for financial and medical identity theft. Medical identity theft can cost an individual more than $ 13,000 on average, according to the 2015 MIFA/Ponemon survey, but healthcare organizations inevitably wind up absorbing some of the cost in bad debt. (For more on medical identity theft, see the July and August issues of BOH.)
Timing and teamwork saves money
The 2016 Ponemon study drew a link between the cost of a data breach and the time and manner in which an organization responds to the breach. The longer it takes an organization to detect a breach, the more it costs?approximately $ 1 million more per incident, the survey shows. The average overall cost of a breach that took a mean time to identify of less than 100 days was $ 3.2 million, while those that took more than 100 days to be identified cost an average of $ 4.38 million. The time it takes an organization to contain a breach also impacts the overall cost, according to the study.
Having a security incident response team in place lowered the costs. An organized, planned team can act quickly to identify, contain, and remediate breaches, key factors in keeping breach costs down, Kelley says. And that can give a clear picture of the actual return on investment for security in terms that the C-suite will easily understand. "If you’re trying to argue for incident response and building out the incident response plan or growing that team, here’s some real dollar value that you could tie to what the return on investment could be," she says.
Participation in threat sharing also showed a clear win for organizations. Threat sharing can give organizations a heads up on the latest and most common threats and help them make smart security investments and strategic threat reduction measures.
"This is becoming very important in healthcare as it is in all industries," Kelley says. "The attackers are very organized and collaborative: they’re sharing data, they’re sharing their tips and tricks with each other so they can get data more effectively."
If information sharing is winning for the bad guys, it can do the same for the good guys, she adds. Cyber threats shift quickly, making real-time or near-real-time information crucial. Organizations can share information on threats, like suspicious websites and server addresses that launch phishing attacks, and tips on shutting them down. But some may hesitate to engage in information sharing out of concern that it may expose sensitive business and security information.
An IBM study released in February looked at the C-suite’s attitudes and actions on cybersecurity (www-03.ibm.com/press/us/en/pressrelease/49100.wss). More than half (53%) of respondents agreed that information sharing between organizations is important for cybersecurity, yet 68% said they were unwilling to do so. It’s not surprising that chief executive officers would be uncomfortable sharing information with rival organizations but it can be done without disclosing sensitive data, Kelley says.
"Nobody wants to give away the keys to the kingdom, and if you’ve been breached you don’t want to show everybody where you went wrong and how you went wrong," she says. "That’s not the kind of information sharing that we need to do to succeed. What we really need to share is what the bad guys are doing."
An organization doesn’t need to discuss its intellectual property, specific security controls, or other corporate secrets. The information an organization should share could be the general content of a phishing email, the IP address it was sent from, and the type of malware attached. This allows cybersecurity researchers and experts to create protections and update anti-malware and anti-virus software.
And as stakeholders and the Office of the National Coordinator of Health IT continue to push for interoperability, doing your part to ensure other organizations steer clear of hackers and malware could become even more important. "I think the more we tie systems together and we share with our partners, there are a couple things we can do. One of those is sharing information about threats," Kelley says.
Customer cost
No one likes to hear that their personal data has been breached, but how that dissatisfaction plays into the cost of a breach isn’t clear. According to the 2016 Ponemon study, the healthcare industry is the second most vulnerable to what it calls "churn"?a sharp drop in customers following a data breach. This may surprise those who assume healthcare is relatively immune to consumer pressure, but it’s supported by other trends that see healthcare becoming consumer-driven. It might also offer a clue as to how strongly some patients feel about breaches of PHI. It’s relatively simple to change banks, but changing healthcare insurers or providers is a more complicated process that takes more motivation, Kelley says.
"What’s it cost you to go from one bank to another bank if you don’t like their practices or they suffered a major breach?" she says. "Healthcare, it’s a little bit more difficult, but there’s still a level of choice and healthcare is very personal for people."
But privacy and security officers might want to rely on something other than consumer pressure to make the case for better security, Borten says. Often, patients simply have no better alternative and can’t switch providers or insurers if they’re unhappy over a data breach. And those who do switch may find themselves back in the same system after a few years.
"The reality is more complicated," she says. "As seen in some of the big retail breaches, after some initial falloff, customers come back in full force. In healthcare, some patients may not have other options: they may be locked in to a given provider by their health plan, or they may stay with an organization after a breach because they have long-established relationships they do not want to give up."
Cost conscious
Another recent study on the cost of data breaches by RAND raises questions about how the cost of a breach measures up against other financial risks organizations face. The RAND study, published in the Journal of Cybersecurity (http://cybersecurity.oxfordjournals.org/content/early/2016/08/08/cybsec.tyw001), found that the average cost of a data breach is roughly equal to an organization’s average IT budget, which is itself only 0.04% of an organization’s estimated revenue. The study authors suggest that public concerns about data breaches don’t match up with the relatively modest financial impact on organizations. Organizations, like individuals, are often motivated by self-interest and will not spend on risks that don’t have a significant impact on them; expecting them to act otherwise is not realistic, the study argues.
