Click here for more sample CPC practice exam questions with Full Rationale Answers

Practice Exam

Click here for more sample CPC practice exam questions and answers with full rationale

Practice Exam

CPC Practice Exam and Study Guide Package

Practice Exam

What makes a good CPC Practice Exam? Questions and Answers with Full Rationale

CPC Exam Review Video

Laureen shows you her proprietary “Bubbling and Highlighting Technique”

Download your Free copy of my "Medical Coding From Home Ebook" at the top right corner of this page

Practice Exam

2018 CPC Practice Exam Answer Key 150 Questions With Full Rationale (HCPCS, ICD-9-CM, ICD-10, CPT Codes) Click here for more sample CPC practice exam questions with Full Rationale Answers

Practice Exam

Click here for more sample CPC practice exam questions and answers with full rationale

Coding and Billing Updates – September 2021

What are the latest changes? Get the facts, fast. Fourth quarter updates to ICD-10-CM and HCPCS Level II code sets and Medicare payment systems happen every year but, like the weather, we’re often caught by surprise. And what a difference a day makes! Proper coding on Sept. 30 may not be proper coding on Oct. […]

The post Coding and Billing Updates – September 2021 appeared first on AAPC Knowledge Center.

AAPC Knowledge Center

2021 E/M Guidelines FAQ – September

AAPC’s senior VP of products answers more of your questions about coding for office and other outpatient services. Ever since the release of the new 2021 evaluation and management (E/M) guidelines for office and other outpatient services, AAPC has been conducting numerous trainings through webinars, virtual workshops, conference sessions, online courses, and multiple articles in […]

The post 2021 E/M Guidelines FAQ – September appeared first on AAPC Knowledge Center.

AAPC Knowledge Center

Changes in Allergy Testing guidelines for Horizon BCBSNJ effective from September 10, 2019


Effective September 10, 2019, Horizon BCBSN will change the way consider certain professional claims for services provided to Horizon BCBSNJ Medicare Advantage (MA) members based on an update to our medical policy, Allergy Testing.

Based on the submitted diagnosis code(s), claims submitted for services provided on and after September 10, 2019 to patients enrolled in Horizon BCBSNJ Medicare Advantage (MA) plans will be processed as follows.

The services represented by CPT code 86003 may be denied as not medically necessary.
Information may be requested to help us determine the medical appropriateness of the services represented by CPT code 86003. Following our review of medical record information, these services may be denied as not medically necessary.

Source: https://www.horizonblue.com/providers/news/news-legal-notices/medical-policy-update-allergy-testing-0


Coding Ahead

BCBS – New Reimbursement Guidelines for Smoking Cessation effective from September 26, 2019


Effective September 26, 2019, Horizon BCBSNJ will change the way consider certain professional claims for smoking cessation services provided September 26, 2019.

In accordance with CMS guidelines, Horizon BCBSNJ shall consider for reimbursement smoking and tobacco cessation counseling visits (99406 or 99407) for asymptomatic patients when billed with an approved diagnosis code.

Approved Diagnosis Codes:
  • Nicotine dependence (F17.21-F17.299)
  • Personal history of nicotine dependence (Z87.891)
  • Initial encounter, toxic effect of tobacco and nicotine (T65.211A, T65.212A, T65.213A, T65.214A, T65.221A, T65.222A, T65.223A,  T65.224A, T65.291A, T65.292A, T65.293A, T65.294A)

Evaluation and management (E&M) services shall be considered for reimbursement on the same day as smoking and tobacco-use cessation counseling services (99406 or 99407) only when medically necessary, as indicated by appending Modifier 25 to the E&M service.

Limitation: 

Horizon BCBSNJ shall limit smoking and tobacco-use cessation counseling (99406 or 99407) in any combination to eight times within a one-year period.

