Fall 2016 | Anesthesia Business Consultants

Anesthesia & Pain Management Webinars

800.242.1131

eAlerts

What Do We Really Know About ICD-10’s Potential Impact on Anesthesia?

Jody Locke, MA
Vice President of Anesthesia and Pain Management Services
Anesthesia Business Consultants, Jackson, MI

On October 1, 2015, a major change to diagnosis coding was rolled out with the International Classification of Diseases and Health Related Problems 10th revision (ICD-10), and virtually all payers (except workers compensation and auto carriers) have agreed to implement the new codes. There was serious concern that the complexity of the new code sequence (69,000 codes instead of the previous list of 14,000) would have a significant impact and increase the number of claims denied for medical necessity. Fortunately, the Centers for Medicare and Medicaid Services announced a 12-month grace period, presumably to give practices time to get up to speed with the logic of the new codes.

Curiously though, there was little or no similar guidance from other major payers and plans. Many practices across the country have spent considerable time and resources to improve the quality of their diagnostic coding, but others have not. Some have reduced the percentage of claims not meeting the specific requirements of ICD-10 to 10 or 15 percent, but many have found it a herculean challenge to obtain and document the details of a patient’s diagnosis to the level of specificity required by ICD-10, especially since many surgeons have taken a rather apathetic view of the new requirements. So, now that the CMS grace period has ended, what should we expect? Are we about to see denial rates increase dramatically or is this going to be another example of a policy change for which the advance press is far worse than the actual implementation?

ICD-10 has taken an aspect of clinical documentation that was vestigial and incidental and made it a focus and priority. This, in and of itself, is huge. Now, let us consider the change in structure and logic. ICD-10 introduced concepts that had never been considered before, such as “episode of care.” When picking an ICD-10 code for trauma or fractures, the coder must confirm whether the procedure represented the first time a patient was being treated for the condition, a subsequent treatment, or treatment of complications or sequelae. Many of the early ICD-10 training programs simply focused on the requirement to document laterality, wherever applicable, but this is just one of many new requirements. In most cases, physicians simply have to provide a greater degree of specificity in their diagnosis. The following three examples highlight the basic nature of the new requirements:

Most physicians used to report that the elderly patient had a cataract. ICD-10 requires the provider to indicate that it was an age-related nuclear cataract of the right or left eye.
It is no longer adequate to indicate that the patient had appendicitis. ICD-10 requires an indication of the nature and extent of peritonitis.
What used to be reported as a femur fracture now entails an entirely new checklist of qualifying factors as indicated in the ICD-10 Decision Tree shown in Figure 1.

When ICD-10 was implemented, it was often noted that the new codes would give payers a powerful tool to better evaluate the appropriateness of the medical necessity for each procedure. From a claims adjudication perspective, diagnosis can be defined as the reasonable justification for the service performed. In order for payment to be approved, the CPT code must be justified by an appropriate and relevant ICD-10 code. In simple terms, tonsilitis justifies the removal of the tonsils. Of particular concern to anesthesia providers was the inference that payers would have the ability to compare the ICD-10 code reported on the anesthesia claim to that on the surgical claim. In fact, this potential has consumed much of the discussion since last October. In fact, a certain paranoia has set in, that if the anesthesia diagnosis does not match the surgical diagnosis exactly, then the claim will be denied.

The fact is that most anesthesia claims are submitted well before the surgical claim. Typically, anesthesia claims are only held when the entire episode of care is being questioned. The prospect of payers holding anesthesia claims to be matched against the surgical claim poses significant logistical claims to payers and would, admittedly, have a material impact on anesthesia cash flow. Most observers of American healthcare do not believe this is a serious possibility, but no one knows for sure, and we cannot dismiss the possibility that payers will use ICD-10 as an excuse to deny a higher percentage of claims.

Given current standards of electronic claims adjudication, it is far more likely that payers will focus on the degree of specificity for all claims rather than on how closely they match. Herein lies one of the greatest challenges for the anesthesia provider. The irony of ICD-10 is that it requires the anesthesiologist to provide a diagnosis that could be used to evaluate the surgeon’s diagnosis. How is the anesthesia provider going to get the necessary details, if not from the surgeon? Most anesthesia practices that have implemented a postoperative time-out” to allow the surgeon to share procedure and diagnosis have found that many surgeons simply do not understand the requirements of the new codes, nor do they seem to care. Anesthesia providers frequently report that the surgeon’s response to their queries is this: “My office staff is responsible for picking the code.”

