Click here for more sample CPC practice exam questions with Full Rationale Answers

Practice Exam

Click here for more sample CPC practice exam questions and answers with full rationale

Practice Exam

CPC Practice Exam and Study Guide Package

Practice Exam

What makes a good CPC Practice Exam? Questions and Answers with Full Rationale

CPC Exam Review Video

Laureen shows you her proprietary “Bubbling and Highlighting Technique”

Download your Free copy of my "Medical Coding From Home Ebook" at the top right corner of this page

Practice Exam

2018 CPC Practice Exam Answer Key 150 Questions With Full Rationale (HCPCS, ICD-9-CM, ICD-10, CPT Codes) Click here for more sample CPC practice exam questions with Full Rationale Answers

Practice Exam

Click here for more sample CPC practice exam questions and answers with full rationale

2016 HIM roles and responsibilities survey: Survey respondents weigh in on roles and responsibilities

2016 HIM roles and responsibilities survey

HIM professionals report on their expansive role in the revenue cycle

For approximately 10 years, HIMB has been gathering data about the HIM profession through its annual salary survey. This survey often gives us a glimpse into the responsibilities of HIM professionals, but focuses primarily on the education, experience, and salary of those in the HIM field.

Time and again, the salary survey reveals that HIM directors and managers are wearing many hats and asked to oversee an increasing number of tasks. In an effort to dig a bit deeper into HIM departments, HIMB conducted its first HIM roles and responsibilities survey.

More than half of respondents were HIM directors (26%) or managers (25%), whereas the remaining 49% held other revenue cycle positions. Of the latter group, 50% were coders and 29% were CDI specialists. Responses also came in from transcriptionists, privacy officers, compliance officers, revenue integrity professionals, and consultants.

HIM demographics

The plurality of respondents work in acute care hospitals (55%) and critical access hospitals (17%) or have a corporate position at a multi-system hospital (8%). Other settings represented in the survey include long-term acute care hospitals, psychiatric/behavioral health hospitals, skilled nursing facilities, ambulatory surgery centers, and physician practices.

On average, most respondents appear to be working in a hospital with 100?199 beds, with approximately 20% of respondents selecting this option. Nearly 18% work in hospitals with fewer than 25 beds, and 15% work in hospitals with 500 or more beds.

 

HIM reporting structure

Nearly half of respondents (48%) report that more than 20 staff members report to the HIM director and/or manager at their facility. Nearly one-quarter (22%) of respondents reported that 0?5 staff members report to the HIM director/manager at their facility. The remaining 30% of respondents said the number of employees reporting to HIM is more than five but less than 20.

The majority of HIM departments represented in the survey (78%) report to their facility’s chief financial officer. Others tend to report to the chief executive officer (13%) or chief information officer (9%). Some respondents wrote in to clarify their reporting structure after selecting one of the aforementioned broader options. Write-in responses indicate HIM may also report up to:

  • Vice president of finance
  • Vice president of health data support services
  • Vice president of revenue management
  • Vice president of revenue cycle
  • Vice president of quality management
  • Chief quality officer
  • Chief medical information officer
  • Chief revenue officer

Similarly, HIMB asked respondents which roles report to the HIM director/manager. The top three roles reporting to HIM include release of information staff (90%), coders (89%), and transcriptionists (76%). Less than half of CDI specialists (45%) and privacy officers (42%) report to HIM. And less than one-quarter of information governance (22%), compliance (16%), security (14%), and revenue integrity (12%) staff report to HIM directors/managers. A lesser percentage of risk management (5%) and case management (4%) professionals fall under HIM.

Some respondents wrote in to note that HIM is often responsible for overseeing registration, billing, collections, record management, and patient access.

Respondents indicated that transcription is the most frequently outsourced role in HIM, with 61% indicating their facility outsources this function. "It is very convenient, as transcribers are situated throughout the states and reports are transcribed timely for late night physician dictations," one respondent said.

More than one-third of facilities surveyed (34%) have also opted to outsource release of information (ROI) functions. "We have a one-person department. ROI is outsourced only as it applies to requests from lawyers, courts, and disability agencies. HIM handles requests from hospitals, doctors, and patients," one respondent said.

Other functions frequently outsourced include archives/warehouse storage (33%) and inpatient (28%) and outpatient (24%) coding. (See the figure on p. 3 for more information about outsourcing.) One respondent noted that his or her coding and transcription is only partially outsourced.

"Our outsourced outpatient coding position is for only 20 hours a week. She codes clinical accounts as well as observation and outpatient surgery cases," a survey respondent said.

Respondents seemed to be split on whether outsourcing was the best option. While some respondents noted that outsourcing was helpful in terms of managing costs, others stated that it was expensive. However, for facilities with limited resources and space, it seems to be a viable option.

"Coding is outsourced due to the limited resources we had available at our facility, such as qualified coding candidates in our geographic area as well as competitive compensations with surrounding areas," one respondent said.

While some facilities reported outsourcing functions due to lack of resources, others are simply using it for backfill and vacation coverage or simply to ensure coverage after hours and on weekends for certain functions. "The services outsourced above are mainly outsourced because of the lack of resources to hire qualified personnel who can do the job. In a recent analysis it was also shown that the price we pay for outsourcing coding was low compared to the price it would cost to have it in house," one respondent said.

Notably, one HIM director stated that his or her function is entirely outsourced. This seems like it may present a challenge given that HIM directors and managers are involved in so many projects.

HIM responsibilities

According to survey respondents, HIM directors/managers are actively responsible for the following functions (see the figure on p. 3 for more information):

  • Prepping, scanning, and quality checks for medical records (96%)
  • Record retrieval, assembly, and analysis (93%)
  • Delinquency management (88%)
  • Transcription (79%)
  • Enterprise master person index/master person index (56%)
  • Archives/warehouse management (51%)
  • Patient identity management (46%)

 

When asked to expand upon their roles in HIM, respondents described their responsibilities in various ways, backing up what we have long seen in the HIM director and manager salary survey about HIM playing many roles.

One HIM manager responding to the survey stated that he or she supervises coder education and training, "providing orientation and initial job training for coders, ongoing and new software/processes training for coders and CDI, including all ICD-10-CM and ICD-10-PCS training as job-required."

An HIM director responding to the survey stated that he or she is "responsible for direction and overall performance of all chart assembly, analysis, and coding." This respondent also noted involvement in "ROI functions and all internal and external audit reviews." As if that doesn’t sound like enough to keep one HIM director busy, this particular respondent also noted involvement in the following:

  • Quality improvement
  • Utilization review
  • Chart delinquencies and CMS reporting requirements
  • Working with CDI and physicians on chart requirements and timely documentation

 

See the sidebar on p. 5 for specific information about responsibilities of various titles within the HIM department.

Despite everything HIM directors/managers have on their plates, most respondents chimed in when we asked which committees HIM should play a role in. Respondents wrote in that HIM should participate in committees related to the following:

  • EMR/EHR
  • UR
  • Billing
  • Quality
  • Finance
  • Compliance
  • HIPAA
  • Credentialing
  • Forms creation
  • Population health
  • Patient services
  • CDI
  • Medical executive
  • Nursing
  • Appeals and denials
  • Revenue integrity
  • Information governance

 

If it seems like we just listed off the majority of hospital departments, that’s because we did. Despite an ever-growing list of demands, HIM managers and directors are well suited to take a seat at the table with any of the above departments/committees and are often eager to do so.

"HIM participates in information governance, and quality meetings. I would suggest that our HIM department also participate in medical executive meetings and also ambulatory care meetings," one respondent said.

While some respondents were specific about which committees HIM should be a part of, others simply stated that HIM had earned a seat on any committee that was related to the revenue cycle. "I think HIM should participate in any and all committees needed, as the HIM department touches every piece of PHI that enters the hospital, whether that be on paper or electronic. HIM representation at meetings, I believe, is very important," said an HIM director.

 

Challenges facing HIM today

We asked survey respondents a variety of open-ended questions about the HIM department at their facility. When asked to identify challenges facing HIM, respondents said the following:

  • "HIM professionals are rarely acknowledged for their impact and knowledge they have that benefits the facilities they work at. Most leaders and other departments have no idea what we do and typically will call us ‘glorified paper pushers.’ Because of this, compensation is not where it should be."
  • "Movement to an EMR. Dealing with issues with copy and paste functions within an EMR. Acquiring accurate information on admission with an accurate MPI. Being included in meetings and decision-making that affects the HIM function."
  • "Lack of staffing. Not all facility staff are aware of all the HIM tasks, so they think we only put papers together all day and nothing else."
  • "Building a coding department. Ensuring accurate coding and impact to patient safety indicators. Accurate physician documentation."
  • "Competing salaries with outsource companies for coders and coders wanting remote work only."
  • "It seems that most HIM jobs are outsourced and that we are having to pick a specialty (CDI, Privacy/Security, coding, EHR, etc.) to keep a foothold in our business. It’s not the old HIM department as we knew it!"
  • "Our greatest challenge is the hybrid medical record. Know what is electronic and where it is located in the HIS system and what is still paper. Some physicians still will not electronically sign. Along with EMR is the multiple systems that interfaces must be built for information to be shared which adds to cost."
  • "For us I believe that is trying to get us that last 5% totally electronic. Overall, I would say support of providers to use the electronic system, so that we can get away from pushing around so much paper. We have gone from a department of eight to a department of five in my five years here; we, as well as many other departments, are being asked to do more with less. That is a challenge."

 

Inside the HIM department

Ever wonder what the inside of another facility’s HIM department looks like? Of course you do. To satisfy our curiosity, we asked respondents to describe the makeup and location of the HIM department within their facility:

  • "HIM is on the main level of the hospital. We are located on a separate wing by ourselves away from main traffic of the hospital. It would be beneficial to be more centrally located so that patients can better find us when they need records. The coding department is across the hall from us in a separate office."
  • "Ground floor next to administration, away from the physician lounge. Would be better being closer to the physicians to get records completed. One in-house coder for ancillary coding. All staff in area for ROI, birth certificates, assembly and analysis, scanning, but file room is located across the hall."
  • "HIM at my facility is on the ground level. In fact, I think we are in the perfect location for patient access because we are right inside the door. From the HIM department we only have HIM personnel working alongside each other. Coding works at home and at our affiliate site. Transcription is outsourced. We do share space with another department, not HIM related."
  • "We are located on the first floor of the hospital. Our coding and transcription functions have been regionalized and are managed off-site. The majority of our coders work from home."
  • "Ground level. Coding, scanning, and records review share a large office. Transcription and CDI are in different areas of the hospital."
  • "All of HIM, except for CDI, are all located together in a medical office building on campus. A CDI [specialist] is assigned to a specific floor/unit and works from there."
  • "The HIM department is on the patient floor with coding being done on-site and remotely. Transcription is contracted out and performed remotely and HIM clerical personnel on-site at each building."
  • "HIM located within the core of the patient care area. Four of five HIM staff share the office with the manager."
  • "Basement of hospital for scanning, chart completion, data integrity. Off-site for HIM at rehab, skilled, homecare. Coding is in a separate building off campus."
  • "We have a separate building from the hospital for all non-clinical employees. Most of our coders work from home. All of HIM is in one big area of the second floor."
  •  

Survey respondents weigh in on roles and responsibilities

To understand the intricacies of the HIM role, we asked survey respondents a variety of open-ended questions about the HIM department at their facility. When asked to describe their role and responsibilities as they relate to HIM, respondents said the following (the title that follows each quote was selected by the respondent regardless of the scope of responsibilities described):

  • "My role is inpatient coder and involved in DRG appeals sending out letters of redetermination to insurance companies?HIM department separated from coding/CDI department." ?Coder
  • "I manage the coding and CDI functions within the HIM department. I make sure the coding service is up to date on any facility changes and monitor that they are meeting service agreements." ?HIM manager.
  • "I am a coder and credentialing coordinator by title, however, I perform every single task in HIM department?transcription filing to chart assembly and analysis, denial follow-up cases due to documentation or coding issue, physician delinquent rates, subpoenas and other ROIs, etc." ?Coder.
  • "Only employee?coder, data entry, chart completion, analysis, physician visits, medical staff, release of information." ?Non-director/manager in HIM.
  • "Revenue cycle director, HIM director, privacy officer. I wear several hats to coordinate the areas of admitting, scheduling, switchboard, business office, and medical records." ?HIM director.
  • "My role and responsibilities as the HIM director and privacy officer include education on HIPAA privacy and breach reporting, maintaining the department, conducting and reporting on closed chart reviews, coding quality and quantity, transcription quality and quantity, and other personnel’s productivity. I also play a very active role in educating physicians on using the EHR and completing their records; track delinquency rates; and assist IT in managing information." ?HIM director.
  • "I am an outpatient coder coding some clinical accounts but primarily outpatient surgery and observation accounts. In addition to coding, I check charges on each account to make sure we have a revenue code to link the CPT code to and have charges for any implants/devices that were used. Each account finalized is then sent to billing so the more we code, the faster the billing department can send the bills." ?Coder.
  • "We share/rotate responsibilities in our small department between outpatient ancillary coding, transcription, ROI, prepping charts for scanning our hybrid record, quality controlling scanned documents. I’m in training to take over for my director when she retires in two years. I’m also the module coordinator for our Meditech computer system, working with our IT lady on issues affecting our department." ?Transcriptionist.
  • "I am the HIM coordinator who wears many hats. Coding/privacy officer/quality improvement/core measure reporting/chargemaster/credentialing." ?HIM manager.
  • "Manage coding staff, perform compliance audits, provide education to coders, CDI specialists, and physicians. Support management of budget, supplies, etc. Participate in revenue cycle meetings and work closely to develop and submit appeals/address denials." ?Coding supervisor.