Reference:BCBSNJ



Coding Ahead

Announcements from the OIG (September 2019)

Alabama Ambulance Provider Settles Case Involving False Claims
On June 28, 2019, Samaritan EMS, Inc. (Samaritan), Union Grove, Alabama, entered into a $ 942,373.67 settlement agreement with OIG. The settlement agreement resolves allegations that Samaritan submitted basic and advanced life support ambulance claims where the trips were to destinations for which ambulance services are not covered by Medicare, such as trips to diagnostic and therapeutic sites (and the associated “return” trip was to a residence).
Missouri Physician Agrees to Voluntary Exclusion
On May 22, 2019, On-Site Imaging, LLC (On-Site), Morganville, New Jersey, entered into an $ 82,065.08 settlement agreement with OIG. The settlement agreement resolves allegations that On-Site submitted claims for Healthcare Common Procedure Coding System (HCPCS) code 96965, when those claims were for a procedure that was already included as a component of the duplex ultrasound procedures for which On-Site submitted claims using HCPCS codes 93970 or 93971 for the same beneficiary on the same dates of service. The OIG further contends that the claims submitted for HCPCS code 93965 were for a procedure that should not have been separately billed and was not medically necessary.
Diagnostic Services Provider Settles Case Involving False Claims
On May 22, 2019, On-Site Imaging, LLC (On-Site), Morganville, New Jersey, entered into an $ 82,065.08 settlement agreement with OIG. The settlement agreement resolves allegations that On-Site submitted claims for Healthcare Common Procedure Coding System (HCPCS) code 96965, when those claims were for a procedure that was already included as a component of the duplex ultrasound procedures for which On-Site submitted claims using HCPCS codes 93970 or 93971 for the same beneficiary on the same dates of service. The OIG further contends that the claims submitted for HCPCS code 93965 were for a procedure that should not have been separately billed and was not medically necessary.
California Physician and Practice Settle False and Fraudulent Claims Case
On April 12, 2019, Complete Women Care, Inc., and Miriam Mackovic-Basic, M.D. (collectively, “CWC”), with multiple locations in Los Angeles County, California, entered into a $ 258,045 settlement agreement with OIG. The settlement agreement resolves allegations that CWC submitted claims to Medicare for items or services that it knew or should have known were not provided as claimed and were false or fraudulent. Specifically, OIG contended that CWC submitted claims for: (1) diagnostic electromyography services using CPT Code 51784 and diagnostic anorectal manometry (ARM) services using CPT Code 91122 when therapeutic, not diagnostic services, had been provided; (2) ARM services using CPT Code 91122 that were not performed according to CMS guidelines; (3) pelvic floor electrical stimulation that was not preceded by a four-week course of failed pelvic muscle exercise training; and (4) in 13 instances, evaluation and management services using CPT Code 99214 that did not meet the criteria for billing under that code.
Alabama Ambulance Provider Settles Case Involving False Claims
On February 13, 2019, Medical Diagnostics Services, Inc. (MDS), with locations in Michigan and Illinois, entered into an $ 878,180.08 settlement agreement with OIG. The settlement agreement resolves allegations that MDS submitted claims for Healthcare Common Procedure Coding System (HCPCS) code 96965, when those claims were for a procedure that was already included as a component of the duplex ultrasound procedures for which MDS submitted claims using HCPCS codes 93970 or 93971 for the same beneficiary on the same dates of service. The OIG further contends that the claims submitted for HCPCS code 93965 were for a procedure that should not have been separately billed and was not medically necessary.

The post Announcements from the OIG (September 2019) appeared first on The Coding Network.

The Coding Network

Joint Commission revises scoring for infection control as of September 1

On September 5, The Joint Commission (TJC) announced scoring changes for its IC.02.02.01 standard, which requires facilities to reduce infection risk associated with medical equipment, devices, and supplies. The standard was third on TJC’s recent list of most challenging requirements for hospitals.

HCPro.com – Briefings on Accreditation and Quality

Case Management Monthly, September 2016

Case study

Using physician advisors as an agent for change

Learning objective:

At the completion of this educational activity, the learner will be able to:

  • Identify the advantages and challenges of having physician advisors involved in performance improvement efforts.

 

Physician advisors (PA) are an important ally for case managers at many organizations when it comes to ensuring proper patient status. But one organization has greatly expanded the role of PAs to include performance improvement and as a result has seen improvements in everything from readmissions to length of stay.

Ven Mothkur, MD, MBA, LSSBB, the corporate physician advisor at the Franciscan Alliance, a 14-hospital health system based in Illinois and Indiana, says that the organization shifted from an outsourced group of PAs to an internal team of 13 PAs and five physician clinical documentation improvement (CDI) specialists over a one-year period in 2014.

"I think we’re quite traditional in some respects," he says. "The primary function of the PAs is to perform patient status reviews. But what makes the role unique is its emphasis on the PA as a leader in performance improvement."