As anesthesia providers slowly came to terms with the implications of ICD-10, many obstacles and challenges started to come to light. Despite what one might have expected, practices with electronic medical records (EMRs) and electronic anesthesia records had the hardest time meeting the new requirements. Why? They had the least ability to review and edit the details of the diagnostic descriptor. One had hoped that the EMR would provide access to the more detailed surgical operative report, but more often than not, the report did not provide the necessary detail. In many cases, the final postoperative surgical diagnosis is simply not known by the end of the case. Questions were raised, for example, about how to treat a biopsy when the pathology report was not available. Many practices attempted to implement a postoperative time-out for the anesthesia provider to confirm the details of procedure and diagnosis, but in many cases, the surgeons were not up to speed, arguing that such details of coding were “a back office function.”

The efforts to reduce the percentage of unspecified ICD-10 codes on claims continues, but one thing has become abundantly clear: If you’ve seen one anesthesia practice, you’ve seen one anesthesia practice! Every approach and strategy must be custom-tailored to the unique needs of the practice and the ability of its providers to master the logic of ICD-10. Scorecards do help. One cannot manage what one cannot measure. But scorecards (and detailed provider feedback) are only one piece of a much more complicated puzzle. Modifying provider behavior is no small challenge, and in the case of diagnosis, it is proving to be huge.

We are almost a year out from the initial rollout of the new ICD-10 codes, and there have been virtually no denials related to the specificity of the ICD-10 code or mismatches with the surgeon’s code. There is nothing that gets a provider’s attention as quickly as issues affecting cash flow. Because ICD-10 does not appear to have had an impact thus far, many providers have started to dismiss its significance.

Anesthesia Business Consultants has been very focused on educating providers about ICD-10 and has conducted dozens of in-service sessions in person and via web meetings. The company has also developed a coding application called F1RSTCode to help client providers confirm the data elements necessary to document the diagnosis.

If we draw an analogy to the administration of anesthesia, there are some useful parallels. It is often said that of the five phases of anesthesia—preparation, induction, maintenance, emergence and recovery—preparation is the most important. The goal is to identify potential risks and prepare for them. So it is with ICD-10. We will not know what the financial impact of ICD-10 will be until it happens. The best advice we offer at this point is to reduce the potential risk areas that payers could take advantage of to deny claims. Probably, things will not change too much, but we cannot know for sure. Just because we don’t think something will happen doesn’t mean it won’t. It is much better to be prepared for the worst and be relieved when it turns out payers are as reluctant to change their behavior as providers.

If you would like more information about how ICD-10 will affect your practice, please contact your client manager and ask for your detailed ICD-10 Client Coding Feedback report (ICCF).

Jody Locke, MA serves as Vice President of Anesthesia and Pain Practice Management for Anesthesia Business Consultants. Mr. Locke is responsible for the scope and focus of services provided to ABC’s largest clients. He is also responsible for oversight and management of the company’s pain management billing team. He is a key executive contact for groups that enter into contracts with ABC. Mr. Locke can be reached at Jody.Locke@AnesthesiaLLC.com.

Anesthesiologists and the Changing Healthcare Landscape

As we noted in our eAlert on the topic, the medical community’s transition to the International Classification of Diseases and Related Health Problems 10th revision (ICD-10) has, contrary to expectations, gone fairly well so far. In fact, it has gone much better than anticipated, with rates of claims denials remaining essentially unchanged before and after the new system’s initial rollout. Does this early success mean that the ICD-10 transition will be smooth sailing from here on out, now that the “grace period” has ended?

As ABC Vice President Jody Locke tells us in What Do We Really Know About ICD-10’s Potential Impact on Anesthesia?, while it is unlikely that payers will radically alter their usual practices by beginning to hold anesthesia claims to match them against the surgical claim, we can’t say this with certainty. Mr. Locke urges anesthesia practices to stay abreast of potential trouble spots and to “prepare for the worst and be relieved when it turns out payers are as reluctant to change their behavior as providers.”