HCPro.com – HIM Briefings

Healthcare News: CMS invites comments on 2-midnight rule payment calculation

A recent court ruling determined that CMS had to explain its calculation for a negative 0.2% reduction in inpatient payment rates as a result of implementing the 2-midnight rule. The court also said that providers should have an opportunity to comment on the calculation. 
 
In early December, CMS released a notice with comment period to meet the court’s requirement, but providers might not be pleased with forcing the agency’s hand. CMS notes that when originally estimating the number of outpatient cases that should shift to inpatient as a result of the rule, it looked at 2011 claims containing HCPCS codes G0378 (hospital observation service, per hour) and G0379 (direct admission of patient for hospital observation care). 
 
Using this data, CMS identified approximately 350,000 observation stays that lasted two or more midnights. The agency combined that with approximately 50,000 claims that contained major procedures based on APCs that resulted in stays lasting more than two midnights. CMS also analyzed data from the inpatient side by looking at inpatient claims containing surgical MS-DRGs with stays that lasted less than two midnights and found approximately 360,000. 
 
The agency used this data to determine a net increase of 40,000 inpatient discharges as a result of the rule to calculate $ 220 million in increased expenditures on the inpatient side, leading to the reduction.
However, CMS now says that in light of new regulations and by using different metrics to estimate the shift, as many as 570,000 cases could move to the inpatient side, resulting in an even larger payment shift. 
 
Providers can comment on the notice at regulations.gov and all submissions must be received by February 2, 2016. 

 

 

HCPro.com – JustCoding News: Inpatient

CMS sets sights on future quality, payment initiatives in 2016 SNF PPS proposed rule

CMS sets sights on future quality, payment initiatives in 2016 SNF PPS proposed rule

In mid-April, CMS released its proposed SNF PPS rule for fiscal year (FY) 2016. Though the rulemaking document is an annual ritual, this year’s iteration, which experts who spoke with HCPro predict will pass largely unaltered, departed from its recent predecessors in one distinct aspect: its preoccupation with long-term projects.

"It was not a … rule like we’ve had in recent years," says Judy Wilhide Brandt, RN, BA, RAC-MT, C-NE, principal at Judy Wilhide MDS Consulting, Inc., in Virginia Beach, Virginia.

In lieu of remedying small-scale, immediate concerns (like FY 2015’s COT OMRA fix), the FY 2016 proposed rule lays the framework for SNF-specific value-based purchasing (VBP) and quality reporting programs (QRP)?two more distant initiatives that, through their ongoing integrations in different settings, promise to reshape long-standing paradigms, business models, and care practices across the care continuum in the coming years.

But despite the unusual foresight of the latest SNF rule, experts say its provisions hold few surprises, as the two far-off programs they detail are products of high-profile legislation passed last year:

  • The Improving Medicare Post-Acute Care Transformation (IMPACT) Act of 2014 calls for the phasing in of various quality improvement and reporting initiatives throughout postacute care (PAC), including a SNF QRP. The legislation also requires the creation of standardized reporting metrics that allow for more equitable comparisons of care delivery strategies, patient outcomes, and overall performance across the various PAC settings (i.e., SNFs, home health agencies, inpatient rehabilitation facilities, and long-term care hospitals).
  • The Protecting Access to Medicare Act (PAMA) of 2014 added new subsections to the Social Security Act that authorize the establishment of a SNF VBP program beginning in FY 2019, under which value-based incentive payments will be distributed to SNFs based on their performance on designated quality metrics.

Payment update

In addition to these long-term projects, experts say the one major constant of annual CMS rulemaking?the payment update?was also familiar territory this year.

CMS projects that aggregate reimbursement to SNFs will increase by 1.4% ($ 500 million) in FY 2016. The proposed bump would be the result of a 2.6% market basket increase combined with two 0.6% reductions, one stemming from the forecast error adjustment, and the other from the multi-factor productivity adjustment.

But although the anticipated increase is within normal bounds?Brandt says the industry is accustomed to an annual boost between 1% and 2%?Maureen McCarthy, RN, BS, RAC-CT, president and CEO of Celtic Consulting, LLC, in Torrington, Connecticut, had hoped that SNFs would see a higher market basket raise next fiscal year. Although McCarthy says the multi-factor productivity adjustment and the forecast error affect reimbursement rates each year, she says this year’s adjustments may also be intended to fund some of the proposal’s other initiatives that center on improving quality of care and patient satisfaction. Still, McCarthy prefers this strategy over ones that would divest providers after payment was awarded or that would only target certain SNFs.

"It’s the least punitive," she explains. "It’s money we haven’t gotten yet, so it’s easier to lose."

 

Payroll-based staffing reporting

The other major change addressed in the proposed rule that will actually hit providers next fiscal year is an electronic system for submitting staffing data pulled directly from payrolls, which CMS plans to debut this October for volunteer SNF testing. The so-called payroll-based journal (PBJ) is a response to the Affordable Care Act (ACA)’s call for the introduction of more accountability into the SNF staff reporting sphere by creating a method to electronically submit data on direct care staff (including agency and contract workers). The ACA requires that such a system fulfill the following criteria:

  • Culls data that is verifiable and auditable, such as that from payrolls
  • Specifies the job classification of each employee (e.g., RN, LPN, licensed vocational nurse, CNA, therapist, or other medical personnel) and the number of care hours each employee category provides per resident day
  • Distinguishes data on agency and contract staff from that on SNF employees
  • Tracks employee turnover and tenure
  • Includes data on resident census and case mix
  • Facilitates public reporting on a regular schedule

 

Although CMS has long been developing a qualifying system and periodically updating the industry about its progress, the FY 2016 proposed rule offers a more comprehensive discussion of how the agency plans to implement these ACA stipulations. Most strikingly, the rule reiterates CMS’ recent announcement that all SNFs will be required to submit data through the PBJ beginning July 1, 2016.

Although this wholesale shift in staff reporting is coming up fast, McCarthy says the details of its execution aren’t yet set in stone. She therefore urges SNFs to parse CMS’ proposals in this domain to bring to light any potential snares, including:

  • How the PBJ will consider corporate nurses who aren’t on a facility’s payroll but may perform direct care.
  • What documentation will be required to support the new collection system. For example, will the CMS-671 and CMS-672 forms feed the PBJ until CMS develops a more tailored alternative?
  • How the PBJ will account for time worked by salaried employees. Although full-time staff are typically thought to spend 40 hours per week on the job, McCarthy says many salaried direct care staff work 50- to 60-hour weeks, meaning a facility could have higher staffing levels at any given time than the size of its workforce would suggest.

 

Despite these lingering uncertainties, Brandt believes that CMS recognizes the gravity of the industry’s upcoming transition to a much more robust?and complex?reporting mechanism. In turn, she’s optimistic that the agency will implement the new system methodically, accounting for industry feedback and not jeopardizing honest performers.

"I trust that their goal is that it be fair and reliable, so I trust that people who are staffing to acuity are going to be just fine," she says.

Despite Brandt’s confidence in the ability of worthy providers to acclimate to the upcoming shift, Bonnie G. Foster, RN, BSN, MEd, long-term care consultant in Columbia, South Carolina, doesn’t think they should have to. Foster sees the PBJ as a symbol of the government’s misplaced distrust in an industry largely composed of scrupulous providers that are trying their best to field unforeseeable staffing challenges (e.g., last-minute callouts and heavy turnover) as they arise.

But others don’t have such a high view of the SNF provider community. In addition to fulfilling legislative mandates, the government hopes that the PBJ will quell worries expressed by industry stakeholders about the validity of today’s self-reported staffing data?worries that were stoked by an August 2014 New York Times exposé that charged some in the long-term care setting with artificially inflating reported staffing levels to fare better on Nursing Home Compare’s star ratings.

Of course, many providers have denounced these charges. Some, like Brandt, believe that they represent only a small proportion of providers?providers that may soon be exposed through the verifiable PBJ data.

"The people who have been spending their time trying to manipulate the data and … figure out ways to beef up staffing before a survey … all of those tricks are going away if these measures get implemented," Brandt says.

But Foster fears the PBJ could have the reverse effect, driving providers to enlist staff whose titles look the best on paper (or screens) rather than those who are the most qualified. For example, with increasing pressure from CMS and consumer advocates to bump up levels of RN staffing and supervision at SNFs (which will be more easily identifiable in an electronic reporting system), LPNs with years of nursing and management experience may fall by the wayside, Foster explains.

"I don’t want people to put staffing down there to satisfy the system," she says. "That part scares me a lot."

Regardless of her qualms about the forthcoming reporting system, Foster says providers have some work to do to brace for the additional staffing scrutiny ahead.

For example, while SNFs have adopted flexible intake practices to stay competitive in an evolving industry (e.g., admitting new residents late at night and on weekends), Foster says many haven’t synced their staffing schedules with these new patterns, potentially leaving a workforce that is undermanned or underqualified to cope with peak admission periods.

"If you’re going to continue to admit at those strange hours, then you better be sure that all of your staff understand everything," she says.

In addition to improving general staffing strategies, Brandt says providers should focus on understanding the specifics of the forthcoming PBJ.

"People need to read the draft manual on submitting staffing data, and it’s not too early to start preliminary talks about how they’re going to comply," she explains, encouraging providers to begin priming staffing data for the new collection process by identifying the employees who will be responsible for reporting through the system, kick-starting training initiatives, and setting away necessary budget today.

 

QRP

To satisfy provisions of the IMPACT Act that task CMS with collecting quality data, the agency is proposing to build a SNF QRP that considers the three quality measures outlined in the table below.

Under the QRP, SNFs would be required to submit certain data on these measures beginning in FY 2018, as well as on any other focuses CMS finalizes in future rulemaking. In addition, the IMPACT Act dictates that providers failing to comply with these reporting requirements will be penalized with a 2% reduction in their annual payment update.

These prospective QRP requirements will carry significant changes in SNFs’ approaches to quality improvement. The proposed fall and functional status measures have not yet been approved by the National Quality Forum for SNFs, and the latter measure could see in an additional MDS component: Section GG. This new section, which would prompt SNFs to evaluate the functional abilities and goals of residents at the start and end of care, would also foretell a new required assessment for facilities to complete when a beneficiary is discharged from a Medicare Part A stay but does not leave the facility?a status shift that CMS says affects 30% of SNF residents.

Brandt has encountered some providers that are wary about the prospect of an additional assessment on top of their already heavy documentation load?not to mention the associated data capture, training, and resource distribution changes it could carry. However, she thinks these fears are overstated because much of Section GG is pulled straight from the Continuity Assessment Record and Evaluation (CARE) item set, a tool that’s been in development since the 2005 enactment of the Deficit Reduction Act compelled CMS to examine the consistency of payment incentives across the various Medicare providers. CMS states that the CARE tool, which is an output of this directive, is "designed to standardize assessment of patients’ medical, functional, cognitive, and social support status across acute and post-acute settings." And Brandt says it has long been on the radars of central SNF departments.