In the past, PAs at the organization were very much in figurehead roles. That has since changed dramatically. Today, PAs at the health system are still visible leaders but are also engaged, active full-time staff members that serve as a bridge between the medical staff, case management, and the C-suite.

The PAs run daily interdisciplinary rounds and are essentially the physician representative for case management and utilization review, but they are also liaisons between the chief medical officer (CMO) and the chief financial officer (CFO), helping to translate corporate goals into actionable plans. This includes global efforts to improve continuity of care and work as part of multiple accountable care organizations.

When an issue crops up, the PA’s are in a position to investigate the challenge. For example, if the observation rate starts creeping up they may jump in and start asking questions.

"What’s happening on the ground? Is it an issue with a payer? Are they being too delayed in getting back with authorizations? Is it a delay in communication between the attending physicians and case managers? Is it a delay on the end of the physician advisor getting back?" says Mothkur.

This new, "mid-revenue cycle" position allows the PAs to focus on what’s going on in the organization as a whole and help make performance improvements in response.

The health system implemented the new PA program after looking at its outsourced PAs and the value they were bringing to the organization. "When we looked at the cost to benefit ratio, it was just not there," says Mothkur.

The health system realized that there may be a real benefit to having well-respected members of the medical staff take on this role working alongside their colleagues.

Today, the PAs at Franciscan Alliance perform regular status reviews and ensure that the hospital is running a tight ship on the front end, but they also keep an eye on all the organization’s dashboards, metrics, and trends and turn those numbers into performance improvements.

Making the shift to the new model required a multi-step process that began by taking a good look at the organization and its needs.

Below are the main steps an organization will need to take to begin a similar program.

 

Shifting the role of the PA

Step 1: Financially justifying the change. The most challenging aspect of allowing PAs to shift their focus is justifying the change to upper management. "You have to give as much of a financially justifiable ROI as possible to the CFO. They’re the ones who approve it," says Mothkur.

When analyzing data to determine whether changing the focus of PAs, consider all the soft returns on investment, such as decreases in the observation rate, fewer denials, more medical staff engagement, or a higher case mix index, he says.

Step 2: Assessing the need. What are the problems your organization wants to address and will they be best solved by a wholly internal group of PAs or a hybrid model?

Some organizations use internal PAs during the week and switch to outsourced PAs to handle calls on nights and weekends, says Mothkur.

"I think the first step in doing this is to look at where you have huge gaps," he says. One starting point might be to look at the organization’s gross revenue write-offs. If this number is beyond national benchmarks, there may be an immediate and readily apparent benefit to having PAs move in and address the problem areas you find.

Also look at your mix of physicians. Are they primarily employed or independent? It may be easier to gain compliance from employed doctors with educational initiatives while independent physicians may require more intervention from PAs to accomplish the same goals.

Also look for other areas that could use improvement. For example, if your denials are high then your observation rate is high, or you are having trouble with payers then PAs can help smooth over some of these problem areas.

The PAs at Franciscan Alliance have become the oil that keeps the machine humming. If the oil was not there, the machine wouldn’t be operating as effectively. "There are now gaps that are picked up, there is improved compliance, nurses are happier, CM is ecstatic, the CFO has answers to what they’re seeing in numbers, the CMO has a second in command," says Mothkur.

Step 3: Choose the right PA. Finding the right person to fill this challenging role can be difficult. "It’s a matter of identifying the right person who is willing to do it all," says Mothkur. But this person also has to be someone who has the respect of the medical staff, someone who is ready to move on from practicing medicine daily to an administrative role and is excited about the opportunity to make improvements at a hospital level.

This job is not for the physician who took the opportunity in the past to scale back and work remotely, he says.

"Our PAs have to come to the hospital, attend leadership meetings, sit in the medical staff office for lunch, just to be there," he says. "This is very much a full-time job. The docs that we’ve gotten into it say it’s harder than clinical practice."

Often the PAs work 50 hour weeks. They also have to have thick skin, because they need to push back against their peers in some instances.

"It’s hard to find someone like I just described," says Mothkur.

To make its selections, Franciscan Alliance asked the CMO, among others, to identify potential candidates who were well respected, possessed leadership qualities, and were potentially interested in leaving clinical practice. Also look for physicians who have an appetite for looking at data and analyzing numbers.