While that may in fact be the attitude of some executives when faced with competing demands and costs, the study leaves some significant questions unanswered. Bad debt is identified by the RAND study as the top financial risk for healthcare organizations, but data breaches can add to that cost. Victims of medical identity theft may be hit with thousands of dollars in medical expenses someone else racked up under their name. These fraudulent bills often wind up adding to an organization’s bad debt. Bad debt may often be a problem an organization can’t control, but by reducing data breaches, an organization can cut its risk of bad debt caused by medical identity theft.
Briefings on Coding Compliance Strategies, October 2016
Ready CDI teams for CMS’ proposed expansion of mandatory ortho episode payment models
by Shannon Newell, RHIA, CCS, AHIMA-approved ICD-10-CM/PCS trainer
If your hospital resides in one of the 67 metropolitan statistical areas (MSA) required to participate in the Comprehensive Joint Replacement Model (CJR), you will also be required to participate in a new orthopedic payment model called SHFFT (surgical hip and femur fracture treatment) if an August 2 proposed rule is finalized. The impact? The following assigned MS-DRGs will no longer define hospital reimbursement:
- Major Joint Replacement or Reattachment of Lower Extremity (MS-DRGs 469, 470)
- Hip and Femur Procedures Except Major Joint (MS-DRGs 480, 481, 482)
MS-DRGs 469 and 470 are included in the CJR, which we have discussed in prior articles. Let’s take a look at the proposed SHFFT episode payment model (EPM), which involves the other three MS-DRGs, and see what role the CDI program can play as reimbursement shifts to episode-based payments.
Model overview
The episode of care defined for the SHFFT EPM begins with an admission to a participating hospital of a fee-for-service Medicare patient assigned MS-DRGs 480?482. This admission is referred to as the anchor hospitalization. The episode continues 90 days post-discharge from the hospital, and payments for all related Part A and Part B services are included in the episode payment bundle. CMS holds the hospital accountable for defined cost and quality outcomes during the episode and links reimbursement?which may consist of payment penalties and/or financial incentives?to outcome performance.
This is a mandatory EPM for hospitals already impacted by the CJR; the SHFFT model will apply to the same 67 geographic MSAs. The EPM is proposed to begin July 1, 2017, and will last for five years, ending in December 2021.
Cost outcomes
CMS will initially pay the hospital and all providers who bill for services during the episode using the usual fee-for-service models. Thus, the SHFFT EPM will not impact the revenue cycle at first. However, at the end of each performance period, which typically represents 12 months (January through December), CMS will compare or reconcile the actual costs with a preestablished "target price."
CMS will set target prices using an approach that will phase in a blended rate of hospital to regional costs. In recognition of the higher costs associated with discharges in MS-DRGs with an MCC or CC, CMS has developed an algorithm to adjust the target price for this subset of the patient population.
If the reconciliation process indicates that the costs to deliver services for the episode were higher than the target price, CMS will require repayment from the hospital. If, however, the costs to deliver care for the episode were lower than the target price, CMS will provide additional payments to the hospital for the provided services. To receive additional payments, however, performance for defined quality outcomes must meet or exceed established standards.
Quality-adjusted target price
To receive any earned financial incentives, the hospital must meet or exceed performance standards for established quality outcomes. CMS therefore adjusts the target price based on quality performance, referred to as the quality-adjusted target price.
The SHFFT EPM uses the exact same quality outcomes as those defined for the CJR:
- Patient experience. This is the HCAHPS measure also used in the Hospital Value-Based Purchasing Program (HVBP). The source of information for this measures is the HCAHPS survey.
- Patient-reported outcome data. As with the CJR, the hospital can collect and submit patient-reported data elements and at present will earn quality composite points for submitting the data. These data elements are collected both before and after the procedure and will be used by CMS to create a functional status measurement tool.
- THA/TKA complication rates. This is the Hospital-Level Risk Standardized Complication Rate (RSCR) following the THA/TKA measure. This measure already impacts financial performance under the HVBP. Like the CJR, performance for this measure is weighted the heaviest in the quality composite comprising 50% of the composite score.
Hospital (accountable party), collaborators, and Advanced Payment Models
The hospital is held accountable for episode cost and quality outcomes and all associated financial risks/rewards, even though a variety of providers deliver services and impact performance. As with the CJR, the hospital has been designated as the accountable party because CMS believes the hospital is best positioned to influence coordinated, efficient delivery of services from the patient’s initial hospitalization through recovery.
CMS permits the hospital to enter into collaborative arrangements with physicians and other providers to support and redesign care delivery across the episode and to share financial gains and/or losses. The proposed rule expands the list of collaborators defined in the previous CJR final rule to include other hospitals and Medicare Shared Savings Program accountable care organizations.
The proposed rule also provides an Advanced Payment Model (APM) track for the EPMs, an important step that will further incentivize collaborator participation.