"The CARE tool has been around for a long time now, and if you read through [Section GG], it’s what therapy has been doing, maybe in different formats, every time they do an evaluation in the discharge summary," she says, explaining that, consequently, many rehab providers already have the tool in their software and have been collecting data through it for some time.

"The MDS community needs to realize that adding a section to the MDS doesn’t mean that it’s going to add more to the job of the MDS coordinator," she says.

Beyond the new quality considerations CMS has posed, the agency also seeks to redefine the current bounds of the industry’s skin integrity measure. Although SNFs are presently required to submit data on changes in their residents’ skin integrity, this measurement is restricted to the development of stage 1?4 pressure ulcers that occur or worsen during facility stays. CMS is proposing to broaden this reporting criteria for SNFs (and other PAC providers) to include:

  • Unstageable pressure ulcers
  • Suspected deep tissue injuries
  • Stage 1 or 2 pressure ulcers that become unstageable due to slough or eschar (indicating progression to a stage 3 or 4 pressure ulcer) after admission

 

CMS points out that since SNFs are already required to complete items related to unstageable pressure ulcers in the MDS, the revision would require a change in the way the agency calculates the measure but would not increase the data collection burden for SNFs.

In addition, by capturing more incidences of decline, CMS says these proposed updates?which are backed by a number of experts and the agency’s own data analyses?could potentially reveal a wider range of SNF performance, improving "the ability of the quality measure to discriminate between poor- and high-performing facilities."

Brandt thinks this attempt to better discern the success of pressure ulcer prevention throughout the provider community demonstrates CMS’ overarching proposal strategy: to elevate hard workers and undercut bad actors.

"Facilities that have been sincerely and tirelessly working on achieving the highest quality of care are going to rise to the surface," she says. "There are nursing facilities all over this country that have been … doing what they can to prevent injuries from falls, preventing pressure ulcers, and I think they’re going to shine."

In addition to putting the necessary frameworks in place to highlight today’s top-performing facilities, ­McCarthy says the QRP proposals can serve as a road map for providers on shakier ground to launch targeted quality improvement initiatives.

"I think providers should take a look at what’s going to be reported for 2018 … and then look at those quality metrics within their own organizations," she says, adding that facilities should pay particular attention to the proposed methods of collecting and scoring quality data.

"They have the opportunity to correct some issues before [there’s] mandatory reporting if CMS will allow it," she continues, explaining that the agency is soliciting public comments through the proposed rule on whether to give providers this head start.

However, Brandt cautions facilities to avoid putting too much stock in the formulas for calculating these quality measures until they are finalized.

 

VBP

In addition to putting the finishing touches on the QRP’s initial aims, CMS is considering another quality-related focus intended to shape future payments dispensed through the setting’s forthcoming VBP program: the SNF 30-day all-cause readmission measure (SNFRM), which CMS specifies would assess the rate of unplanned readmissions among SNF residents that occur within 30 days of discharge from an inpatient hospital. However, McCarthy says CMS has failed to disclose whether the measure would also penalize providers for hospital readmissions that occur within 30 days after discharge from the SNF itself.

To gather preliminary data for the potential introduction of this metric?whose development was first kindled by PAMA?in October 2016, CMS plans to require facilities to report certain rehospitalization rates starting this October.

Beyond the prospect of an imminent reporting start date tied to its contents, Brandt thinks the SNFRM is significant for another reason: It would be calculated using data from claims rather than MDS documentation, an unprecedented move in the SNF quality domain and one that wouldn’t require any additional data collection or submission by providers.

"It’s kind of historic that we’ve finally got our first measure that is not MDS-based," says Brandt, who believes that the financial tie-ins carried by both the VBP and QRP will further undermine bad actors by stripping them of their primary motivation: monetary reward.

"I think the people who are in long-term care for the goal of providing the service of quality care and who are interested in quality outcomes are going to rise to the surface," she says. "I think people who are in long-term care for any other reason are going to be leaving."

Foster is more ambivalent about the financial incentives (and disincentives) that will soon underlie key performance metrics in the sector. She says that although the forthcoming measures?and their monetary drivers?target long-standing industry shortcomings, she thinks they paint with too broad a brush.

"It’s your entire building is doing a good job, or your entire building is not doing a good job," she says.

Foster worries that this stance could penalize facilities that take on the most compromised residents or reward those whose emphasis on producing favorable bodily outcomes jeopardizes the psychosocial health of the individuals they serve.

 

Today’s strategies for future success

Despite the far-off focuses of CMS’ latest SNF rulemaking, experts warn providers against lapsing into complacency in the absence of more urgent proposals. They stress that the changes, although distant, are likely to become finalized without major revision. Further, the sweeping scope of QRP and VBP demands preparation from providers today to facilitate compliance and operational stability down the road.

To address the spirit of these changes?the facilitation of effective and efficient care?Foster urges SNFs to implement new restorative nursing programs (or modernize existing ones) with an eye to addressing CMS’ focuses, such as functional status and rehospitalization. Foster says this latter quality indicator, in particular, has been an historic pain point in the industry.

"We’re just worried about the people that keep going back and forth to the hospital as [if through] a revolving door," she explains. To combat this issue, Foster says restorative programs should target services that have traditionally landed residents back in the hospital even though SNFs are equipped to render them, such as providing extra hydration through IVs.

Currently, Foster?who has extensive experience helping facilities implement restorative strategies?says many providers are failing to capitalize on the benefits of a formal restorative program, instead opting for one-off interventions (e.g., designating nursing staff to take residents for a walk once or twice a week) and dedicating the bulk of their resources to enriching therapy offerings. Although some experts say that therapy has been gaining priority throughout the industry as an adaptation to today’s influx of patients seeking short-term intensive SNF rehab services, Foster argues that restorative nursing is a more sustainable practice in some respects. For example, she says that Medicare-covered SNF therapy services have federal cost caps, while restorative programs oftentimes have no mandated expiration date.

Thus, Foster urges providers to shift some of their focus to modeling restorative programs after their often more robust therapy counterparts (e.g., by framing the program with concrete, measurable goals). Not only does Foster believe a restorative mindset will align a facility’s practices with large-scale regulatory shifts, but she says it can breed better connectivity between therapy and nursing departments, thereby fostering a unified vision of care.

In order to build a restorative program that can achieve these manifold benefits in time for the implementation of QRP and VBP measures, Foster says providers need to get started soon.

"It’s going to take you a year to get it right," she explains, citing chronic industry shortfalls as barriers to speedy implementation.

In particular, Foster says providers need to strengthen communication with physicians and the families of residents. She believes many rehospitalizations can be attributed to insistence by families that a SNF readmit a resident to the hospital for any change in condition?even one a facility is capable of remedying.

"When nurses call the families to let them know … "Something’s changed in your loved one," families are notorious for saying, ‘We’ll just send them to the hospital,’ and that’s what [SNFs] do," she says.

To combat families’ reflexive panic and facilities’ equally knee-jerk acquiescence, Foster urges SNFs to sit down with partnering physicians to write a concrete strategy for addressing condition changes. The document should list the specific events a facility can handle on its own and detail the procedures it will use to do so. This will arm SNFs and physicians with an official document to assure families that the SNF is well-equipped to stabilize their loved one’s condition after certain adverse events.

But SNFs’ current communication shortfalls aren’t restricted to external stakeholders, according to Foster, who also charges the industry with insufficient education, particularly among frontline staff. In turn, these lapses can trigger subpar care, inaccurate documentation, and high turnover among mismanaged and frustrated employees. For example, Foster says that documentation among a facility’s CNAs can be erratic and inconsistent, especially regarding a given resident’s functional status, which must be captured multiple times each day and can be evaluated very differently by varying frontline staff members.

To begin clearing up disparate clinical understandings, Foster recommends focusing training efforts around the component of the MDS that corresponds to functional status. "If nothing else, just teach Section G," she says?a directive that seems particularly fitting, given the potential implementation of Section GG, which would build on the functional data already captured today.

Beyond ramping up education, Foster proposes an unconventional solution for warding off critical quality lapses: establishing a mentor program that assigns a qualified staff member to remain by each newly admitted resident’s side for the first two days of his or her stay, a period during which Foster believes the lion’s share of adverse incidents occurs.

"Everything bad happens within the first 48 hours of admission," she says, explaining that she’s seen mentor programs targeted to this time frame reduce fall rates.

But before getting too caught up in planning any full-fledged program refurbishments, McCarthy urges providers to take advantage of the public reporting period on the proposed rule?in effect through June 15?to point out to CMS any perceived issues, discrepancies, or oversights (e.g., surrounding the PBJ and SNFRM) that could jeopardize the future success of their facility.

"Providers really should use that opportunity to voice their concerns to CMS on what issues they think may negatively impact them," she explains. "Because once they become public, they become public, and there’s no opportunity to correct the information that’s out there."

In many respects, the proposed rule provides a first glimpse into CMS’ big-picture plans for the industry in the years ahead. Although it glazes over some key nuances of the agency’s potential execution strategy, Brandt is optimistic the proposal will ultimately introduce new, more reliable methods of upholding virtuous SNFs that have been overshadowed in recent years by the industry’s small, yet potent faction of abusers.

"I think that all the good, decent, honest nursing home operators have ever asked for was a fair chance and to be measured realistically on a level playing field, and I think this is a great step in that direction," she says. "I’m excited to see what’s going to happen in our industry in the coming years."

HCPro.com – Billing Alert for Long-Term Care

BAAs, faxing, and customer surveys

HIPAA Q&A

BAAs, faxing, and customer surveys

by Mary D. Brandt, MBA, RHIA, CHE, CHPS

Q: I recently received a customer satisfaction survey from a medical supply company. The survey was printed on a postcard, not enclosed in an envelope. The survey is generic and doesn’t include information about what services or supplies were received, but it does show my name and address and the name of the company. Anyone looking at it could know, or assume, that I received medical supplies. I don’t feel this is appropriate, but I’m not sure if this is a HIPAA concern.

 

A: Since no PHI was disclosed, this is not a HIPAA violation. If the survey were targeted to a specific type of supply, such as diabetes test kits, it could be considered a HIPAA violation because it disclosed information about your medical condition. A generic survey, such as the one you received, is not a concern.

 

Q: A situation recently arose with one of our business associates (BA). We have a copy of a business associate agreement (BAA) signed by the company; however, there have been some changes in personnel within the BA. The BA now claims it has no record of the BAA and does not feel it should be bound by the agreement. We suggested creating and signing a new BAA but the BA is reluctant to agree to do that. Is it a HIPAA breach if the BA no longer has a copy of the BAA?

 

A: As a covered entity (CE), you are required to have a written agreement with each of your business associates to secure the PHI to which the BA has access. If the BA claims it does not have a copy of the agreement previously signed, the BA is clearly not abiding by the agreement. You should (1) provide a copy of the existing agreement to the BA and obtain their agreement to abide by it; (2) have the BA sign a new agreement, or (3) terminate your contract with the BA.

 

Q: Is an organization required to notify a patient of a single misdirected fax?

A: You do not have to notify a patient of a single misdirected fax unless you have reason to believe it may have resulted in harm to the patient.

 

Q: We are having a problem with misdirected faxescaused by the phone company. Our electronic health record (EHR) auto-faxes ancillary reports and transcribed documents to physician offices whose fax numbers are set up in our system. Recently, I was contacted by two businesses who received misdirected faxes on more than one occasion. These faxes should have gone to one of our physicians. The fax number for these businesses is one digit off the physician office’s fax number.

Our modem dialed the correct fax number but a switch in the phone company’s system misdirected some pages of the fax to a wrong number. Our IT director/security officer has contacted the phone company numerous times to no avail. We are considering legal action against the phone company.

My question is: Who is in violation of HIPAA? Are we in violation even though our modem is dialing the correct number? Is the physician’s office in violation because the fax is being sent to them? Is the phone company in violation because its equipment is causing the problem, even though it is not a CE?

 

A: Your organization would probably be considered to be in violation because your PHI is being misdirected. If the problem involves only one physician, you may need to stop auto-faxing to that office until the problem can be resolved. If you believe the problem lies with the phone company’s equipment, a letter from your attorney may get the phone company to take this seriously.

 

Editor’s note

Brandt is a healthcare consultant specializing in healthcare regulatory compliance and operations improvement. She is also an advisory board member for BOH. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are those of the author and do not represent HCPro or ACDIS. Email your HIPAA questions to Associate Editor Nicole Votta at [email protected].