Step 4: Ensure proper training. Once candidates are identified, training should begin as quickly as possible, says Mothkur. In the absence of formal training programs, organizations often have to cobble together their own programs, which should involve the following:

  • Getting the candidate introduced to and embedded in the case management and CDI departments.
  • Linking PA with educational resources, such as professional organizations like the American Case Management Association, Case Management Society of America, ACDIS, or the American College of Physician Advisors.
  • Ensuring familiarity with different payers and health plans and ensuring proper education on InterQual® and MCG® (formerly Milliman) standards.
  • Encouraging PAs to attend conferences on related topics and to join industry list-servs where PA topics are discussed. "The training is really very much on-the-job training, learning as you go," says Mothkur.

 

Step 4: Follow up. After the initial adjustment period, determine how the PAs are performing by polling case management and other departments, including the medical staff. Don’t be surprised if the medical staff is a little agitated by PAs, after all the job can be and should be a little adversarial.

The relationship between case management and PAs should always be one of mutual respect. A good PA will have respect and empathy for the increasingly complex and evolving case management role. A PA should have the attitude of "how can I help you," says Mothkur.

"There is often a shared bonding [between the PA and case management] over war stories because you’re fighting the same payers," he says.

A functional and positive relationship can pay dividends.

Franciscan Alliance has not only saved money by using an internal group of physicians. The other benefits of this approach include a reduction in the following:

  • Denials
  • Inappropriate admissions
  • Avoidable days
  • Readmissions
  • Observation length of stay
  • Overall length of stay

 

And case management has an important ally to support them and to help drive organizational change. "For case management it’s about knowing they have this leader and champion standing behind them that they never had," says Mothkur.

 

NOTICE Act confusion continued into the summer

Learning objective

At the completion of this educational activity, the learner will be able to:

  • Identify challenges related to the lack of information about the Medicare Outpatient Observation Notice and the Notice of Observation Treatment and Implication for Care Eligibility Act.

 

Hospitals were struggling this summer to comply with the Notice of Observation Treatment and Implication for Care Eligibility (NOTICE) Act, which was signed by President Barack Obama August 6, requiring hospitals to provide a verbal and written notice of outpatient status to any patient in observation who has been in the hospital for more than 24-hours.

With only a preliminary form on the PRA website to guide them (http://ow.ly/7TPE302eSiM), many organizations were finding more questions than answers in their quest to comply with the regulation.

"[The preliminary form] does not have an Office of Management and Budget approval number, so it is not finalized," says Ronald Hirsch, MD, FACP, CHCQM, vice president of the Regulations and Education Group at Accretive Health in Chicago. "And there are several comments that it is not written to the federal standard for understanding by someone with limited education, so it may not even be approved in its present form. CMS has also said they will give further guidance on the requirement for verbal explanation so it is hard to know who will be allowed to present and explain the form."

In July, Janet Blondo, MSW, LCSW-C, LICSW, CMAC, ACM, CCM, C-ASWCM, ACSW, the manager of case management at Washington Adventist Hospital in Takoma Park, Maryland, was still looking to have a number of questions about the rule answered.

"I contacted the Maryland Hospital Association who researched this issue," she says. "The staff at MHA are conferring with experts at the Maryland Department of Health and Mental Hygiene about my questions and concerns and expect to have a response soon."

This lingering uncertainty not only was making it difficult for hospitals to start planning for compliance, but also led some to speculate that the compliance date would be extended.

The Ohio Hospital Association (OHA) in June told its members that the requirement date could be pushed back until October.

"The implementation of the Medicare Outpatient Observation Notice, or MOON, was set for August 6, 2016. However, as hospitals await the details of the federal fiscal year 2017 inpatient prospective payment system final rule, CMS is now stating that the MOON requirement date may be pushed back to October. Stay tuned for a final decision on the MOON implementation date," the OHA stated in a written release (http://ow.ly/z0qZ302fmvH). But as of mid-summer this talk still amounted to unsubstantiated rumors, says Hirsch.

"Unless someone knows someone at CMS, there is no official word. I did read many of the comments to the rule and many asked for a six-month delay. My guess is that they cannot delay the implementation since it is a law but they will delay enforcement for three months," he says.

In the meantime, organizations were trying to do what they could to get ready.

The NOTICE Act stipulates hospitals must inform patients within 36 hours from the start of the service, or at the time of discharge, about their status.