CDI program opportunities
There are five key ways that clinical documentation and reported codes across the continuum impact SHFFT performance:
- Identification of patients included in the EPM. The assigned MS-DRG impacts which discharges are included in the cohort. As one example, consider a patient who would fall into the EPM (MS-DRGs 480?482) unless he or she has a bone biopsy. If reported, the bone biopsy would result in assignment of different MS-DRGs (477?479) and the discharge would not be included in the EPM.
- Establishment of target costs. The capture of the MCC and/or CC impacts establishment of the episode target price.
- Determination of related costs. The costs for hospital readmissions within the episode are included in episode costs if the readmissions are related. The assigned MS-DRG for the readmission determines whether the readmission is related.
The costs associated with Part B claims are included in episode costs if the services are related. The primary diagnosis for each visit determines whether the visit is related.
- Reported complications. Assignment of ICD codes for the following conditions are counted as complications when those conditions result in inpatient readmission:
- Complication risk adjustment. As with other hospital-centric measures such as risk-adjusted readmission and mortality rates, comorbidities reported for the 12 months prior to the anchor hospitalization are used to assess case-mix complexity. The CMS risk adjustment module uses defined comorbidity categories to identify conditions that impacted predicted rates of complications for the THA/TKA cohort.
The capture of at least one condition for each of the 28 comorbid categories over the 12-month period will strengthen risk adjustment and RSCR performance. RSCR performance contributes to 50% of the quality composite score, which, in turn, impacts the quality-adjusted target price.
Summary
Together the CJR and SHFFT models cover all surgical treatment options (hip arthroplasty and fixation) for Medicare beneficiaries with hip fractures. These MS-DRGs typically represent one of the largest inpatient surgical volumes for most short-term acute care hospitals.
As hospitals and collaborators assess and refine the management of patients to achieve or exceed the quality-adjusted target price, the data we submit on claims will be used to assess our performance. The CDI program in the inpatient and ambulatory setting must be positioned to promote and support the capture and reporting of impactful documentation.
Additional information on the proposed rule can be located at https://innovation.cms.gov/initiatives/epm.
Editor’s note
Newell is the director of CDI quality initiatives for Enjoin. Her team provides CDI programs with education, infrastructure design, and audits to successfully and sustainably address the transition to value-based payments. She has extensive operational and consulting expertise in coding and clinical documentation improvement, case management, and health information management. You can reach Newell at 704-931-8537 or [email protected].
Computer-assisted coding: Where are we today?
by Lori-Lynne A. Webb, CPC, CCS-P, CCP, CHDA, COBGC, CDIP
In our computer-savvy tech world, the medical field has been notoriously slow to respond to newer technologies and applications of computer-assisted enhancements. However, in the HIM market, computer-assisted coding (CAC) has been touted to boost coding accuracy and productivity, in addition to being an important tool for the remote inpatient coder.
Background
The term CAC denotes technology that automatically assigns codes from clinical documentation for a human to review, analyze, and use, according to the Journal of AHIMA.
Currently, there are a variety of methodologies, software, and integration interface applications that enable a CAC application to read text and assign codes. This type of software reads the information in a similar way to how a spell-check application works on a traditional computer. According to some users, data-driven documentation (e.g., documentation that is dictated or typed) is more accurately processed by the CAC software than documents that are scanned into the system for the software to use.
CAC software works through recognition; it learns words and phrases, as well as learning the areas within a specific document where standardized words and phrases appear. CAC software also has the ability to discern the context or meaning of those words and phrases. The program then analyzes and predicts what the appropriate ICD-10-CM/PCS codes should be for the documented diagnoses and procedures it finds within the specified documents.
Software providing CAC functionality has been available for over 10 years, but it has come to the forefront of inpatient coding with the implementation of ICD-10-CM/PCS. CAC has allowed hospitals to reduce lag times and enhance DRGs while also finding missed MCC/CC diagnoses. The usage and integration of an electronic health record (EHR) has also played a role in better code assignment and usage for data analysis and outcomes.
It is yet to be shown whether CAC actually enhances a coder’s productivity rate. On the upside, CAC does give the coder a great place to start when working on a difficult inpatient record. CAC is now where we were more than 20 years ago when encoders were first introduced into the inpatient hospital marketplace for coding, abstracting, and data analysis.
Pros and cons of CAC
Due to the complexity of inpatient care records, clinical documentation, and the complexity of medical terms and abbreviations, many hospitals only use CAC together with intervention by human coders. However, the latest CAC software technology employs a type of natural language and syntax processing to compare, contrast, and extract specific medical terms from electronic data or typed text?so CAC stand-alone technology does exist. In studies conducted by AHIMA, though, the combination of a CAC with a coder/auditor has been proven to be just as good, or better than, a coder or CAC alone.