HCPro.com – Briefings on HIPAA

Reporting biopsies with ICD-10-PCS

By Shelley C. Safian, PhD, RHIA, CCS-P, COC, CPC-I, AHIMA-approved ICD-10-CM/PCS trainer

Biopsies are performed, most often, for diagnostic purposes. These procedures are done to obtain a sampling of cells or piece of tissue from the body that can then be pathologically analyzed. In ICD-10-PCS, a biopsy is not a biopsy.
 
Actually, there is no “biopsy” term available in this code set. ICD-10-PCS uses a variety of terms to describe these procedures, determined by what is actually done by the physician as explained by the Official Guidelines for Coding and Reporting 2016 guideline B3.4a: “Biopsy procedures are coded using the root operations Excision, Extraction, or Drainage and the qualifier Diagnostic.”
 
Fine-needle aspiration biopsy is reported with the root operative termDrainage (taking or letting out fluids and/or gases from a body part) in ICD-10-PCS. When you think about it, this is actually more specific and accurate, as the physician uses a thin needle to draw out–or drain–some fluid or gas to be used for testing.
 
For example, an amniocentesis would be reported with ICD-10-PCS code 10903ZU (Drainage of amniotic fluid, diagnostic from products of conception, percutaneous approach). Each of the characters making up the code would be:
  • 1, obstetrics
  • 0, pregnancy
  • 9, Drainage
  • 0, products of conception
  • 3, percutaneous approach
  • Z, no device
  • U, amniotic fluid, diagnostic
A lumbar puncture (spinal tap) would be reported with code 009Y3ZX (Drainage of lumbar spinal cord, percutaneous approach, diagnostic). Each character would be:
  • 0, medical and surgical section
  • 0, central nervous system
  • 9, Drainage
  • Y, lumbar spinal cord
  • 3, percutaneous approach
  • Z, no device
  • X, diagnostic
 
Core needle biopsy is reported with root operation Extraction (pulling or stripping out or off all or a portion of a body part by the use of force) because the physician uses a hollow needle, a bit larger than the needle used during a fine needle biopsy, to extract a cylindrical section of tissue to be analyzed.
 
For example for a bone marrow biopsy, the correct ICD-10-PCS code could be 07DR3ZX (Extraction of iliac bone marrow, percutaneous approach, diagnostic). The individual characters would be:
  • 0, medical and surgical section
  • 7, lymphatic and hemic system
  • D, Extraction
  • R, bone marrow, iliac, but it could also be Q for bone marrow, sternum, or S for bone marrow, vertebral
  • 3, percutaneous approach, though it could also be 0 for an open approach
  • Z, no device
  • X, diagnostic 
A punch biopsy of the skin could be reported with code 0JDD3ZX (Extraction of right upper arm subcutaneous tissue and fascia, percutaneous approach). The individual characters would be:
  • 0, medical and surgical section
  • J, subcutaneous tissue and fascia
  • D, Extraction
  • D, subcutaneous tissue and fascia, upper arm or various other characters for other specific anatomical sites
  • 3, percutaneous approach or potentially reported with 0 for Open
  • Z, no device
  • Z, diagnostic
 
Excisional and incisional biopsies are reported as an Excision (cutting out or off, without replacement, a portion of a body part), whether a sampling of tissue or an entire tumor or abnormal area is taken during the procedure.
 
For example, a liver biopsy could be reported with code 0FB20ZX (Excision of left lobe liver, open approach, diagnostic). The individual characters are:
  • 0, medical and surgical section
  • F, hepatobiliary system and pancreas
  • B, Excision
  • 2, liver, left lobe
  • 0, open or 3 for percutaneous approach or 4 for percutaneous endoscopic
  • Z, no device
  • X, diagnostic
 
A scrotum biopsy would be reported with 0VB5XZX (Excision of scrotum, external approach, diagnostic). The characters are:
  • 0, medical and surgical section
  • V, male reproductive system
  • B, Excision
  • 5, scrotum
  • X, external
  • Z, no device
  • X, diagnostic
Endoscopic biopsyis reported with the same root operation, Excision, however, coders will explain this circumstance with the appropriate approach–the fifth character: percutaneous endoscopic (4) or via natural or artificial opening endoscopic (8).
 
A natural or artificial opening endoscopic is defined as entry of instrumentation through a natural or artificial external opening to reach and visualize the site of the procedure.
 
For example, a cystoscopy with biopsy would be reported with 0TBB8ZX (Excision of bladder, via natural or artificial opening endoscopic, diagnostic), depending on approach. The individual characters are:
  • 0, medical and surgical section
  • T, urinary system
  • B, Excision
  • B, bladder
  • 8, via natural or artificial opening endoscopic
  • Z, no device
  • X, diagnostic
 
A stomach biopsy is reported with 0DB68ZX (Excision of stomach, via natural or artificial opening endoscopic, diagnostic), depending on approach. The individual characters are:
  • 0, medical and surgical section
  • D, gastrointestinal system
  • B, Excision
  • 6, stomach
  • 8, via natural or artificial opening endoscopic
  • Z, no device
  • X, diagnostic
At times, the biopsy may be done and analyzed and directly followed by a more extensive procedure during the same encounter or session. The Official Guidelines for Coding and Reporting 2016 explain in section B3.4b that both should be reported (separately).
 
For example, a physician performs a lumpectomy of the right breast followed by mastectomy during the same session. Coders should report codes 0HBT3ZX (Excision of right breast, percutaneous approach, diagnostic) and 0HTT0ZZ (Resection of right breast, open approach). The individual characters for these respective codes are:
  • 0, medical and surgical section
  • H, skin and breast
  • B, Excision
  • T, breast, right
  • 3, percutaneous
  • Z, no device
  • X, diagnostic
And:
  • 0, medical and surgical section
  • H, skin and breast
  • T, Resection
  • T, breast, right
  • 0, open
  • Z, no device
  • Z, no qualifier
Editor’s note: Safian, of Safian Communications Services in Orlando, Florida, is a senior assistant professor who teaches medical billing and insurance coding at Herzing University Online in Milwaukee. Email her at [email protected].
 

HCPro.com – JustCoding News: Inpatient

Billing Alert for Long-Term Care, June 2015

Star razing: Providers face quality rating dips after system recalibration

Note: For more recent coverage of the Nursing Home Compare star rating system, see the November 2014 and January 2015 issues of PPS Alert for Long-Term Care.

 

On February 12, CMS announced the dawn of Nursing Home Compare 3.0, a version update marked by a major recalibration of the popular consumer search site’s five-star quality rating system. When the agency debuted the retooled feature just one week later, almost a third of nursing homes had shed at least one star from their overall rating?a change that some provider advocates say baffled industry business partners and consumers alike.

"What we’ve heard is confusion," says David Gifford, MD, senior vice president of quality and regulatory affairs at the American Health Care Association (AHCA), a national trade association for long-term care providers. "The public’s asking, ‘Why did you lose a star?’ "

 

Recalibration rundown

The five-star rating system scores a given nursing home in three domains, the general characteristics of which were preserved during the recalibration:

1.Quality measures (QM) pulled from MDS documentation completed by the facility.

2.Staffing levels identified in a form completed by the facility during its annual state inspection. The rating in this domain is calculated based on scores in two subcategories: 1) the number of hours RNs have worked per resident day in the two-week period leading up to the survey, and 2) the total number of hours worked by RNs, licensed practical nurses, CNAs, and physical therapists within the same time frame.

3.Health inspection reports that detail the facility’s performance on the latest three annual surveys, as well as the outcomes of any complaint investigations conducted within that time frame.

 

The methodology CMS uses to translate these individual component scores into a facility’s overall rating was also spared in the February calculation updates: The health ­inspection component?the only rating domain that doesn’t hinge on data submitted directly by a facility?still serves as the bedrock of the score. From there, one star can be added or subtracted based on the staffing component. The same goes for the quality measure score.

The recalibration instead targeted the two so-called self-reported categories, weeding the field of top performers in these arenas by:

1.Increasing the difficulty of achieving a staffing rating of four stars, which now requires nursing homes to earn four stars in either the RN or total staffing subcategory.

2.Ratcheting up the number of points necessary to earn a QM rating of two or more stars?a move that significantly redistributed providers along the rating scale. CMS reports that since the recalibration, the number of nursing homes with four- or five-star QM ratings has plunged from about 80% to 49%, while the number of facilities with one star in this arena has climbed from 8.5% to 13%. In total, ­Gifford says a staggering two-thirds of providers experienced a change in their QM score.

3.Incorporating two antipsychotic measures that have long been reported on Nursing Home Compare (one targeting rates of use among short-stay residents, the other aimed at their long-stay counterparts) into QM scoring methodology.

 

In addition to kindling major rating changes in the quality and staffing domains, the February shake-up also tided a shift of up to two stars in facilities’ overall ratings.

According to AHCA, overall score changes that can be wholly attributed to the quality and staffing calculation updates are as follows:

  • About 29% of providers lost one star
  • 2% lost two stars
  • Less than 1% gained a star

 

Note: These statistics don’t account for the additional star shifts experienced in February by some providers whose health inspection data was updated at the time of the recalibration.

 

Curbing the ratings creep

The recent recalibration builds on the controversy that has embroiled the star system since the New York Times published its August 2014 exposé claiming the ratings’ reliance on self-reported measures enabled facilities to game the system. This position, the author and some consumer advocacy groups say, is backed by the steep climb of top-ranked facilities over the years (a climb that the new calibration has since stemmed).

But providers and their advocates bristled at these charges, instead attributing the influx of four- and five-star ratings seen prior to the recalibration to the industry’s fierce commitment to improving care delivery.

Although stakeholder factions are still contesting the primary drivers of the historic ratings creep, it’s undeniable that, with calculation methodology left largely unchecked in the six-year expanse between the advent of the star system and its February recalibration, ratings had trended upward.

When the five-star system was first inaugurated in December 2008, the number of top and bottom ratings awarded in a given category hovered within a few percentage points of their counterparts in the other two domains. However, between 2009 and 2013, the volume of nursing homes with an overall rating of five stars jumped more than 10%, while the number of facilities with one star fell more than 11%.

Because the health inspection rating is calculated using a state-specific fixed distribution (with five stars awarded to the top 10% of facilities, one star granted to the bottom 20% of performers, and the remaining star counts doled out in equal shares among the middle 70%), the skyward trajectory of the overall ratings can be traced exclusively to hikes in staffing and quality scores over the years.

Between 2009 and 2013, the proportion of four- and five-star ratings in the staffing domain increased about 13%, while these ratings soared almost 33% in the quality arena, according to data released by CMS contractor Abt Associates.

"We’ve seen the number of high five-star rated buildings increase, increase, increase," says Thomas Martin, senior research analyst at PointRight Inc., a healthcare analytics consulting firm in Cambridge, Massachusetts. "We were moving toward almost half of the industry being a five star in the quality domain."

These disproportionate leaps in QM scores shook many stakeholders’ trust in the system, according to Richard J. Mollot, executive director at the Long Term Care Community Coalition (LTCCC), a New York City?based advocacy group for elders and people with disabilities.

"It got to the point where it was hard to pay any attention at all to the quality measures," Mollot explains, recalling the site profiles of facilities with one-star ratings in the inspection and staffing categories and a five-star QM score. "It was just kind of bizarre."

Although most stakeholders seem to acknowledge that the spiraling ratings needed to be reined in, provider advocates worry that the steep drop-offs triggered by CMS’ drastic response will sully the reputations of well-performing facilities and ignite unintended operational consequences.

Nursing Home Compare was launched in 1998?and augmented by the five-star system a decade later?to facilitate consumers’ searches for facilities that best fit their specific care needs. But today, the reach of the site extends well beyond these original bounds. Far-flung entities (e.g., accountable care organizations, managed care plans, liability insurance carriers, and the U.S. Department of Housing and Urban Development) have appropriated the star ratings to determine facilities’ business worth, and consequently, Gifford says some providers have fielded calls from these stakeholders inquiring about sudden rating drops.

"It looks like . . . industrywide, nursing home practices have suddenly dipped and quality has decreased, but that’s not really the case," adds Martin.

 

Stakeholders support antipsychotics crackdown

Although Gifford decries the aggressiveness and abruptness of CMS’ score rebasing, he says AHCA backs the agency’s inclusion of antipsychotic measures in QM calculations?a decision that speaks to the growing precedence of this focus in the healthcare realm.