Another pressing regulatory issue is the second round of audits by the Health and Human Services Office of Civil Rights—now including business associates—of compliance with the Health Insurance Portability and Accountability Act (HIPAA). The audits are intended to improve compliance, writes Neda Ryan, Esq, but “OCR also maintains its right to launch a more thorough investigation into an organization that it discovers, or believes, to pose a threat to the privacy and security of individuals’ protected health information.”

Kathryn Hickner, Esq, delves into the Comprehensive Care for Joint Replacement Model (CJR Model), an alternative payment program. Unlike many other programs to come out of Center for Medicare and Medicaid Innovation, the CJR Model is not voluntary. It behooves us to know more about this program, which applies to items and services provided to Medicare beneficiaries.

HIPAA, ICD-10, CJR and the plethora of regulatory requirements—and long hours clinicians spend complying with them—can sap professional passion. So can clinical responsibilities in the operating room when those responsibilities become repetitive, routine and lacking in opportunities for professional growth. In The Perioperative Surgical Home: Invest in Good Will, his fifth in a series of six articles, Rick Bushnell, MD, MBA, describes the potential of this care delivery model to rejuvenate the specialty, rekindle enthusiasm and reinvigorate careers.

The renewed excitement for one’s specialty that can come from expanding anesthesiology’s role in the delivery of value-based care is one thing; the collective soul-searching required to develop a cohesive strategic plan with colleagues in one’s anesthesia group is another. It’s an essential activity physicians often avoid, hoping it will magically take care of itself, either because they don’t perceive its importance or because they fear it will lead to conflict, according to consultant Will Latham, MBA. To help quell these fears, Mr. Latham offers a straightforward strategic planning primer.

In Anesthesia Mergers and Acquisitions and Post-Termination Obligations: Have You Terminated Your Future?, Mark F. Weiss, JD, explores an aspect of group practice that is particularly relevant in the current environment of heightened merger and acquisition activity—namely, what happens when an anesthesia group is acquired and the contract includes “post-termination obligations”—provisions, such as covenants not to compete, that survive the nominal term of the agreement. Mr. Weiss cautions anesthesia practices to “take into account exactly what it is that you are selling and what its value is.”

Non-compete agreements “are crucial to securing the value of the practice,” note Amanda K. Jester, JD, and Ashleigh VanLandingham, JD, in their first article for the Communiqué, What Anesthesiologists Need to Know About Enforcement of Non-Compete Agreements. “Failure of the covenant to meet technical elements for enforceability can be fatal,” they warn, stressing the importance of regular reviews of applicable state statutes and case law and adjustments in covenants and the practice’s overall strategy to ensure that the covenants remain enforceable.

We hope to see many of you at the American Society of Anesthesiologists annual meeting in Chicago, October 22-26.

With best wishes,

Tony Mira
President and CEO

Ten Things Anesthesiologists Should Understand About the Medicare Comprehensive Care for Joint Replacement Model

Kathryn Hickner, Esq
Ulmer & Berne LLP, Cleveland, OH

For years, anesthesiologists have been acutely aware that this country’s healthcare reimbursement regime is in a state of significant transition. Government healthcare programs (such as Medicare and Medicaid) and commercial payers are gradually moving away from a fee-for-service model to value-based payment programs that focus on the quality and efficiency of services provided. For example, the federal government aims to have 50 percent of all Medicare fee-for-service payments made via alternative payment models by 2018.

Anesthesiologists have also heard for several years that they need to command a seat at the table when such reimbursement changes are proposed and implemented. We know that anesthesia services provided during the perioperative period can have a significant impact on financial and clinical outcomes. By providing anesthesiologists with a seat at the table, hospitals gain from the unique perspective and insight that the anesthesiologists have to offer.

Active and collaborative participation by anesthesiologists also benefits the anesthesiologists themselves. Such involvement may provide anesthesiologists with an additional opportunity to improve the healthcare system and patient satisfaction, experience greater fulfillment in their own practices, provide additional value to their hospitals and, under some circumstances, financially benefit from such contributions. Although the practical opportunities for doing so vary tremendously depending on the circumstances, the importance of such anesthesiologist engagement—to the specialty, the patients, the hospitals and the industry more generally—is relatively well understood and accepted.