The biggest challenge CAC poses might be getting buy-in from the hospital coding and HIM staff. The HIM, coding, and clinical staff must all be a part of the changes and be on board with learning how to use this technology enhancement. In the past, there has been some uncertainty and fear related to CAC eliminating coders’ jobs. However, a good CAC solution in conjunction with HIM management allows coders to apply their critical thinking and analytical skills to create well-coded documentation of patients’ care. This, in turn, results in more accurate DRG assignment and reimbursement for the facility.
HIM and coding staff’s responsibility and role in the fiscal revenue stream will change as a result of CAC and similar technology. With this change must comes the acceptance that it takes both a human and a computer to successfully transform a CAC product into good financial outcomes and even better documentation.
As coders will surely agree, the final code selection for inpatient records should be based upon coders’ knowledge of coding guidelines, clinical concepts, and compliance regulations. When working with CAC, the coder has the ability to agree with or to override codes that the software determines.
Coders have the education to understand why a diagnosis or procedure should or should not be coded in a specific situation, and by using CAC, they can help the software learn to identify the importance of specific documentation and its relation to ICD-10-CM/PCS codes.
Many CAC vendors will try and sell their product based on the following list of features and benefits:
- Better medical coding accuracy
- Faster medical billing
- Greater coder satisfaction
- Identification of clinical documentation gaps
- Increased coder productivity
- More revenue from more detailed bills
- Return on investment?the CAC system quickly pays for itself
As we’ve said, it hasn’t been shown that CAC actually increases coders’ productivity. In reality, their productivity will probably stay the same, as a coder will still have to audit the information to determine whether the code generated by the software is correct. But in regard to the other CAC benefits on the above list, coder satisfaction should not be overlooked.
During AHIMA’s pilot testing of CAC software, the organization weighed in on some of the potential issues with using CAC software alone (with no human intervention). AHIMA noted that within specific areas of the pilot CAC testing in ICD-10, the coders did not accept 75% of the diagnosis codes presented, and they did not accept 90% of the procedure codes presented within the code sets. However, the information that the CAC software presented did give the coders a good starting reference to drill down to a more comprehensive diagnosis or procedure code.
Coders and CDI personnel will still need to be in charge of the following:
- Ensuring clinical documentation is complete and querying when appropriate
- Ensuring complete coding (e.g., for specificity)
- Ensuring correct sequencing of diagnosis and procedures
- Reviewing CCs/MCCs and DRG assignments with case complexity and severity
CAC, clinical documentation, EHR, and providers
Integration of clinical documentation from providers and physicians has always been a challenge, and combined with the implementation of ICD-10, it has presented a huge impetus for the adoption of CAC technology in hospital- and facility-based organizations.
Unfortunately, physicians still don’t provide thorough documentation, instead relying on CDI and coding staff to guide them. There has always been a disconnect in the language spoken by providers and the language spoken by coders. Physicians document in their comfort zone and fall back on terms such as "pneumonia," whereas a coder is looking for much more specificity. The integration of an EHR-based program and CAC for providers can lead to a good team relationship for both parties.Many CAC programs integrate well with hospital-based CDI programs and EHRs. These combination interfaces allow more real-time processing of possible code selection prior to the coder’s audit and review of the final code selection.
When the CAC software identifies these possibilities, there is an opportunity to identify and improve the DRGs with MCCs and CCs, as well as more quickly address areas for query and missed procedures or diagnoses.
Wrapping it all up
It is evident that coders and HIM professionals need to make a commitment to embrace change, which includes new technologies and integration of learning processes and opportunities. A hospital’s success depends on the coder acting as part of a team that will strive for successful outcomes for both the patient and the hospital.
Editor’s note
Webb is an E/M and procedure-based coding, compliance, data charge entry, and HIPAA privacy specialist with more than 20 years of experience. Her coding specialty is OB/GYN office/hospitalist services, maternal fetal medicine, OB/GYN oncology, urology, and general surgical coding. She can be reached via email at [email protected], and you can find current coding information on her blog at http://lori-lynnescodingcoachblog.blogspot.com. This article originally appeared on JustCoding, and opinions expressed are those of the author and do not represent HCPro or ACDIS.
Key attributes for coders moving forward amidst the 2017 coding guideline changes
by Laura Legg, RHIT, CCS, CDIP, AHIMA-approved ICD-10-CM/PCS trainer
Resiliency is the ability to spring back or rebound. In sports, it’s one of the mental attributes a player must have. Coders are resilient: bouncing back from one change after another, deciding to code smarter and faster, and having the patience to do whatever is expected?even amid closing grace periods and guideline controversies.
The change to ICD-10 in October 2015, was a solid transition, and no one in healthcare was affected by it more than coders. The changes didn’t stop there. The coming months will again prove to be challenging for coders because of the new ICD-10 codes for both CM and PCS beginning October 1, 2016. Along with that, we’ll see the end of the CMS grace period on code specificity for Part B, and updated ICD-10-CM Official Coding Guidelines. Coders have a lot to learn this fall.