As Americans are living longer with more complex conditions, and nursing homes have consequently experienced an influx of residents with dementia, regulatory efforts to quell the use of antipsychotics are gaining momentum.

"Antipsychotic drugging . . . is, I think, one of the most important issues that we’re looking at today," ­Mollot says. "It’s emblematic of care in general for a lot of facilities in terms of . . . how staff are trained to meet the needs of their residents."

Although providers have already made significant strides in this domain, CMS and patient-centered groups like LTCCC say there’s a lot of work left to do.

For example, though the industry managed to whittle usage of antipsychotics by 15% between calendar years (CY) 2011 and 2013, CMS hopes to double this statistic by the end of CY 2016. And despite current progress, LTCCC reports that roughly 20% of residents nationwide were still on antipsychotic drugs in December 2014.

Because many providers focus on boosting ratings to attract prospective clients and business partners, Mollot thinks CMS’ decision to integrate antipsychotic use into rating calculations will fuel more necessary improvements in this arena.

Despite garnering support from provider and consumer advocates, the new QM measures left some participants in a February open door forum wary about the then-impending rating system updates. A couple callers voiced concerns that the incorporation of the short stay antipsychotic usage measure would penalize nursing homes for drugs prescribed to residents during prior stays at the hospital. One participant worried the new spotlight on antipsychotics would misrepresent her facility’s usage of the drugs among its unique population of residents with severe mental health issues.

 

Star striking justified, but too abrupt

Despite generally favorable receptions of the antipsychotic measure additions to QM ratings, some provider advocates had championed a much more graduated approach to getting the star system up to speed. For example, Gifford recounts AHCA’s suggestion to bump up the cutoff score needed to qualify for a given star count (called a cut point by CMS) on a quarterly basis, adding that he hopes CMS will still adopt such a method for the subsequent rounds of rating updates the agency already has in the pipeline.

"Each time they add new measures, if they’re going to rebase [ratings], that’s just going to add more confusion," Gifford explains. "I think there’s a better way that hopefully they’ll consider next time going forward."

He adds that employing an incremental method to adjust star cut points and calculations would also benefit the intended users of Nursing Home Compare, who would be able to make more meaningful judgments about a facility’s succession of star ratings?an ability Gifford says would be hampered by future iterations of this year’s recalibration, which rendered providers’ ratings between January and February incongruous.

"Rebasing this every couple years [would mean] that all prior ratings have no meaning compared to the new ratings," Gifford explains.

But while providers and their backers believe February’s jarring rating updates could malign nursing homes’ performance, consumer advocates say the rampant score inflation prior to the recalibration also misled consumers. "[The rating system] really wasn’t fair before for consumers," says Mollot. "You’re seeing a much more accurate rating now."

For this reason, Mollot finds many of the attempts he’s seen throughout the industry to characterize lowered ratings as mere byproducts of CMS’ more stringent calculation methodology too reductive. Instead, he urges providers to consider the full context of the agency’s decision to carry out the rating overhauls and reflect on whether star losses reveal any gaps in current care practices.

"If providers are thinking about [the recalibration] in a constructive way, that will be really useful to them in terms of the quality of care overall in the facility and . . . in terms of customer satisfaction, too," Mollot says. "The more accurate the information is, the more useful it will be for the nursing home[s] . . . to improve their care, and that’s really what we all want."

Despite the growth opportunities he thinks the recalibration presents, Mollot acknowledges the importance of explaining to alarmed clients that it is also the direct impetus of some sudden rating reductions.

But Martin thinks this feat may be easier said than done, given the minutiae of the rating calculation methodology. He recommends underscoring that the changes reflect higher expectations from CMS, rather than newfound performance lapses on the facility’s end.

"The five-star methodology has raised the bar," he says. "[CMS’] grading criteria has gotten more difficult, even though the facility didn’t necessarily take a dip in quality."

In addition, Gifford suggests trying out the language CMS posted on Nursing Home Compare post-recalibration to highlight the lack of comparability between QM scores introduced in January and their immediate predecessors.

"Many nursing homes will see a lower quality measure rating as a result of these changes, even though the underlying QM data may not have changed," CMS recently wrote on the "How we calculate ratings" page of the site. "Because of these changes, it is not appropriate to compare a facility’s QM ratings that appear in February with those that appeared in earlier months."

Mollot says anticipating tough questions from clients is a best practice that should extend beyond the scope of recalibration fallouts. For example, if a surveyor identifies a deficiency during an annual inspection, a provider should brace for queries about what its staff are doing to address the issue?and have a corrective plan in place to ensure the prepared answer is more than lip service.

 

Catch falling stars

In addition to strategically educating concerned clients on rating changes carried by the recalibration, Mollot and Gifford urge providers to use the revised scoring methodology as a tool to identify their facility’s specific hot spots and guide targeted quality improvement efforts.

Gifford recommends consulting the latest version of the rating system user’s guide, which CMS updated in February to reflect the new quality and staffing star cut points ushered in by the recalibration.

"One of the nice things in the changes is CMS actually provided the rates on each of the quality measures that you need to achieve a better score," says Gifford. "We’ve been encouraging members to look at those rates related to the points and figure out how much better they have to get on which measures to improve their score."

Martin echoes this recommendation, stressing the importance of determining a given facility’s proximity to the next star count in each domain.

"If you just understood where those cut points were and how close you were, you could get a feel for what you need to do to improve," he explains. "You might be one hour of nursing time away from the next star."

Because of the heightened emphasis on reducing antipsychotic drug usage, Mollot also recommends strengthening dementia care practices?a move he says doesn’t necessarily demand major resource expenditures or new hires. Sometimes, he says, a simple change in approach?such as delaying a distressed resident’s scheduled bath?is all it takes to overcome the use of chemical restraints and recoup time traditionally spent subduing difficult behaviors. This refocusing can allow staff to dedicate additional efforts to other facility needs and, in turn, boost star ratings.

"Providers who are moving to provide better dementia care will see benefits, and hopefully that will incentivize others as well," Mollot says.

Once nursing homes pinpoint their performance gaps and growth opportunities, Gifford suggests turning to national initiatives (e.g., the one developed by AHCA) or established quality improvement programs (e.g., the Baldrige Performance Excellence Program) for frameworks to transform performance goals into operational realities.

 

More changes on the horizon

Although providers may still be seeing stars after the February recalibration, CMS is far from done with its overhauls to the rating system.

In particular, experts are keenly anticipating the agency’s deployment of an electronic reporting system that will both cull staffing numbers from a nursing home’s payroll records and report this data on a quarterly basis, ultimately transforming it into star ratings, Mollot says. CMS recently announced that it intends to collect data through the system on a voluntary basis beginning October 1, 2015, and to mandate the industry’s nationwide reporting in this manner beginning July 1, 2016.

Gifford says CMS is also readying a handful of new staffing and quality measures for integration into star calculations in the not-so-distant future, including rates of turnover, retention, rehospitalization, and discharge to the community?prospects about which he is cautiously optimistic.

For his part, Mollot would like to see CMS regularly update criteria and refine calculation methodologies across all rating categories to undercut what he calls the tendency of some industry players to "teach to the test" by applying quick-fix strategies to bump up ratings rather than launching genuine quality improvement initiatives.

As CMS continues to flesh out the criteria within each rating domain, Gifford hopes the agency will find a way to continue representing the entire spectrum of insurers weighed in today’s ratings. Although current scores reflect all residents, regardless of their payer type, the proposed rehospitalization and discharge to community measures could be based on claims data that isn’t collected for all coverage plans.

"If this information is going to be used for [consumer] choice, it should reflect the full panel of individuals who are cared for by a provider," Gifford explains.

But despite stakeholders’ misgivings, Mollot stresses that the revamped rating system is an important tool for the nursing home community. "Nursing Home Compare, even with its imperfections, is by far the most valuable resource for people in terms of choosing a nursing home," he explains. "Capturing quality in an accurate way . . . is an important thing, and I think that benefits the good providers, as well as consumers."

 

Stakeholders take NOTICE of mounting ­observation status reform legislation

In mid-March, the U.S. House of Representatives unanimously approved the Notice of Observation Treatment and Implication for Care Eligibility ­(NOTICE) Act (H.R. 876). As a result, the bill is now poised to become the first to gain legal standing among a collection of proposed legislation aimed at remedying today’s fallout from observation status.

Reforming this outpatient designation?which leaves affected Medicare beneficiaries eligible only for Part B coverage?has drawn support from an unlikely assemblage of healthcare stakeholders in the acute, postacute, and beneficiary advocacy spheres.

"We’ve been working very closely with a very broad coalition of groups around [observation status], and it’s a coalition of groups where sometimes we’re on different sides of issues, but as it pertains to this issue, we’ve been completely and totally united," says Clifton J. Porter II, senior vice president of government relations at the American Health Care Association, a national trade association for long-term care providers.

The reason behind this widespread traction: Today’s heavy-handed application of observation status is having devastating effects on those in acute and postacute settings. The designation often disrupts a beneficiary’s eligibility for Medicare coverage in SNFs following a hospital stay, sparking patient confusion and potentially narrowing the client pool for long-term care providers.

In addition, the outpatient designation severely limits Medicare coverage in the hospital itself, ­slapping beneficiaries with a copayment for each individual service rendered during an observation stay instead of the one-time deductible granted during the Part A inpatient alternative. In addition, patients are expected to pay for prescription charges that accumulate during an observation stay.

Because of these potential liabilities, observation status has traditionally been reserved for patients who undergo brief hospital stints, during which time clinicians are charged with assessing whether they are ill enough to warrant inpatient admission or well enough to return home. However, as Recovery Auditors (RA) have ramped up scrutiny on the appropriateness of inpatient stay determinations, hospitalists have become much more liberal in their use of observation status, applying it to stays as long as a week, says Diane Brown, BA, CPRA, director of postacute education at HCPro, a division of BLR, in Danvers, Massachusetts. She underscores the huge impact on beneficiaries, many of whom are left in the dark about their outpatient status and its ramifications until long after their stay has ended.

"The beneficiaries who weren’t aware that they hadn’t been officially admitted come out of the hospital, and then they get whacked with a bill," says Brown.

And underlying the recent outcrop of beneficiaries under observation is a flawed foundational concept that fails to account for the clinical services provided in the hospital, says Ann M. Sheehy, MD, MS, associate professor and division head of hospital medicine at the University of Wisconsin School of Medicine and Public Health.

"We can deliver the same exact care to two patients that are in the beds next to each other?one is observation, one is inpatient?for three nights, and the inpatient gets to go to a nursing home and have the Medicare coverage; the outpatient does not," she explains. "That’s just really hard to swallow."

 

Flying under RA radars

Observation status has been a provision of the Medicare benefit since the program’s inception in 1965, but healthcare providers attribute the backlash facing beneficiaries today to the instatement of the nationwide Recovery Audit Contractor Program (now known simply as the Recovery Audit Program) nearly half a century later.

RAs are charged with combating reported instances of fraud and abuse throughout the healthcare system by detecting and recouping improper payments, such as those for noncovered, incorrectly coded, and duplicative services. However, because RAs are paid on a contingency basis, healthcare providers argue there’s a financial incentive for them to target practices that will yield the biggest monetary reward while providing the least grounds for contest, a strategy that Brown says has inspired them to take a hard line on regulations with obvious gray areas, like observation status.

"If you’re going to be paid that way . . . you want to find the low-hanging fruit," says Brown. "[Observation status is] a broad-based rule . . . and unless you have a lot of concrete examples to support a broad-based rule, nobody knows how it really works, and so the RAs took advantage of that."

Since CMS began phasing in the national RA program as directed by the Tax Relief and Health Care Law of 2006, the prevalence of observation status designation has soared. According to a March 2014 report by the Medicare Payment Advisory Commission, the number of outpatient observation claims increased 88% between 2006 and 2012?a trend that runs counter to financial motivation for hospitals, which are paid less for care delivered to a patient under observation than for that provided during an inpatient stay, even if the services are equivalent in both cases.

For their part, RAs deny responsibility for the climb. ­After a July 2014 Senate hearing that addressed observation status, the American Coalition for Healthcare Claims Integrity, an RA trade association, issued a statement stressing that the contractors audit less than 2% of Medicare records from any given provider and only focus on CMS-approved billing hot spots.