This article provides a broad overview of certain key considerations regarding one relatively new and significant alternative payment program, the Comprehensive Care for Joint Replacement Model (the CJR Model).¹ Understanding the impact of the CJR Model on the healthcare industry is important not only for anesthesiologists who are directly impacted by the CJR Model, but also for those anesthesiologists who are preparing themselves for success under similar value-based payment models in the future. Here are 10 facts about the CJR Model that anesthesiologists should understand.

The CJR Model aims to lower Medicare expenditures and improve outcomes related to hip and knee replacements. The CJR Model was designed by the Center for Medicare and Medicaid Innovation (Innovation Center) to improve surgical outcomes and reduce Medicare expenditures related to hip and knee replacements (sometimes also referred to as “lower extremity joint replacements” or “LEJR”), which are common and expensive procedures.

According to the federal government, in 2014, there were more than 400,000 hip and knee replacements for Medicare beneficiaries, and the associated hospitalizations alone cost more than $7 billion. Further, it is anticipated that such surgeries will become increasingly utilized. The Innovation Center has identified substantial variability across the country in terms of cost and patient outcomes associated with these services. That means there may be significant room for improvement.
Many hospitals are required to participate in the CJR Model. Unlike many other Innovation Center programs, hospitals do not opt into or out of the CJR Model. There is no application form or process. Rather, most acute care hospitals within the 67 designated CJR Model geographic areas (which are defined by and referred to as metropolitan statistical areas (MSAs)) are required to participate. Such geographic areas and the participating hospitals within such areas (along with an abundance of other materials related to the CJR Model) are set forth on the Innovation Center website.² As of August 1, 2016, there were approximately 790 hospitals participating in the CJR Model.
The CJR Model only applies to items and services provided to Medicare beneficiaries. Only those Medicare beneficiaries who satisfy the following criteria will be included in the CJR model: (a) the beneficiary is enrolled in Medicare Part A and Part B; (b) the beneficiary’s eligibility for Medicare is not on the basis of the End-Stage renal disease benefit; (c) the beneficiary is not enrolled in any managed care plan; (d) the beneficiary is not covered under a United Mine Workers of America health plan; and (e) Medicare is the primary payer.
The CJR Model retrospectively bundles payments for certain hip and knee replacement episodes of care. The CJR Model is designed to hold hospitals accountable for the quality and cost of a CJR episode of care. Under the CJR Model, an episode of care has wide breadth in terms of duration and the scope of services included. For purposes of the CJR Model, an episode of care commences upon the patient’s admission to a hospital and ends 90 days after the patient is discharged under MS-DRG 469 (major joint replacement or reattachment of lower extremity with major complications or comorbidities) or 470 (major joint replacement or reattachment of lower extremity without major complications or comorbidities).

Subject to certain exclusions that are described more specifically on the Innovation Center website, the episode covers all related items and services paid under Medicare Part A and Part B. In general, the episode of care includes, for example, the following services when they are related to the hip and knee replacement surgery: (a) physicians’ services, (b) inpatient hospital services (including hospital readmissions), (c) inpatient psychiatric facility services, (d) long-term care hospital services, (e) inpatient rehabilitation facility services, (f) skilled nursing facility services, (g) home health agency services, (h) hospital outpatient services, (i) outpatient therapy services, (j) clinical laboratory services, (k) durable medical equipment, (l) Part B drugs and (m) hospice.
Under the CJR Model, participating hospitals are paid in the usual manner subject to annual reconciliations that take into consideration quality and efficiency. Hospitals that participate in the CJR Model will operate under the usual Medicare payment system, subject to an annual reconciliation at the end of each CJR Model performance year. Such reconciliation will review certain quality indicators and also a comparison of the actual spending for the episode and the Medicare target episode price.