The Centers for Disease Control and Prevention published guidelines for discharges effective October 1, 2016, that have been approved by the four organizations that make up the Cooperating Parties for ICD-10-CM: the American Hospital Association, the American Health Information Management Association, CMS, and the National Center for Health Statistics.
The guidelines are available at www.cdc.gov/nchs/data/icd/10cmguidelines_2017_final.pdf. In the linked document, the changes are indicated in bold type for easy identification. Below are some of the highlighted changes.
Excludes1
This guideline supports the interim advice published last fall. Here, the Cooperating Parties have given instructions that two conditions unrelated to each other represents an exception to the Excludes1 definition. If it is not clear whether the two conditions are related, coders must query the provider.
With
Under Section I.B.7 of the guidelines, "multiple coding for a single condition" clarification has been added for interpretation of the word "with."
The word "with" should be interpreted to mean "associated with" or "due to" when it appears in a code title, the Alphabetic Index, or an instructional note in the Tabular List. The classification presumes a causal relationship between the two conditions linked by these terms.
These conditions should be coded as related even in the absence of provider documentation explicitly linking them, unless the documentation clearly states the conditions are unrelated. For conditions not specifically linked by this term in the classification, provider documentation must link the conditions in order to code them as related.
Code assignment and clinical criteria
Also under Section I, the Official Guidelines for Coding and Reporting tell us that the assignment of a diagnosis code is based on the provider’s diagnostic statement that the condition exists. The provider’s statement that the patient has a particular condition is sufficient. Code assignment is not based on clinical criteria used by the provider to establish the diagnosis.
Coders are instructed to assign a diagnosis or procedure code according to physician documentation. Coders have been told in the past not to question the physician’s clinical judgment. This appears to be pretty simple until audits from outside the organization place more emphasis on the use of clinical criteria. This use of clinical criteria to assign reported codes is known as "clinical validation." When coders follow the official coding guideline instructing them that a code assignment is not based on clinical criteria used by the provider to establish the diagnosis, they will be caught between following the guideline as instructed and being presented with a claim denial based on the absence of clinical validation.
In today’s healthcare environment, it is essential that organizations face this issue head on and provide coders with guidance on how to solve the dilemma of a record that contains physician documentation but does not contain clinical validation. Clinical documentation improvement efforts to improve upon complex clinical condition documentation must continue to bring the coding and medical records together to allow coders to code correctly and avoid payer denials.
CMS must clarify the reason the Recovery Auditors are allowed to deny claims, whether auditors will bypass this official coding guideline, and how organizations can reconcile the discrepancy.
Laterality coding
This update clarifies that when a patient with a bilateral condition has surgical correction on both sides, the first side corrected is coded with the bilateral code. The second site is not coded using the bilateral code because the condition no longer exists on the corrected side. If the treatment on the first side did not completely resolve the condition, then the bilateral code is used.
Documentation for BMI, non-pressure ulcers, and pressure ulcer stages
Section I.B.14 says for body mass index (BMI), depth of non-pressure chronic ulcers, pressure ulcer stage, coma scale, and NIH Stroke Scale (NIHSS) codes, code assignment may be based on medical record documentation from clinicians who are not the patient’s provider. Dietitians often document the BMI, nurses often document pressure ulcer stages, and an emergency medical technician often documents the coma scale. Keep in mind the associated diagnosis must be documented by the patient’s provider. A query should be used to clarify any conflicting medical record documentation.
This guideline shows the addition of the coma scale and NIHSS to conditions where code assignment can be determined from clinicians who are not the patient’s provider. Many coders may not be familiar with the NIHSS?it is a 15-item neurologic examination used to evaluate the effect of acute cerebral infarction. The NIHSS evaluates:
- Levels of consciousness
- Language
- Neglect
- Visual field loss
- Extraocular movement
- Motor strength
- Ataxia
- Dysarthria
- Sensory loss
The NIHSS evaluation is often done by nursing staff and can help physicians quantify the severity of a stroke in the acute setting.
Zika virus infection
The official guidelines instruct coders to code only confirmed cases of the Zika virus with code A92.5 as documented by the provider. Note that this is an exception to the hospital inpatient guidelines. "Confirmation" does not require documentation of the type of test performed; the physician’s diagnostic statement that the condition is confirmed is sufficient. Documentation of "suspected," "possible," or "probable" Zika is not assigned to code A92.5.
Hypertensive crisis
A coding guideline has been added to instruct coders to assign a code from category I16 for hypertensive urgency, hypertensive emergency, or unspecified hypertensive crisis. This may call for some physician documentation education to make physicians aware that these more specific codes are available and can be used instead of documentation of hypertension without any further description.
Coma scale
In addition to using the coma scale codes (R40.2-) for traumatic brain injury codes, acute cerebrovascular disease codes, or sequelae of cerebrovascular disease codes, the coma scale may be used to assess the status of the central nervous system for other non-trauma conditions. Examples include monitoring patients in the ICU regardless of their medical condition.