The goal of the legislation is to ensure patients are aware of their status and what it might mean for them financially?in particular, how it might affect their post-acute care options.

Patients often (wrongly) assume that if they’re in a hospital bed, they are an inpatient.

They also don’t understand the implications of outpatient billing status.

One of the biggest issues that can crop up when a patient’s care orders place him or her on observation status is that he or she will not be eligible for Medicare coverage for a post-acute stay in a skilled nursing facility (SNF), and instead may need to pay more out of pocket. Medicare currently only covers SNF extended care rehabilitation services for patients who have three consecutive inpatient days in a hospital. For example, one day in observation and two days as inpatient equals three days in the hospital, but does not meet the three-day inpatient day stay requirement because it only includes two inpatient days.

"An Office of Inspector General report found that the average out-of-pocket cost for SNF services not covered by Medicare was more than $ 10,000 per beneficiary," states a press release issued by the congressional leaders who promoted the bill (http://ow.ly/S6JSB).

To comply with the rule, hospitals will now need to designate someone?in some cases it may be the case manager?to provide this notification.

Stefani Daniels, RN, MSNA, ACM, CMAC, founder and managing partner of Phoenix Medical Management, Inc., in Pompano Beach, Florida, says a few of her clients were trying to get the form included in a packet of admission papers that are given to each Medicare patient to sign.

But even so, as of press time most organizations had more questions than answers about compliance. Stay tuned for updates in future issues of CMM.

 

Ask the expert

Understanding nuances of patient status and therapeutic services

Learning objective

At the completion of this educational activity, the learner will be able to:

  • Identify strategies to comply with condition code 44 and the Medicare Outpatient Observation Notice (MOON), and understand rules related to some aspects of therapeutic services.

 

Assigning the correct patient status is a constant challenge for hospitals and the case managers who are charged with ensuring these decisions are accurate. CMM often gets questions from readers on related topics and we forward them to our experts to get the answers. This month’s questions were answered by Ronald Hirsch, MD, FACP, CHCQM, vice president of the Regulations and Education Group at Accretive Health in Chicago. 

 

Q: If a Medicare patient is downgraded from inpatient to observation is it expected that the patient will be issued the MOON and condition code 44 will be used on the claim? 

 

A: First, it must be noted that all patients who are downgraded using the condition code 44 process are being downgraded from inpatient status to outpatient status. If the patient then needs continuing hospital care (i.e., is not ready to be discharged), then observation can also be ordered. If observation is needed and is ordered, the MOON will be required only if the patient receives observation for 24 or more hours from the time of this order for observation services.  

 

Q: I have a question about how to interpret the CMS Standard Operating Procedures. If a requisition/order for physical therapy treatment is received at a hospital facility and is not authenticated (e.g., signed, timed, dated) by a community physician who is not credentialed at the hospital, is it true that facility can begin treatment but the order must be authenticated when it will be filed in the record?

A: Therapy services (e.g., physical, occupational, speech-language pathology) are unique in that an actual order from a physician or non-physician practitioner is not required (see the Medicare Benefit Policy Manual, Chapter 15, Section 220.1, at www.cms.gov/Regulations-and-Guidance/Guidance/Manuals/downloads/bp102c15.pdf). The following is required:

  • The patient must be under the care of a physician
  • The therapy must be provided under a plan of care
  • The physician must certify that plan of care by way of signature and date

 

In this case, the therapy provider may develop a plan of care and forward it to the physician for certification. Treatment may begin while awaiting the return of the signed plan of care. But the organization staff should do their best to get the signed certification returned within 30 days of start of therapy services.

Because the physician is not on the medical staff, the therapy provider may want to confirm that the physician is enrolled with Medicare and therefore eligible to order and certify services on Medicare recipients.

Got a question on any case management topic that you’d like to ask our experts? Email it to Kelly Bilodeau at [email protected].

 

Bonus question

Q: What do you do with a patient who does not have a safe discharge plan, but does not meet inpatient criteria and has been in observation status for 48 hours?

A: The original instruction from CMS that still stands is that we give the patient an advance beneficiary notice that says his or her care in the hospital setting is no longer medically necessary and is not being billed to Medicare and that he or she will be financially responsible.