"While our coalition agrees that the use of observation status has evolved from its initial intent and administrators should work to clarify these payment policies, the suggestion that the Recovery Audit Contractor (RAC) program has caused this issue is false," Becky Reeves, spokesperson for the group, said in the statement.

But this alleged audit rate of less than 2% doesn’t hold for providers across the board, according to Sheehy, who points to a recent study she led that found RAs performed complex Part A audits on 8% of the total inpatient encounters had by three academic hospitals from 2010 to 2013. Complex reviews, as opposed to their automated or semi-automated counterparts, produce the vast majority of RA recoupments.

Regardless of disputes over the reasons behind observation status spikes, CMS introduced the two-midnight rule in 2013 in an effort to curtail them. Through the provision, the agency sought to clarify that hospitals can consider beneficiaries whose stays are expected to last at least two nights inpatients without the fear of RA review. But enforcement of the rule has been repeatedly delayed since its introduction, lambasted by hospitals as arbitrary, reductive, and potentially punitive toward innovations used to reduce lengths of stay.

Because many healthcare providers maintain that hikes in observation status are tied to RA scrutiny, Sheehy thinks major reform in both domains is necessary to make progress throughout the industry.

To that end, CMS and a couple of its RA contractors are currently locked in disputes over the terms of new contracts, which propose revisions to the way RAs are paid?a possible effort by CMS to discourage faulty recoupment of payments and to unclog RA decision appeal logjams.

SNF implications

Although hospitals are at the heart of the observation status crisis, those in the postacute sector are also feeling the fallout. SNFs are often the next stop for recently hospitalized patients whose stays have been deemed observation, such as those who will require short-term intensive therapy services after a medical illness. But days spent under observation don’t count toward the three consecutive days a beneficiary must remain in the hospital before Medicare coverage for subsequent nursing home care kicks in?a rule that is itself contentious. Some say the requirement flies in the face of continuum-wide pushes to return beneficiaries to the community as often and as quickly as possible.

"The reality is that the sooner a patient is out of the hospital, the better," says Porter. "Requiring a patient to be in a hospital for three days before they can access a benefit that gets them out of the hospital and ultimately on their way home seems a bit archaic to me."

And now that the requirement is increasingly tangled with observation stays, more and more patients are disqualified from SNF coverage, forcing them to choose between paying for rehabilitation services entirely out of pocket and jeopardizing their recovery by forgoing the follow-up care deemed necessary by their doctors.

Sheehy recalls the first time she witnessed the detrimental effects of such a decision. It was 2010, and she had just treated a woman who had stayed three nights in the hospital following a recent cancer diagnosis. At the time of discharge, Sheehy decided to order nursing home services for the patient, who was weak and dehydrated. But when Sheehy informed her case manager of this plan, she was told that the patient?a longtime Medicare contributor?would have to pay the cost in full because she had been under observation during her entire stay.

"All she should have had to do was worry about getting better," says Sheehy. "Now she was worried about her bill and how she was going to take care of herself at home because she didn’t have the resources to pay for a nursing home on her own."

But not all patients are granted even this modicum of warning that subsequent services won’t be covered?a shortfall that saddles SNF providers with the task of verifying the hospital admission status of prospective clients and communicating bad news to those whose nursing home stay wouldn’t be covered by Medicare.

Brown says hospitals sometimes compound this burden by retrospectively deciding to tag a stay as observation, potentially leaving nursing home providers as blindsided as residents come billing time.

 

The NOTICE Act only sets stage for reform

These knowledge gaps are precisely what theNOTICE Act targets. The bill would amend the Social Security Act with a provision requiring hospitals to provide oral and written notice to patients placed under observation for more than 24 hours, the reason for this designation, and its implications for service coverage within 36 hours of the classification, or, if the stay is shorter, upon discharge.

Advocates say the bill is an important move toward empowering beneficiaries to make informed decisions about their healthcare.

"They deserve to know [their status] in the hospital, so I think this transparency measure is a very good one," says Sheehy, though she adds that the bill would also increase pressure on hospital employees, who would be expected to create, supply, and test comprehension of additional paperwork, thereby upholding a regulation that doesn’t sit we

HCPro.com – Billing Alert for Long-Term Care

Credentialing & Peer Review Legal Insider, October 2016

Interstate Medical Licensure Compact Commission proposes licensure process

The medical licensing tool aimed at expediting the process through which physicians can obtain licenses to practice in multiple states is one step closer to becoming a reality as more details of the process come into focus. Once it’s up and running, the Interstate Medical Licensure Compact will allow physicians licensed in one participating state to gain licensure in other participating states without having to repeat the entire licensing process in each state.

The Interstate Medical Licensure Compact Commission, which is responsible for the compact’s governing rules and administration, recently released a proposed process for expedited licensure through the compact and opened the period for public comments. The commission will consider the proposed rule at its meeting in early October.

 

The expedited licensure process

The basic process is the same as the one outlined in model legislation released two years ago, says Ian Marquand, chair of the Interstate Medical Licensure Compact Commission. Under the newly proposed process, a physician applies for expedited licensure via the compact through the state where he or she claims principal licensure. The state of principal licensure is where the physician resides, practices, is employed, or files a federal tax return.

"The physician will have to provide some information so that we can make sure that state is legitimately the state of principal license. A physician can’t willy-nilly pick a state in the compact," Marquand says. The applying physician will also have to pay the commission a service fee and submit to a criminal background check through a law enforcement agency, including providing fingerprints or other biometric data.

"There are no heavy applications at this point. The point of this is to make it much easier for a physician to get licensed in additional states and for much less time and energy expended," he says.

The principal licensure state would then review the applicant’s qualifications to determine if he or she is eligible for expedited licensure, perform a criminal background check, and issue a letter to the applicant and the compact commission verifying or denying the physician’s eligibility. Once the applicant receives that letter, he or she can then select from which member states to request expedited licensure and pay those states’ licensure fees. The relevant member boards would then issue full and unrestricted licenses to the applicant. Those licenses would be valid for as long as any other full and unrestricted license normally issued by that state board.

 

Application turnaround time

There is not a set amount of time to process the application for licensure through the compact due to several variables, Marquand says. These variables include how quickly the physician goes to a law enforcement agency to get fingerprinted, the amount of time necessary to complete the criminal background check and deliver the results to the medical board at the state of principal licensure, and how long it takes that state of principal licensure to review the criminal background check and the applicant’s other details (e.g., board certification and medical education).

A few test runs of the process have been performed in Marquand’s home state of Montana. "We find that it only really takes a matter of hours but it’s not the only thing our people have to do. So where it falls in the queue depends on how long it’s going to take for our people to actually get to do the work. That’s a variable. The communication between a state of principal license to compact commission and then compact commission to receiving state, I don’t think those should take very long at all."

In contrast, the applicant’s responsiveness will be a factor in the turnaround time. Marquand provides a hypothetical scenario to illustrate this point: Dr. Smith, whose state of principal licensure is Montana, applies for licensure in three additional states through the commission. He is prompt about providing his fingerprints and submitting to the criminal background check, which allows the staff in Montana to process his application fairly quickly. In a matter of days Dr. Smith is certified by the commission but then puts off paying the licensure fees.

"We can’t do anything until the fees have been paid. So if the physician is slow about paying fees, that’s on them, not on us," Marquand says. "But once the fees are paid and delivered to the receiving states, we don’t expect [the states] to take very long in issuing the license."

To help motivate physicians to stay on track with their applications, the proposed rule sets a 60-day limit for the applicant to submit all requested materials.

"With every application in the professional licensing world, there’s an expiration date on the application. It doesn’t sit there forever waiting for you to finish. If you don’t get it done, it expires. Putting a 60-day limit on that seems pretty reasonable to me," he says.

Returning to the example of Dr. Smith, Marquand says if the physician applies through the compact commission, pays the initial processing fee but then doesn’t have his fingerprints taken and is unresponsive to the commission’s requests for information for more than 60 days, the application is withdrawn.

"It put some onus on the physician to take some action. But will it take 60 days for processing? No, that’s just the time we give the physician to get any information that we need. But I can’t imagine that happening very often, if at all." Marquand says.

Once a physician is certified through the commission, that certification is valid for one year. This means that if Dr. Smith initially selects one compact state for licensure, such as Wyoming, and then decides six months later that he wants a license for Idaho as well, he will not have to reapply, Marquand says. Dr. Smith will simply need to inform his state of principal licensure?Montana?that he’d like to practice Idaho. The board in Montana will notify the commission and then Idaho will issue the license fairly quickly.

"The only thing that would preclude that would be if Dr. Smith gets in trouble with either the Montana or the Wyoming board and his license is suspended. Then his compact eligibility goes out the window," he says.

When a physician’s license is suspended, it is the responsibility of the member state in which the disciplinary action occurred to notify the commission, which in turn, would notify all the states in the compact. At that point, it would be up to each individual state to decide what to do.

"It’s presumed that reciprocal discipline will happen very quickly. So if Dr. Smith gets in trouble in Wyoming, Wyoming reports him to the commission and Montana would probably take very swift action to suspend his license there, Marquand says. "And if he’s licensed anywhere else in the compact, those states would have the option of doing the same. We want to at least make it possible for very swift action in all the states.

He adds that there are circumstances where reciprocal discipline is automatic, such as when a license from a state of principal licensure is revoked, suspended, or surrendered. In such cases, states can change that automatic action to something else, if they choose. So while states would have some discretion, it may come after an initial action.

Physicians who retain clean records and maintain their qualifications would be able to obtain licenses in as many compact states as they want within a year of achieving certification from the commission, as long as they’re willing to pay the fees.

 

Work to be done

Some details of this process have yet to be finalized. For example, the amount of the commission’s processing fee has yet to be determined. The commission will likely take up this issue by the end of the year.

"Each individual state within the compact also needs to have its own discussion of whether it wants to charge an application fee to cover the cost of reviewing the physician’s qualifications," Marquand says. In Montana there is a proposal put forth for a $ 100 fee. That proposal still needs to go through a public comment period and receive final approval from the state medical board.

After considering the provisions of the proposed rule, the commission will have several options: Adopt the rule as-is, adopt it with amendments, send it back to the committee for more work, or scrap it completely.

"I’m certainly optimistic that the commission will adopt these. And whether there are any changes suggested to them through comments, we’ll deal with them. I think the commission is anxious to get these rules in place and move on to the next topic," Marquand says.

If the commission decides that the proposal requires significant changes, the rule could be brought back to the commission as early as December.

Work on the application portal for expedited licensure is also underway but an open date has not been announced, Marquand says. However, the commission has set January 2017 as the target date for the first licenses to be issued by a member state using the compact process.

To assist with all the work that remains to be done, the U.S. Health Resources and Services Administration (HRSA) recently announced a $ 250,000 annual grant for three years to help the commission get up and running. The grant, which was requested by the Federation of State Medical Board, underwrites the cost of the commission.

"That takes a huge load off on us as commissioners. We know that through that grant there will be money available to cover technical costs, meeting costs, and maybe even staff costs for the next three years," Marquand says. He forecasts that after the three years, the commission should be able to stand on its own financially and operate on the service fees it collects.

 

Telemedicine

Often the Interstate Medical Licensure Compact is discussed in the same breath as telemedicine but Marquand emphasizes the distinction between the two. The compact relates exclusively to licensing and therefore does not provide any rules, regulations, or even any guidelines on the use of telemedicine. Although physicians or health organizations may want to use it to allow their own practice or corporate practice to expand into more states, they will still need to follow the regulations of those states once licensed.

"I understand that there may be benefits of the compact for physicians who want to do telemedicine in more places, but that’s not specifically why the compact exists. The compact exists for licensed physicians to get licenses in other states quickly and efficiently, regardless of what kind of practice they want to do," Marquand says.

He recalls this topic came up at a press event in Washington, D.C., designed to promote the compact to members of Congress and major healthcare organizations. When the question was posed of who would be the major user of the compact?large healthcare organizations that want to use telemedicine, or individual physicians who want to expand a practice across state lines either in person or by telemedicine?the answer that came back was it would likely be both.

"Here’s how I look at this: Think of two parallel highways. On one, there are physicians using telemedicine. The compact is on the other, with ramps between them," he explains. "The folks on the telemedicine highway may take a ramp over to the compact highway to get additional licensure, but then they’ll get back on the telemedicine highway."