Depending on the participating hospital’s performance in terms of efficiency and quality, the hospital may receive an additional payment from Medicare or may be required to repay Medicare for a portion of the episode spending. Note, however, that there is no downside risk during performance year one, which is a partial year commencing on April 1, 2016 and ending on December 31, 2016. For subsequent CJR Model performance years (each of which is a full 12-month calendar year), stop-loss limits apply during performance years two through five, increasing from five percent to 20 percent over the course of such timeframe.
The CJR Model should create additional opportunities for collaboration. In order to succeed under the CJR Model, hospitals will need to foster alignment and coordination with anesthesiologists and other physicians, home health agencies, skilled nursing facilities and others. Participating hospitals will rely upon teams of professionals, including anesthesiologists, to monitor and improve performance (for example, by reducing unnecessary complications and hospitalizations) through communication, collaboration and standardization across the continuum of care. Anesthesiologists can uniquely contribute and benefit from such teamwork.
The CJR Model includes safeguards designed to protect Medicare beneficiaries. Under the CJR Model, the patients (i.e., the Medicare beneficiaries) themselves continue to have the freedom to choose their own services and providers. Accordingly, participating hospitals may ultimately be responsible for items or services within the episode of care provided by a third party over whom the hospital has little influence or control.

This dynamic creates a strong incentive for hospitals to align in new ways with physicians, home health agencies, skilled nursing facilities and others within the continuum of care to strengthen care coordination. The Innovation Center website (referenced above) includes a description of certain beneficiary notifications and forms for use by CJR Model hospitals and their collaborators. Also note that Medicare has several tools, including additional monitoring of claims data, to ensure that participating hospitals do not impermissibly stint care to achieve cost-savings.
Providers impacted by the CJR Model must be cognizant of applicable regulatory constraints. Participation in a new Innovation Center payment model that encourages collaboration does not necessarily bless all potential relationships entered by participating hospitals and their collaborators, even if such relationships are designed for the lofty goals of achieving quality, efficiency and success under the payment model. Historically, the state and federal healthcare, tax exempt, anti-trust and other regulations have intentionally created certain barriers to alignment among providers. Such constraints are designed, in part, to protect the federal healthcare programs from overutilization and associated costs. It is important for providers to understand that, in general, the relationships that they forge while positioning themselves for success under the CJR Model continue to be subject to applicable regulations.
CJR Model and related federal guidance affords hospitals and their collaborators with certain increased flexibility. To encourage the collaboration required for the CJR Model to achieve its objectives while simultaneously safeguarding the federal healthcare programs, the CJR Model itself includes certain increased flexibility for participants to structure relationships with other providers across the continuum of care.

For example, subject to certain parameters, the CJR model allows its participating hospitals to share payments received from Medicare for the provision of efficient high-quality services (and also, on the flip-side, to share financial accountability and risk) with collaborating providers and suppliers, which could include anesthesiologists and their groups. Further, on November 16, 2015, the federal government issued limited fraud and abuse waivers for certain arrangements involving CJR Model participants. Note that such fraud and abuse waivers apply only with respect to the specific laws cited and only protect those arrangements that meet each and every applicable condition.
Anesthesiologists should keep their eyes and ears open for additional developments regarding the CJR Model and other alternative payment models. During August, 2016, the federal government issued helpful Frequently Asked Questions regarding the CJR Model that are available along with several other pieces of useful guidance on the Innovation Center website.³ Further, note that although the CJR Program is relatively new, the federal government proposed further changes to the model during July 2016.⁴ Such changes focus, in part, on aligning financial incentive policies of the CJR Model with proposed episode payment models, allowing participating hospitals to further collaborate with accountable care organizations and critical access hospitals, and modifying the pricing and reconciliation process.

¹ See 80 FR 73273 (November 24, 2015) and https://www.federalregister.gov/articles/2015/11/24/2015-29438/medicare-program-comprehensive-care-forjointreplacement-payment-model-for-acutecarehospitals
² https://www.federalregister.gov/articles/2015/11/24/2015-29438/medicare-program-comprehensive-care-forjointreplacement-payment-model-for-acutecarehospitals See https://innovation.cms.gov/initiatives/CJR
³ See https://innovation.cms.gov/Files/x/cjr-faq.pdf
⁴ See 81 FR 50793 (August 2, 2016). See also, https://www.federalregister.gov/articles/2016/08/02/2016-17733/medicare-program-advancing-care-coordination-through-episode-payment-models-epms-cardiac.