 

HCPro.com – Case Management Monthly

Credentialing & Peer Review Legal Insider, September 2016

Avoid HIPAA breaches from ransomware attacks

Although ransomware is not a new phenomenon, a recent increase in reported attacks along with several well-publicized cases have raised the public’s awareness of the threat it poses. Ransomware, a variety of malware, can be incredibly damaging because it is designed to infect a system, find and encrypt the system’s data, and lock out users until they pay a ransom–typically in an anonymous electronic currency like bitcoin–to regain access through a decryption key.

According to a U.S. government interagency report, there have been approximately 4,000 ransomware attacks each day since the beginning of the year, up from the 1,000 daily attacks reported last year. Further, a recent analysis by managed security services provider Solutionary found that 88% of ransomware attacks during the second quarter of this year targeted healthcare entities.

"Hospitals rely on data systems not only for the survival of their business, but the survival of their patients. Because of this, the perceived value of the data becomes much greater, meaning the criminals can charge premium ransoms against their victims," says Travis Smith, senior security research engineer at Tripwire, a Portland, Oregon-based cybersecurity firm.

The variants of ransomware that exist can complicate a hospital or other healthcare provider’s response, says Doron S. Goldstein, partner and co-head of privacy, data, and cybersecurity practice at Katten Muchin Rosenman, LLP, in New York City. In addition to the typical form of ransomware that infiltrates systems and locks users out of their data unless they make some form of payment, some types can also exfiltrate a copy of the locked data to the hacker, or delete the data but make it seem as though it’s encrypted and still present-tricking the user into paying for data that is actually gone.

"In each scenario, you don’t know if there is intention to release the data if you pay or not. You may pay and still get nothing. Or you may get it back. There is no certainty to it. Some victims have gotten access back; others have not," says Goldstein, a former software developer and network administrator. "The general guidance from law enforcement, such as the FBI, is not to pay ransom. But if everything you have is locked out, you may not feel like you have a choice."

HHS guidance

In light of the increased prevalence of ransomware threats, the U.S. Department of Health and Human Services (HHS) recently released guidance to help covered entities understand the risks associated with these types of attacks and how complying with HIPAA can help identify, prevent, and recover from ransomware.

"The HHS is just reacting to what is happening in the marketplace. The sustained increase in the number of successful ransomware attacks is proof that the ransomware problem is going to get worse before it gets better. Issuing guidance is raising awareness of the issue at hand," Smith says.

The HHS guidance states that healthcare entities can better protect against ransomware by implementing security measures required by the HIPAA Security Rule. According to the guidance, these measures include limiting access to electronic protected health information (PHI) to personnel and software that require it; and conducting risk analyses to identify threats and vulnerabilities to PHI.

"You have to do the risk analysis. Ransomware is just another form of malware; it’s particularly insidious, but they all require doing the risk analysis," says Goldstein.

A big takeaway from the HHS guidance is the importance of taking appropriate actions beforehand to mitigate the potential of damage caused by ransomware, he adds. Unlike malware that simply transfers PHI without authorization, ransomware makes the PHI unavailable or destroys it altogether.

"For a healthcare provider in particular, having data exfiltrated means there’s damage to the patients, but likely not to their immediate health. Being locked out of your health data or your patients’ health data is a potential threat to the life and health of patients," he says.

 

HIPAA breaches

The guidance provides clarification on whether a ransomware infection constitutes a HIPAA breach. A breach under HIPAA is any acquisition, access, use, or disclosure of PHI in a manner that is not permitted under the HIPAA Privacy Rule and that compromises the PHI’s security or privacy.

Prior to the release of the HHS guidance, instances of data exposure that revealed individuals’ PHI would be considered a HIPAA breach, says Justin Jett, director of compliance and auditing at Plixer International, a Kennebunk, Maine-based security analytics company. ­However, at that point, one could have made the argument that ransomware wouldn’t technically be considered a breach since it encrypts data rather than exposing it.

Now, according to the new guidance, if a ransomware infection encrypts electronic PHI that was not encrypted prior to the incident, a breach has occurred. The guidance reasons that the PHI has been "acquired" because hackers have taken control or possession of it. In these cases, the hospital must then undertake a risk analysis and, when applicable, comply with the breach notification requirements and notify individuals affected, HHS, and the media.

However, if the hospital had previously (prior to the ransomware attack) encrypted the PHI in a manner that would render it unusable, unreadable, or undecipherable to an unauthorized individual, there is a possibility the ransomware attack wouldn’t be considered a breach.