 

Moving forward

As this issue of CPRLI went to print, 17 states have enacted compact legislation and nine others have introduced it. Marquand is optimistic more will adopt legislation.

"There are a couple that haven’t quite got to the finish line and we understand there are going to be states that are on the sidelines, waiting to see what the commission does and see how the compact really works," he says.

That’s why Marquand says the work the commission is doing to get the compact up and running is so important. The successful operation of the compact will be the commission’s biggest promotional tool for convincing additional states to participate. The hope is to bolster the case for joining once the commission has concrete figures on time frames and the number of licenses issued.

Protecting your facility from successful plaintiff litigation

Identifying red flags within credentialing applications can be the first step to protecting yourself and your facility from a successful plaintiff litigation. In the on-demand webcast, Negligent Credentialing: Best Practices to Prevent Successful Plaintiff Litigation, expert Mark A. Smith, MD, MBA, FACS, discusses ways to recognize issues within a credentialing application that require immediate action or additional questioning. Smith also provides best practices an organization should adopt to prevent credentialing-based lawsuits.

At the end of this on-demand program, participants will be able to:

Identify at least three red flags in credentialing applications that require action or explanation

Know what a negligent credentialing claim entails

Assemble the necessary documentation to help combat negligent credentialing

 

For more information or to order this webcast on demand, visit http://hcmarketplace.com/negligent-credentialing-best-practices-to-prevent-successful-plaintiff-litigation.

 

 

OCR ramps up HIPAA enforcement efforts

The Office for Civil Rights (OCR) stepped up HIPAA enforcement in a big way this year. The agency handed down more than $ 5 million in HIPAA settlement fines in one week in March, and in July reached a HIPAA violation settlement with Advocate Health Care in Illinois that carried a $ 5.55 million payment. OCR kicked off phase two of its HIPAA Audit Program and will likely complete desk audits of covered entities (CE) and business associates (BA) by the end of the year. Comprehensive on-site audits may occur early in 2017.

However, breaches continue to come at a relentless pace and questions have arisen about OCR’s handling of HIPAA violations, particularly repeat HIPAA offenders. And a truly permanent HIPAA audit program may not yet be in sight: OCR states that phase two audits will help the agency plan for a permanent audit program but doesn’t state when that might launch.

In a September 2015 report (https://oig.hhs.gov/oei/reports/oei-09-10-00510.pdf), the Office of Inspector General (OIG) said OCR?and the U.S. Department of Health and Human Services (HHS) as a whole?should strengthen its oversight of CEs and be proactive rather than reactive in its approach to HIPAA enforcement. The report found that in 26% of closed privacy cases, OCR did not have complete documentation of corrective actions taken by CEs. In addition, OCR’s case tracking system has significant limitations and makes it difficult for the agency’s staff to check if a CE under investigation has been the subject of previous investigations.

All of this may make some CEs and BAs feel that HIPAA compliance is merely optional, and that leads to a weaker privacy and security culture throughout the industry. Although OCR does take action to make its presence felt, it could do more, Frank Ruelas, MBA, principal of HIPAA College in Casa Grande, Arizona, says.

"I do believe that OCR is trying to let people know that it considers HIPAA compliance an important objective," he says. "With its guidance and ongoing alerts about the occasional enforcement actions here and there, I see OCR’s enforcement a small step above being a paper tiger in terms of how seriously people take it."

The waiting game

The OIG’s September 2015 report wasn’t the first time that agency has found fault with HHS and OCR’s methods, Kate Borten, CISSP, CISM, HCISSP, founder of The Marblehead Group in Marblehead, Massachusetts, says.

"OIG has published a number of reports over the years, identifying problems with HHS’ oversight and enforcement of these HIPAA rules," she says. "I know of no one in the profession who reads the OIG reports and disagrees."

But HHS and OCR have been slow to take action. More than five years passed between the end of phase one of the HIPAA Audit Program and the announcement of phase two, and OCR still has obligations it’s failed to fulfill. The agency’s slow pace may lead some to take it, and HIPAA, less seriously.

"Since the latest round of rule changes back in 2010, over six years ago, there are still outstanding rules and unmet commitments by HHS and OCR," Ruelas says. "In the end, it not only erodes credibility but also questions just how seriously is OCR taking its enforcement duties."

 

Another day, another fine

HHS and OCR regularly announce breach settlements, but 2016 saw a flurry of high-profile and costly settlements. OCR took the opportunity to make examples of a number of CEs and BAs in its statements, calling attention to the particular violations that tipped the settlements into the hundreds of thousands, or even millions, of dollars.

Although the settlements grab attention and headlines, it may be difficult to determine their positive impact. Some of the HIPAA violations in question date back years. Staff who worked at the organization, and may have been involved in the breach, are likely gone. Even administrators, executive leaders, and owners may change in that time. Some organizations may see OCR’s enforcement actions as too little, too late, Mac McMillan, FHIMSS, CISSM, cofounder and CEO of CynergisTek, Inc., in Austin, Texas, says.

"We all want the same thing: to see our industry do better," he says. "This is just more of the same old, same old. Same issues, different players."

A HIPAA settlement fine might be a crushing blow to a physician practice or small home health or physical therapy organization, but even the largest fines might not make an appreciable impact on larger organizations, McMillan says.

"To be really impactful, there will probably need to be more, they will need to happen closer to the actual event they’re related to, and possibly the fines will need to be bigger," he says. "The fines levied were really not substantial fiscally, and there was no accountability for those responsible for making security decisions, so they pay and move on."

Borten agrees that the long period of time between when a breach is reported and when OCR takes action lessens the impact. "The response or punishment must rapidly follow the event to have a significant impact on future behavior," she says.

Although some find California’s short breach notification timelines and black and white faxing rules burdensome, these measures have caused CEs and BAs to change their behavior and improved privacy and security, McMillan says.

Some CEs and BAs may be willing to take the chance they won’t be caught, Ruelas says. "I truly think that people see enforcement a lot like getting hit by lightning. However, if it does occur, it tends to be a game changer and does make for an interesting day."

But whether the change is meaningful or widespread may be difficult to determine, and any alteration to OCR’s HIPAA enforcement practices would likely be an improvement, he adds.

 

Learning from others’ mistakes

However, CEs and BAs can get something out of HIPAA settlements. Conscientious entities will fulfill the terms of the corrective action plan and even improve on it. And other CEs and BAs can take valuable lessons from OCR’s breach announcements. The agency often draws attention to specific issues that led to the breach, levies a pricey fine, and points out how the organization could have avoided the problem in the first place.

"HIPAA enforcement actions are important teaching tools," Borten says. "Workforce members can be asked if the same problem could arise in their organization, and how individuals can avoid the same fate."

Many privacy or security failures that lead to breaches are the result of human error and are still relevant regardless of when the breach occurred, she adds.

Although the security landscape has expanded beyond missing laptops and smartphones, Ruelas says there’s still a lot CEs and BAs can learn from these enforcement actions. Organizations may see ransomware, phishing, and privacy and security breaches on social media as the biggest threats?and rightly so. Yet many breaches still come down to 10-year-old HIPAA basics: misdirected faxes, incorrectly addressed emails, or handing the wrong documents to a patient.

 

While human error is still a concern, McMillan is most worried about the increasing number of breaches due to hacking, particularly the greater loss of data due to hacking and the effects such breaches have on the industry. "Human errors are still an issue, but the relative impact of those incidents compared to the impacts we see from hacking recently pales in comparison. Many of those attacks were the result of misconfigured or poor administration of systems resulting in serious outages and millions of lost records," McMillan says. "This is where OCR needs to focus attention."

 

Phase two

The launch of phase two of the HIPAA Audit Program may promise some positive change. The audits are intended to help the agency improve HIPAA guidance and tools and pinpoint common problems and challenges CEs and BAs face. Desk audits of CEs began in July, with BAs scheduled to follow in the fall. However, it may take 90 days after submitting documents for CEs to receive a draft audit report. Until then, it will be difficult to predict what OCR’s response to the audits might be.

The audit reports will not be made public, although OCR representatives indicated they will likely be available through a Freedom of Information Act request. Sharing some data might help CEs and BAs.

"I do think that if audit results can somehow be summarized and shared, just by their detailed nature, the audits can be wonderful sources of information for the HIPAA community," Ruelas says.

It took three years for the agency to update the audit protocols to reflect changes made by the HIPAA omnibus rule, he adds. It’s too soon to tell how long it might take the agency to revise or refocus its guidance based on the results of the phase two audits, but it would no doubt be beneficial for all CEs and BAs to see results sooner rather than later.

Establishing a permanent audit program is one of OCR’s responsibilities under HIPAA, and the agency’s failure to develop one has drawn criticism from the industry and from other regulatory agencies such as the OIG. OCR agreed with the OIG’s latest call for a permanent audit program. Phase two is an encouraging step in that direction, but still not quite enough.

"It has been very vocal on its commitment to establishing an effective and permanent auditing program," Ruelas says. "Let’s see if it really is going to walk the talk."

 

Legal and regulatory news roundup

Find out what’s happening in the world of federal healthcare regulations by reviewing some recent headlines from across the country.

 

EMTALA violations declining

The number of U.S. hospitals cited for violating the Emergency Medical Treatment and Active Labor Act (EMTALA) has decreased over a 10-year period, according to a study published in the Annals of Emergency Medicine. Researchers analyzed a list from CMS of EMTALA investigations conducted from 2005?2014 and found that the percentage of U.S. hospitals cited for violations citations decreased from 5.3% to 3.2%. The percentage of hospitals investigated also declined during this period from 10.8% to 7.2%.

EMTALA aims to prevent the practice of discharging or transferring patients to other hospitals before stabilizing treatment is provided for emergency medical conditions. It requires hospital emergency departments to provide medical screening examinations to patients seeking medical treatment regardless of their ability to pay, citizenship, or legal status.

 

Stark Law, EMTALA violation penalty amounts increase

Due to several years of inflation, the U.S. Department of Health and Human Services recently issued an interim final rule that calls for steeper maximum penalties for violating federal regulations, including EMTALA and the Stark Law.

For hospitals with more than 100 beds, the maximum penalty for an EMTALA violation is $ 103,139, up from the previous maximum of $ 50,000 set in 1987. For hospitals with less than 100 beds, the maximum penalty is $ 51,570, up from $ 25,000.

Circumventing the Stark Law’s self-referral restriction can now result in a maximum penalty of more than $ 159,000, up from previous maximum of $ 100,000 set in 1994. Submitting claims in violation of the Stark Law can result in a penalty of nearly $ 24,000, up from $ 15,000.

 

Home health agency owner sentenced for healthcare fraud, kickbacks

Khaled Elbeblawy, the former owner and manager of three home health agencies in the Miami area, will spend 20 years in prison for his role in a scheme that fraudulently billed Medicare for millions of dollars.

Elbeblawy was sentenced to prison and ordered to pay more than $ 36 million in restitutions following his conviction in January of one count of conspiracy to commit healthcare fraud and wire fraud and one count of conspiracy to defraud the United States and pay healthcare kickbacks. According to evidence presented at trial, from 2006?2013, Elbeblawy and his co-conspirators claimed to have provided medically necessary home health services to Medicare beneficiaries through the three agencies: Willsand Home Health Agency Inc., JEM Home Health Care LLC, and Healthy Choice Home Services Inc. In reality, those services were either medically unnecessary or never provided. The conspirators also paid kickbacks to physicians, patient recruiters, and staffing groups for referrals of beneficiaries.

In all, Elbeblawy and his co-conspirators submitted $ 57 million in false or fraudulent claims and received approximately $ 40 million in payments. In 2012, Eulises Escalona, a former owner of Willsand and JEM, pled guilty to one count of conspiracy to commit healthcare fraud and was sentenced to 10 years in prison. Cynthia Vilches, former co-owner of Healthy Choice, also pled guilty to one count of conspiracy to commit healthcare fraud and is awaiting sentencing.

Healthcare systems calls for dismissal of antitrust lawsuit

Carolinas HealthCare System (CHS) has argued that the joint antitrust lawsuit filed against it by the U.S. Justice Department and the North Carolina Attorney General’s office has no basis. According to the Charlotte Observer, the lawsuit alleges CHS uses its size to drive up prices to prevent competition. CHS operates 10 hospitals in the Charlotte area. Its closest competitor, Novant Health, operates five.