Kathryn (Kate) Hickner, Esq is an attorney at Ulmer & Berne LLP, Cleveland, where she co-chairs the firm’s Health Care Practice Group. Additional information regarding Kate’s background, experience, publications and presentations can be found at http://www.ulmer.com/attorneys/Hickner-Kathryn-E.aspx. She can be reached at (216) 583-7062 and khickner@ulmer.com.

The Perioperative Surgical Home: Invest in Good Will

Rick Bushnell, MD, MBA
Director, Department of Anesthesia, Shriners Hospital for Children, Los Angeles, CA
and Huntington Memorial Hospital, Pasadena, CA

You trade on it every day. It may be your anesthesia group’s most important asset. It’s difficult to quantify, but in the accounting sense, “good will” is the value of your anesthesia group’s assets above and beyond the tangible assets or the net present value of your group’s future cash flows. For example, good will was a substantial portion of the calculus when Disney purchased the Star Wars franchise. Good will is embodied in your relationship with your hospitals, your surgeons and your patients. You unknowingly groom your good will every single day in order to capitalize your business environment.

In this fifth installment of the Perioperative Surgical Home (PSH) series, allow me to posit the PSH as your means of increasing your good will by increasing your value to your hospitals, surgeons and patients. Let us explore the discoveries we’ve made at my institution having initiated pre- and postoperative clinic appointments during this last calendar quarter.

Our PSH clinic targets the 20 percent sickest patients with appointments one week in advance and up to 14 days post-discharge. After initiating clinic appointments with those patients, we quickly noted profound patient gratitude. In most cases, PSH patients already know they are sick and anesthesia is their biggest fear. They’re worried, and our 30- minute appointments result in a relaxed setting where we take the luxury of time to address their concerns. These clinic appointments are the embodiment of true patient access to anesthesiologists. The result is a pool of happier patients and an increased reservoir of community good will toward the entire health system.

Our surgeons also noted their increased access to PSH anesthesiologists. Because of the complexities of anesthesiologist scheduling, often surgeons have no anesthesiologist to consult with concerning complicated patients. Often, the surgeon’s best chance of obtaining an anesthesia consult is three minutes before surgery. Too frequently, the results are canceled cases, frustrated physicians, upset patients and global inefficiency.

On the other hand, the clinic appointment the week before surgery is a fantastic time to partner with surgeons in order to optimize their patients. Surgeons really appreciate a call from the PSH clinic anesthesiologist preparing their next week’s complicated patient.

In your operating room (OR) anesthesia colleagues will similarly appreciate receiving a PSH phone call the night before a complicated surgical patient lands on their lineup. That medical sign-out to your anesthesia colleague doing the case the next day is enormously important to them—a service to their day they have never before experienced. In calling and signing out PSH patients to my colleagues, I am personally gratified by the contribution I can make to their practice—and the feeling is mutual. I have found my OR anesthesia colleagues profoundly grateful for our PSH clearances and sign-outs.

Hospital risk management attorneys are also discovering that the PSH is their new best friend. In our clinic, we conduct full histories and physicals, and place electronic medical record notes that dramatically improve the medicallegal environment.

In one notable case, our PSH anesthesiologist spent an hour with a complicated patient and her daughter. They had an extensive conversation about the anesthesia/surgical risks, benefits and alternatives, and he placed a beautifully detailed note. The patient went on to surgery and eventually passed away from a perioperative complication, but the patient’s family was grateful for the extensive preoperative briefing. Additionally, the detail in the PSH record resulted in near absolution and indemnification for the surgeon, the hospital and the anesthesiologist.

Our Risk Management Department became a big believer after this one case alone. Our chief financial officers and executives are delighted to follow the mounting evidence of the PSH’s financial value. One study from New York University places a value of a preoperative PSH appointment with an anesthesiologist at $1,700 due to decreased length of stay, fewer readmissions and decline in surgical cancellations. This data is being closely followed by CMS and other payers. With the implementation of bundled payments and accountable care organization (ACO) caps, this is data you will want on your side. This is data that your anesthesia group will want to ”own” as you go before the ACO board to present your request for a larger percentage of fixed, capped bundled payments.