"I interpret this guidance as removing the loophole of ransomware not actually looking at the data. Since malware changes over time, it’s within the realm of possibility that ransomware will target [PHI] and exfiltrate the data once found. The new guidance states that if the ransomware is unable to actually see the protected healthcare information in cleartext (not encrypted), then it is not a reportable breach," Smith says.

Even in these cases, the guidance says additional analysis would be required to determine if the PHI was sufficiently encrypted prior to the attack. Goldstein says this emphasizes the need for a risk analysis whenever there is a security incident. He further noted that HHS may have included this guidance so covered entities could not view the ransomware’s own encryption of the data as protection against that data being compromised.

"In those cases, the data is technically encrypted by virtue of the ransomware, but it’s not encrypted by the covered entity; it’s encrypted by someone else who controls that encryption. It shouldn’t be viewed as encryption for the purposes of your risk analysis," Goldstein says."

 

Prevention and recovery

To better prevent ransomware, Jett says all staff should be appropriately trained on email and web security as most malware and ransomware comes from those sources. Additionally, companies should invest in heightened email security solutions, like anti-spam firewalls, which will help prevent the most obvious attacks from getting to employees’ inboxes.

The HHS guidance suggests that since HIPAA requires the workforces of covered entities to receive security training on detecting and reporting malware, employees can assist with early detection of ransomware by spotting indicators of an attack. These warning signs could include unusually high activity in a computer’s CPU as the ransomware encrypts and removes files, or an inability to access files that have been encrypted, deleted, or relocated.

Even if hospitals are vigilant, ransomware attacks may still occur. Again, the guidance suggests that HIPAA compliance may help hospitals recover from ransomware attacks due to HIPAA’s mandate for frequent backups of data.

Goldstein warns, however, that some variants of ransomware can lie dormant for a period of time in order to migrate across systems, including into data backups. Many hospitals and companies keep hot backups as part of their disaster recovery plan. These backups can be automatically or manually switched on if a system goes down. If ransomware has infiltrated a backup, the backup’s data could also become compromised and encrypted by the ransomware as soon as it’s activated.

"The important thing about dealing with the impact of ransomware is that it may require additional or different protections compared to what other malware requires to avoid or mitigate its ill effects," he says.

 

Recent ransomware attacks

All types of malicious software attacks are on the rise,but ransomware has recently received more high-profile media coverage, says Doron S. Goldstein, partner and co-head of privacy, data, and cybersecurity practice at Katten Muchin Rosenman, LLP, in New York City. "Ransomware has certainly gotten more coverage lately because of the potential damage, and the sophistication of some of these attacks has increased," he says.

The following are a few of the recent ransomware attacks that made headlines:

Hollywood Presbyterian Medical Center: In February, this Los Angeles hospital paid hackers the equivalent of $ 17,000 in bitcoins to regain access to its computer system, according to the Los Angeles Times. The malware prevented hospital staff from accessing their system for 10 days by encrypting its files; once the hospital paid the ransom, it was given a decryption key to unlock the files. In a statement, CEO Allen Stefanek said paying the ransom was the quickest way to restore the hospital’s systems.

Chino Valley Medical Center and Desert Valley Hospital: In March, hackers targeted these southern California hospitals by infiltrating their computer systems with ransomware. A spokesman for the two hospitals, which are part of Prime Healthcare Services, Inc., said technology specialists were able to limit the attacks so both hospitals remained operational, no data was compromised, and no ransom was paid.

MedStar Health: Also in March, this Columbia, Maryland-based system was targeted with ransomware that encrypted the system’s data. According to the Baltimore Sun, the hackers demanded that MedStar pay three bitcoins, worth approximately $ 1,250, to unlock a single computer, or 45 bitcoins, the equivalent of about $ 18,500, to unlock all of its computers. MedStar refused to pay the ransom, and staff at its 10 hospitals and more than 250 outpatient centers resorted to using paper records while system access was restored.

Kansas Heart Hospital: In May, hackers infected the network system of this Wichita hospital with ransomware. According to local CBS affiliate KWCH12, the hospital paid an undisclosed portion of the ransom demanded but the hackers refused to return full access and demanded a second payment. The hospital announced that it had refused to make the second payment and would work with its IT team and external security experts to restore access to the rest of the system.