The lawsuit alleges CHS uses its clout to encourage health insurers to steer patients away from other lower-priced hospitals and toward CHS hospitals.

In asking for a dismissal, CHS has said the lawsuit has failed to allege any actual competitive harm to the marketplace.

Exciting updates: More content, tools, and news at your fingertips!

The challenges healthcare professionals tackle each day don’t wait for solutions, and neither should you. That’s why Credentialing & Peer Review Legal Insider (CPRLI) is transitioning to a more frequent and robust publishing model this fall by combining with the Credentialing Resource Center (CRC)’s flagship publication, Credentialing Resource Center Journal (CRCJ), to create a single source for all your credentialing, privileging, peer review, and legal news, tools, and best practice strategies.

Your updated member benefits gain you access to expanded content and tools on CRC?with new resources added weekly to the website (www.credential-ingresourcecenter.com). Plus, as a CRC member you gain instant access to over 300 clinical privilege white papers, core privileging forms, Medical Staff Talk, and Credentialing Resource Center Daily (CRCD), CRC’s daily e-newsletter for medical staff leaders and MSPs. If you are already a CRC member, you will continue to receive the news and analysis you’ve come to rely on, plus expanded member benefits this fall.

To help readers keep tabs on available content, we will announce new articles in CRCD. At the end of each month, we’ll roll the corresponding weekly articles into a digital issue of the newly expanded 16-page CRCJ that mirrors the current digital format.

As a member of CRC, you can continue to download and print high-quality PDFs of the current issue, as well as several years of back issues of CRCJ and CPRLI, directly from CRC’s website. We’re looking forward to delivering your peer review and credentialing guidance in a timelier, efficient, and more convenient manner.

Stay tuned for additional details as we near implementation. In the meantime, feel free to contact Editor Son Hoang at [email protected] with any questions.

 

HCPro.com – Credentialing and Peer Review Legal Insider

Conducting a phase two audit self-review

HIPAA audits

Conducting a phase two audit self-review

As OCR’s auditors wrap up the final desk audit reports for phase two of the HIPAA audit program, many covered entities (CE) are breathing a little easier. Only 167 CEs were selected for desk audits in July. Audited CEs can expect to wait several months to see the final audit reports, although they will have the opportunity to review a draft version and submit comments that will be attached to the final report.

But phase two is far from over. Business associates (BA) will be selected for desk audits this fall—the first time these entities will be subject to OCR’s HIPAA audits. And early next year, OCR will launch comprehensive on-site audits of both CEs and BAs.

Desk audits look at specific sections of HIPAA. A BA might be asked to produce documentation supporting compliance with only two aspects of the Security Rule: risk analysis and risk management. The BA could look to the audit protocol to learn what documentation auditors expect to see.

However, comprehensive on-site audits will be exactly what they sound like: a comprehensive snapshot of a CE’s or BA’s compliance with every part of HIPAA.

Both BAs and CEs must be ready to submit all documentation requested by auditors within a limited window of time. CEs had only 11 days to submit documents in response to desk audits, and the clock starts ticking when OCR sends the audit notification email, not when the email is opened. BAs will likely also have 11 days to submit desk audit responses. Although some BAs and CEs may decide to test their luck and hope the audits pass them by, there will be little time to prepare if they are selected.

Conducting a self-review based on the audit protocols can help BAs prepare for desk audits; it can also help BAs and CEs get ready for the more exhaustive on-site audits. And as OCR steps up investigations of breaches large and small—while cyberthreats continue to mount—the audit protocols offer a blueprint that can help an organization identify and address risks.

 

Following protocols

The phase two audit protocols were built on the phase one protocols and updated to include changes made by the 2013 HIPAA omnibus final rule. (For more information on the phase two audit protocols, see the July issue of BOH.) The updates also include information specifically for BAs. But the protocols are useful beyond simply checking boxes for audited organizations: Any CE or BA can use them to evaluate compliance.

"Every affected organization should be routinely conducting reviews of its regulatory compliance," says Kate Borten, CISSP, CISM, HCISSP, founder of The Marblehead Group in Marblehead, Massachusetts. "Not only is this a good business practice, but it is explicitly required in the HIPAA Security Rule evaluation standard."

Some organizations may have put off these evaluations to deal with other compliance or business concerns, but privacy and security officers might see the tide finally turn in their favor. OCR’s increased activity, as well as the rise in frequency and cost of data breaches, may put HIPAA compliance back in the spotlight. Privacy and security officers should revitalize efforts to conduct the gap analyses and mock audits CEs and BAs may have postponed, advises Frank Ruelas, MBA, principal of HIPAA College in Casa Grande, Arizona.

"Now may be a good time to bring a review of the audit protocol, which essentially helps provide an overall indication of one’s state of compliance with many of the key areas within the HIPAA privacy, security, and breach regulations, from the drawing board to the to-do list," he says.

The phase two protocols may seem overwhelming at first glance. They’re extensive and detailed, covering the Privacy, Security, and Breach Notification rules. Each of these is broken down by section and specific compliance actions, with documents mapped to each section.

The level of detail is what makes the protocols useful, Ruelas says. "The audit protocol is much like an open-book test that not only comes with the questions, but also with many of the answers that auditors are looking for," he says.

With on-site audits not scheduled until early 2017, CEs and BAs should have plenty of time to prepare.

 

Road map to compliance

The audit protocols can be looked at as a road map to HIPAA compliance, says Reece Hirsch, Esq., a partner at Morgan and Lewis in San Francisco. CEs conducting self-reviews and BAs prepping for desk audits can look to the audit protocols, and OCR’s recent enforcement actions, to see where they fall regarding compliance with specific HIPAA areas.

BAs may not be direct healthcare providers and may deal with HIPAA in very different ways than CEs typically do. However, most of the audit targets, such as security risk management, still apply to BAs and are a common pain point for all organizations.

"The questions relating to timeliness of breach notification, security risk analysis, and security risk management are all areas that will almost certainly be focused on for BAs," Hirsch says. "In earlier statements, OCR highlighted just those areas when they were talking about areas that might be audited for BAs."

BAs may not be audited on targets that don’t apply to them, he says. However, some audit targets will contain elements that don’t apply to specific BAs. A BA may be asked to produce documentation for a compliance area it doesn’t engage in, such as the right of patients to access their PHI. In such a case, the BA will nevertheless be expected to produce official policies and documents stating it does not engage in these activities.

Conducting a self-review can help a BA identify what documents it is missing before an audit letter arrives. After that letter lands in a BA’s inbox, it’s too late to create missing policies or enforce them.

"This is the time to make any corrections that are possible," Hirsch says. "Once you receive the audit request, you have to respond with the policies that are in effect as of that date. It has to be a snapshot of compliance. You can’t correct things between the time you get the audit letter and the time you respond."

Both CEs and BAs should keep that mind when looking ahead to the next round of audits.

 

Team review

Conducting a self-review based on the protocols doesn’t need to be a complicated process, Ruelas says. Generally, it can be completed by the staff who routinely handle HIPAA compliance. For CEs, this could be the privacy and security officer or the compliance officer. BAs aren’t required to have a staff member dedicated to overseeing compliance with the Privacy Rule, so the individual best suited to this task will likely be the security officer. Whoever leads the review should be the individual most familiar with the organization’s HIPAA policies and procedures. That will make it quicker and easier to gather the documentation and leave more time to evaluate it.

It may be helpful to pull other staff into the review, Ruelas says. Human resources staff might be called on to provide a list of staff who have been sanctioned for violating the organization’s HIPAA policies.

Staff outside the privacy and security or compliance departments will have a different and valuable perspective on the organization’s HIPAA policies and procedures, Hirsch says. Any review should look at whether the items on paper are translating into practice.

"For example, when looking at patient access, it’s one thing to look at the policy, and it’s another thing to actually speak with the personnel who are receiving those requests and responding in a manner that’s consistent with the organization’s PHI access policies," he says. "You won’t know that unless you’re out there in the field talking to the people who are getting those requests day to day."

Auditors want to see more than simply a written policy. As privacy and security officers know, policies and procedures aren’t worth anything if no one knows they exist or they aren’t updated and modified to reflect changes in the organization. Risk analyses in particular must be living documents, Hirsch says. The organization must be able to show that information collected during a risk analysis is shared with the appropriate individuals, and there must be documented proof of actions taken and decisions made. This will also apply in cases where no action is taken on an identified risk. If a risk is determined to be low-level and triaged below more serious vulnerabilities, the organization should be able to produce documentation explaining why and how that decision was reached. (For more information on risk analyses, see the June and July issues of BOH.)

If a privacy or security officer runs into resistance while conducting the self-review, it can be an indication of larger problems, Borten says. Senior management should be willing to offer support as needed and provide documentation of HIPAA-related processes. If this support is lacking, it may mean privacy and security programs and policies aren’t being followed or managed.

Privacy and security officers should check with their organization’s legal counsel if they have questions about how to interpret the audit protocols, Hirsch says. During an actual audit, it may be difficult to get this guidance on time. Having these answers in advance will be invaluable in the event of an audit.

"There are some areas [of the protocols] that are open to interpretation, but I think if you’ve made a reasonable good faith effort to comply with the HIPAA standards, you’re probably going to be on solid footing," he says.

 

Taking the test

The self-review should have a clear goal and purpose, like any other evaluation. Start by defining its scope and methodology, Borten says. Determine what elements will be reviewed, what level of compliance the organization must achieve, and, perhaps most importantly, what will be done with the results. Have a plan and process in place to take action on any compliance gaps identified during the self-review.

Review by section rather than trying to tackle all 180 elements at once, Ruelas advises. He suggests starting a review with the breach notification targets (elements 162?180 in the audit protocols). Organizations can rank their compliance with each element and make note of those that don’t apply. Audit tools can help reviewers track and analyze data. A free audit tool is available at www.hipaacollege.com/tools.html.

Pay particular attention to standards that organizations have struggled with in prior audits or that are cited most often in OCR’s enforcement actions, Borten says.

The review itself can take as little as two days, Ruelas says. However, this may not be practical. Staff conducting the review will likely have other work to complete and may choose to break the review up over several weeks. But the review often goes quicker than anticipated, he says.

"Reviewers may be surprised that once they roll up their sleeves and dive into the review, it is not uncommon [they] may decide to assess more elements than originally planned," he says.

Minimize distractions when reviewing documents. Workflow can easily be interrupted if staff involved in the review are sidetracked by emails and phone calls, he says.

 

Time well-spent

Getting the time and resources to perform a review may be the most difficult part. Staff may already be filling multiple roles, and it might be difficult to convince leadership that a self-review is necessary if the organization wasn’t selected for a desk audit. A glance at OCR’s recent enforcement actions shows that some CEs and BAs already put off risk analyses.

"Unfortunately, the biggest hurdle in many provider organizations may be lack of knowledgeable resources and sufficient commitment," Borten says.

Motivation can be another stumbling block to a self-review. CEs that dodged desk audits may have breathed a sigh of relief and moved on. BAs might do the same after their audits launch.

"We must remember, everyone in the selection pool may also be selected for an on-site audit," Ruelas says.

In a July 13 webinar for CEs selected for desk audits, OCR representatives emphasized that the 2017 on-site audits would be comprehensive. An organization that hasn’t taken the time to prepare in advance could easily find itself falling short on some elements. It’s better to discover and address compliance gaps before an auditor does. Phase two audits aren’t meant to be punitive, but if auditors feel a compliance miss is significant, they can open an investigation, Hirsch says. A formal OCR investigation will take up far more time and resources?and potentially money?than a self-review of the audit protocols.

 

Interpretation

The audit protocols are detailed, but there is still room for interpretation, particularly when looking at the audit elements for the Security Rule. The unknowns in the audit protocols can leave privacy or security officers wondering if they’re making the correct call during a self-review.

"We may think we understand them or are interpreting them accurately, but we won’t know how our position compares with how they are interpreted by the auditors until the audits actually begin," Ruelas says. "I think people should simply try to understand and interpret them as best as they can, understanding that clarification may be coming later once the on-site audits get underway."

A self-review can also help an organization gauge how thoroughly it understands HIPAA compliance to begin with. If those involved in the review are struggling to understand and apply the audit protocols, it could be a sign that a little assistance is needed.

"True compliance requires that an organization fully understand what each requirement means and how to achieve it," Borten says.

HCPro.com – Briefings on HIPAA