Observation
One observation Z code category has been added for use when a newborn patient is being observed for a suspected condition that is ruled out. The new code category is Z05: encounter for observation and evaluation of newborn for suspected diseases and conditions ruled out.
Newly added ICD-10 codes
CMS will implement an unprecedented number of new code changes October 1. A partial code freeze prevented regular updates for the last five years, resulting in the release of over 5,000 ICD-10 revisions on that date. The newest coding updates can be found at https://www.cms.gov/Medicare/Coding/ICD10/Latest_News.html.
The new ICD-10 codes come as we thaw out from the code freeze that has been in effect since October 1, 2011. Since that time, we have received only limited code updates to both the ICD-9 and ICD-10-CM/PCS code sets. Now, the long delay is over. ICD-10-CM changes include 1,928 diagnosis code changes with expanded code choices for atrial fibrillation, heart failure, diabetes mellitus Type 2, disorders of the breast, and pulmonary hypertension.
Extensive PCS updates are also being implemented. There are 3,651 new PCS codes, revised code titles, and a grand total of 75,625 valid codes with this update. It is important to note that 87% of the PCS code updates are in the cardiovascular system.
Following adoption of the new codes, review of coding accuracy will be needed. Any misconceptions or incorrect rationale should be recognized and communicated early to prevent ongoing or costly patterns from developing. Remember to ensure software updates are also in place and scheduled on time.
The new cardiovascular PCS codes include:
- Unique codes for unicondylar knee replacement
- Codes involving placement of an intravascular neurostimulator
- Expanded body part detail for the root operations Removal and Revision
- New codes in lower joint body system
- New codes for intracranial administration of substances such as Gliadel chemotherapy wafer using an open approach
- Addition of bifurcation qualifier to multiple root operation tables for all artery body part values
- Specific body part values for the thoracic aorta
- Specific table values to capture congenital cardiac procedures
- Unique device values for multiple intraluminal devices
Other PCS changes include:
- Donor organ perfusion
- Face transplant
- Hand transplant
The impact of the new codes will depend on what you do, so it’s important for hospitals to assess how the changes will affect them specifically. If you don’t deal with the areas where the codes have changed, the updates will be much easier than if your facility uses all the affected codes. Make sure the applicable codes are integrated into your internal applications and processes, while verifying that vendor products support the new codes. You don’t want to have claims rejected because not all of the new codes were incorporated.
Overall, there are moderate changes to the Official Guidelines for Coding and Reporting. The 2017 coding updates, however, are extensive and may seem overwhelming to some coders. The addition of over 10,000 codes after only one year of using ICD-10 will require coder resiliency to learn them all and understand how to apply them.
Medicare’s proposed discharge planning changes at a glance
Medicare’s proposed discharge planning changes at a glance
Learning objective
At the completion of this educational activity, the learner will be able to:
- Identify the proposed changes to the Conditions of Participation that affect discharge planning.
Discharge planning has long been a challenge for organizations, but proposed revisions to Medicare’s Conditions of Participation (CoPs) announced in November 2015 may make the process even more difficult. (See related article, Proposed rule focusing on discharge process could increase case management staffing needs in the January issue of CMM.)
In an April webinar called "Discharge Planning Realignment of Standards and Workflow," speaker Jackie Birmingham, RN, BSN, MS, CMAC, vice president emerita of clinical leadership for Curaspan Health Group in Newton, Massachusetts, said the proposal would represent "probably the biggest change that has been proposed in years for the CoPs." The changes could likely prompt a restructuring of case management functions to help ensure compliance with these new proposed functions.
Birmingham and fellow webinar speaker Janet L. Blondo, MSW, LCSW-C, LICSW, CMAC, ACM, CCM, C-ASWCM, ACSW, manager of case management at Washington Adventist Hospital in Takoma Park, Maryland, took some time at the end of the presentation to answer questions from the audience about the proposed rule and how it will affect case management and hospitals overall. Below are adapted versions of some of those questions and answers, which can help clarify some of the issues organizations may be struggling with related to these proposed changes.
Q: Does this proposal mean that we can send referrals to skilled nursing facilities (SNF) and home healthcare and they only present patients the choice of those accepting facilities?
A: Yes, that’s what it means. If you send referrals to postacute providers, we’ll use SNF as an example, and they look at it and they have the resources, the skills to meet that patient’s needs, and they have an empty bed when the patient is being discharged, you can show the options to the patient. If you have one option, then you have one to present to the patient. If you have 12 options, then you may want to use your clinical judgment and counseling and look more at the quality ratings to narrow the list down before presenting it to the patient. Medicare does not have a minimum list of providers to give to a patient. Some hospitals do. They’ll say you have to have three providers, but that’s only so that people are forced to have a backup plan should the first provider be unable to take the patient. So the answer is you can give the patient a list of only those that are available.
Q: We do physician-to-physician with transfers to acute care, but not to SNFs and rehab facilities. Is this now a requirement?