 

Exciting updates: More content, tools, and news at your fingertips!

The challenges healthcare professionals tackle each day don’t wait for solutions, and neither should you. That’s why Credentialing & Peer Review Legal Insider (CPRLI) is transitioning to a more frequent and robust publishing model this fall by combining with the Credentialing Resource Center (CRC)’s flagship publication, Credentialing Resource Center Journal (CRCJ), to create a single source for all your credentialing, privileging, peer review, and legal news, tools, and best practice strategies.

Your updated member benefits gain you access to expanded content and tools on CRC–with new resources added weekly to the website (www.credentialingresourcecenter.com). Plus, as a CRC member you gain instant access to over 300 clinical privilege white papers, core privileging forms, Medical Staff Talk, and Credentialing Resource Center Daily (CRCD), CRC’s daily e-newsletter for medical staff leaders and MSPs. If you are already a CRC member, you will continue to receive the news and analysis you’ve come to rely on, plus expanded member benefits this fall.

To help readers keep tabs on available content, we will announce new articles in CRCD. At the end of each month, we’ll roll the corresponding weekly articles into a digital issue of the newly expanded 16-page CRCJ that mirrors the current digital format. As a member of CRC, you can continue to download and print high-quality PDFs of the current issue, as well as several years of back issues of CRCJ and CPRLI, directly from CRC’s website. We’re looking forward to delivering your peer review and credentialing guidance in a timelier, efficient, and more convenient manner.

Stay tuned for additional details as we near implementation. In the meantime, feel free to contact Editor Son Hoang at [email protected] with any questions.

 

Case summary

Maine supreme court upholds immunity for CVO questionnaire

The Supreme Judicial Court of Maine (the "Court") upheld a superior court’s ruling granting immunity to two physicians who provided negative comments regarding a third physician when they responded to a questionnaire from a credentials verification organization (CVO).

The decision stems from a dispute where Kevin F. Strong, MD, sought damages from Rebecca M. ­Brakeley, MD, and Jonathan M. Bausman, MD, alleging defamation and tortious interference with his business relationship with St. Mary’s Regional Medical Center in Lewiston, Maine.

In 2013, Strong applied for staff privileges at St. Mary’s, which reached out to its contracted CVO, Synernet, to collect, verify, and dispense Strong’s credentialing information. Synernet sent professional reference questionnaires to Brakeley and Bausman, who completed and returned them. Synernet forwarded the responses to St. Mary’s, which ultimately chose to deny staff privileges to Strong. Strong subsequently filed his complaint in the superior court against Brakeley and Bausman, claiming the denial was a result of negative comments in their questionnaires.

In court, Brakeley and Bausman argued that their statements were entitled to absolute immunity pursuant to Section 2511 of the Maine Health Security Act and filed a motion for summary judgment. The superior court granted the motion, and Strong appealed.

Strong made several arguments for why Brakeley and Bausman’s statements didn’t meet the criteria for immunity, but the Court rejected his interpretation of the statute.

In its decision to affirm the superior court’s summary judgment, the Court discussed the language of Section 2511 and its three subsections, which outline the circumstances when a physician is afforded immunity from civil liability, and why Strong’s interpretation was incorrect.

Central to Strong’s argument was Subsection 3 of the statute, which states that physicians "assisting the board, authority, or committee in carrying out any of its duties or functions provided by the law" are afforded immunity. Strong argued that Synernet was not a board, ­authority, or committee and therefore Brakeley and Bausman were not immune. However, the Court interpreted that subsection to include professional competence committees, which the Maine Health Security Act defines to include "[e]ntities and persons, including contractors, consultants, attorneys and staff, who assist in performing professional competence review activities."

Since St. Mary’s contracted with Synernet to collect, verify, and dispense credentialing information for its competence review process, the Court concluded Synernet qualified as a professional competence committee and therefore was a board, authority, or committee pursuant to the statute.

Strong also interpreted the language of Subsection 3 to mean that it only provided protection to a physician if he or she was a member of the board, authority, or committee. The Court found this interpretation illogical as it twisted the meaning of the subsection from protecting the acts of the physician providing assistance to instead protecting the committee receiving the assistance.

 

Source:

Strong v. Brakeley, Docket No. And-15-260 (Me. Apr. 21, 2016).

 

HCPro.com – Credentialing and Peer Review Legal Insider