A: It’s not mentioned as a requirement in the discharge planning CoPs. But, in the view of continuity of care and safe transition of care, ensuring that the next provider can start the care. It is necessary to communicate to the next medical person who’s going to be taking care of the patient. It could be a doctor. It could be a non-physician practitioner. We believe that that would have an impact on readmissions if the person responsible for the care at the next level has a history of what happened to the patient in the current setting. So the medical information does need to be shared with whoever is going to be the medical provider in the postacute setting.
For patients being referred to an inpatient rehabilitation facility (IRF) from an acute care facility, it has to be physician-to-physician. The IRF physician must accept the referral. That was implemented maybe a year or more ago so that the benefit of the IRF for the individual patient would be clarified before they accepted the patient.
Q: Can you please clarify the requirements for critical access hospitals (CAH) briefly?
A: The CAH is a rural hospital and it’s one that is located geographically distant to a tertiary care hospital or a larger acute care hospital and they have been not required to do such rigorous discharge planning, but Medicare has said for those who are inpatients, they have to do planning for the patient. Now remember, they’re distinguishing between a discharge to home and a transfer to another hospital.
The CAH average length of stay is about 90 hours, 72?90 hours. I don’t know how many go home, but for those patients who go home directly from an inpatient stay at hospital CAH, the CAH has to do the same thing acute care hospitals do. It has to have a plan for all patients and it also needs to have a plan for follow-up for patients who are sent back into the community and not transferred to the hospital.
CAHs have been off the radar screen for a long time, but they are just what they say. They give access to critical services in rural areas. So some health systems have CAHs as their related partners so that those of you in an acute care hospital need to work closely with CAHs to help them understand the discharge planning and maybe if they’re in your system, do a combined system for follow-up care. Follow-up of the discharge patient to home, you see all the programs that are out there. There are some commercially available products. It’s a very time-consuming situation. If you call a patient who went home, you have to have a plan to address whatever concerns come up. So I applaud any CAH. CAHs usually have one person doing case management and that person does everything. I talked to one who was the supervisor of the operating room, the bed manager, the utilization reviewer, and the quality person because the CAH had 25 beds or less.
Q: Does the choice list given to the patient need to be kept in the permanent medical record?
A: That’s a great question and the answer is it depends on your hospital policy on choice. If your hospital policy on choice says that you must keep that file, then that should be in the medical record. It all goes back to what your hospital policy says. You may want to get it out and look at it. What does it say about documenting patient choice? Now, do you need to list everybody that you sent the referral to and only two accepted? That should be in your choice policy. The use and disclosure of HIPAA should be used as a basis for the answer to that question. I hope I’m not skirting the issue, but because Medicare will not tell you how to do it; it tells you, you must do it. It’s up to what your policy says.
Many people will document who the referrals were made to, but if you do use an electronic referral system that will be documented as you’re making the referral, when the surveyors come you may be asked to show in the electronic referral system where the referrals were made.
Q: At what point will these proposals be implemented by CMS?
A: I anticipate relatively soon. It likely won’t take as long as it did last time?1988 was when the amendment to the Social Security Act came out saying you will do discharge planning and then they kept evolving it. Because this is so big and such a big expansion, I imagine that it will take a little while but I don’t think it’s going to be too long. But the other piece of advice is that everybody should act as if this is the way it’s going to be. CMS published the blue boxes two or three years ago and there’s nothing in here that’s not logical, and if they don’t pass one thing, then I’ll say you should be doing it anyway because it has good outcomes. Remember in the blue boxes that came out from Survey and Certification May 2013 CMS said that it collected information from surveyors?from The Joint Commission, from the other [deemed] one and from state surveyors, and they said in hospitals where they had good scores. CMS took that information and put the advisory boxes and now they’ve taken the advisory boxes and converted them into standards. It’s so logical.
It’s so refreshing and when you have staff in the room, when you have new staff, when you’re asking an existing staff to do a new function, use these as your training tools because they tell you what the expectation is and then get your policies wrapped around it.
Q: What are the 10 sections of the discharge planning process?
A: The abstract of the CoPs lists those 10 parts of the discharge process, which include the following instructions:
1.Discharge planning must be provided by a registered nurse or social worker or other qualified individual
2.An initial assessment must be performed 24 hours after admission
3.The hospital must provide regular evaluation of the patient’s condition
4.A responsible practitioner must be involved in the planning process?that means, for example, a physician or nurse practitioner
5.The hospital must also consider caregiver- and community-based support
6.The patient and caregiver must be involved in the development of the plan
7.The plan must address the patient’s goals and treatment preferences
8.The facility must assist patients in selecting a postacute provider
9.The evaluation must be documented
10.The hospital must reassess its discharge planning process on a regular basis
To comply with No. 10, the organization would need to take all of your readmission data, your HCAHPS scores, and referrals that you’ve made to five-star, three-star, postacute providers and look at the readmission rate related to geography. Those types of things, and you have to document that in the minutes of your discharge planning meetings or in the utilization review committee meetings if that’s your reporting structure.
Organizations might also want to consider revising their assessments and including some of this information in assessments if the organization does a checklist, to have some of this information included so it can easily be shown that you’re addressing this topic.
Tips from this month’s issue
Tips from this month’s issue
Small breaches could become a big problem (p. 1)
1.Regional offices were advised to increase investigations of breaches affecting fewer than 500 individuals. Investigators will look for evidence of systemic noncompliance, such as multiple small breaches and common root causes.
2.Implementing OCR’s directive may be a tall order for resource-strapped regional offices, and it’s difficult to predict what the outcome will be.
3.Because small breaches weren’t investigated on the same scale as large breaches, OCR has much less data on them. Stepping up small breach investigations will mitigate that and may lead to improved guidance on key HIPAA pain points.
4.Although large breaches grab attention, they’re statistically less likely than small breaches.
5.But even a breach involving a single patient’s records can have serious consequences for the individual and even impact his or her safety if the medical record becomes compromised as a result.
6.Large health systems may lose sight of the details and brush off small breaches, but it’s the duty of privacy and security officers to take every breach, no matter how large or small, seriously and ensure the organization does so as well.
The cost of a data breach (p. 4)
7.Data breach costs vary between industries but healthcare, a highly regulated industry, sees especially high data breach costs.
8.Direct costs include remediation efforts and possible fines, but indirect costs are sometimes more difficult to identify and quantify.
9.Breach notification costs are the highest in the U.S.?first class postage adds up fast.
10.The more quickly a breach is identified and contained, the lower the cost. A well-prepared security incident response team is a smart investment that will pay off.
11.Participating in threat sharing may also be linked to lower data breach costs, but executive leaders may be concerned that sharing information on cybersecurity threats will put confidential information at risk. But no sensitive business information needs to be disclosed to participate.
12.Direct breach costs may be significant on their own but may not stack up against other risks an organization faces. Remember that one of the indirect costs of a data breach can be bad debt via medical identity theft. Bad debt is a top financial risk, and any measures that can bring that risk down are worth investing in.
Is HIPAA enough? (p. 8)
13.The rise of ransomware and other threats has led some stakeholders and lawmakers to question whether HIPAA is robust enough to provide even a reasonable bare minimum of security.
14.OCR has pointed fingers at executives for failing to support strong security programs, but the agency has no power to hold those executives accountable.
15.OCR recommends that CEs and BAs follow NIST’s cybersecurity framework, but that standard is only optional?not required?and many organizations may choose to not spend more resources on security than required.
16.Failure to complete an organizationwide risk analysis will land a CE or BA in hot water if a breach happens, but other federal agencies are critical of OCR’s risk analysis guidance, calling it inadequate.
17.HIPAA is designed to work with state laws. CEs and BAs must follow all applicable state privacy and security laws. In some cases, state laws may be stricter than HIPAA and provide stronger security requirements or clearer guidance.
Does your facility continue to struggle with injections and infusions coding?
By Steven Andrews
Despite few recent code or rule changes in recent years, coders and HIM managers I hear from through emails and at industry events almost always mention concerns about accurately documenting and reporting drug administration services.
The services are often performed in different hospitals departments on a variety of types of patients. Revenue integrity relies on orders, nurse documentation, correctly applying coding concepts, and capturing charges based on documentation.
If you continue to struggle with accurately reporting these services, join HCPro for our annual 90-minute webcast for a comprehensive review of the revenue integrity concepts applicable to drug administration services, including tips on medication administration record (MAR) documentation, and for capturing charges.
During this program, expert speakers Jugna Shah, MPH, and Valerie A. Rinkle, MPA, will cover frequently raised questions and discuss the impact of OPPS packaging on drug administration overall payments, the importance of reviewing your MAC’s local coverage determination guidance, and hot audit topics.
The webcast will take place Friday, January 29, from 1-2:30 p.m. (Eastern). For more information, click here.
Watch for the Revenue Cycle Daily Advisor!
We are happy to announce that beginning on January 25, you will be receiving the Revenue Cycle Daily Advisor. This free daily email newsletter combines editorial experts from HealthLeaders Media and HCPro to bring insight and news on every aspect of the revenue cycle covering topics such as Medicare reimbursement rules and regulations, value-based business models, clinical documentation improvement, health information management issues, patient privacy and security, and updates to coding and billing rules and guidelines, utilization review and case management challenges, and hospital and physician practice reimbursement and compliance.
Your current subscription to APCs Insider will be transferred to the Revenue Cycle Daily Advisor. The last issue of the APCs Insider is scheduled for January 22. Next week we will give you more details about managing your subscription to the Revenue Cycle Daily Advisor.
Survey on education and resources for coding management
HCPro is conducting research on education and resources related to coding management post-ICD-10. Please take a moment to answer a short 5-question survey to help us learn what would best serve your needs. Click on the link below to answer the survey online. If the click-through does not work, copy and paste the URL into the address bar of your browser. We appreciate your time!