The greatest accrual of value, though, may be the motivation and stimulation afforded by the PSH. Stepping out of the OR to redeploy your anesthesia intuition in the perioperative setting is a fantastic management and medical experience. These new challenges can rejuvenate your career by giving you a new sense of purpose. Your own good will toward your colleagues, surgeons, patients and hospital will soar. You will rediscover energy and enthusiasm that had faded with repetitive and routine OR work. It is true that your practice can be new again.

The excitement and renewed sense of purpose that comes with being a PSH clinic anesthesiologist will be transmitted to patients, staff and the hospital. That is the real value of good will. Your new sense of fulfillment will be infectious as it rolls through the health system like a shot of adrenaline, resulting in happier patients, increased rapport between services and more appreciative hospital administrators. While not directly, objectively calculable, it is money in the bank of reputation that secures your exclusive contract with those you serve. Invest in yourself first. Invest in good will.

Rick Bushnell, MD, MBA is the Director of the Department of Anesthesia, Shriners Hospital for Children, Los Angeles, CA and a clinical anesthesiologist at Huntington Memorial Hospital in Pasadena, CA. Dr. Bushnell graduated from the University of Illinois College Of Medicine and attended the University of Pittsburgh Medical Center and Loma Linda University for internship and residency. He has been with Pacific Valley Medical Group since 2003. He and his partner have six adopted children in Tanzania, where he serves as Visiting Clinical Anesthesiologist at St. Elizabeth’s Hospital for the Poor in Arusha. He can be reached at propofolstingsme@gmail.com.

Preparing for Round 2 of HIPAA Audits

Neda M. Ryan, Esq
Corporate Compliance Attorney, Anesthesia Business Consultants, Jackson, MI

Over the past five years, the Department of Health and Human Services Office of Civil Rights (OCR) has been more aggressive about identifying organizations that fail to comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its impending regulations. Historically, OCR has taken a reactive approach to noncompliance through tips and complaints or notifications of breaches by covered entities. Recently, however, OCR has been more proactive through its use of audits to identify organizations that are noncompliant with HIPAA and its regulations.

Until now, OCR has only audited covered entities. Covered entities are health plans, healthcare clearinghouses and healthcare providers who conduct certain financial and administrative transactions electronically. Now, OCR is expanding its audits to business associates. Business associates are people or entities performing certain services involving the use or disclosure of protected health information (PHI) on behalf of or for a covered entity. Business associate services include legal, actuarial, accounting, consulting, management, financial and billing.

OCR states that its audits are intended to improve compliance within the industry by identifying vulnerabilities and developing tools to address widespread areas of non-compliance. However, OCR also maintains its right to launch a more thorough investigation into an organization that it discovers, or believes, to pose a threat to the privacy and security of individuals’ PHI. As such, all organizations should be familiar with what the recent phase of audits entails and use this as an opportunity to prepare for this round, or future rounds, of OCR audits.

Pilot and Phase 1 of the Audit Program

During 2011 and 2012, OCR initiated its Pilot Program during which 20 covered entities were audited. It approached the Pilot Program in three steps: (1) developing audit protocols, (2) conducting 20 audits to test the protocol and (3) expanding the audit to Phase 1 to audit 95 additional covered entities using revised protocols. The Pilot Program and Phase 1 included audits of a health plan, a hospital system, small providers, community hospitals, outpatient surgery centers and a regional pharmacy. During the Pilot Program, OCR found various HIPAA compliance-related issues, but did not seek enforcement action against those covered entities. Most notably, OCR found that more than 60 percent of violations were related to Security Rule provisions.¹

Phase 2 Audit Program

Phase 2 was launched in July 2016 when 167 covered entities received notice they were selected for desk audits. Business associates will receive notice of desk audits this fall. The focus of the desk audits is on seven controls drawn from the Security Rule, the Privacy Rule and the Breach Notification Rule. The controls are summarized in Figure 1. In early 2017, Phase 2’s third wave of audits will begin with onsite audits, which will be broader in scope than the desk audits.

Entities having received, or that will receive, an audit letter from OCR under Phase 2 can expect to receive a notification email of their selection for participation in the audit. They will also receive a document request for policies, procedures and/or other related documentation. Covered entities will be required to provide the contact information for all business associates.

After a review of the submitted documentation, OCR will develop and share draft findings with the entity. The entity may respond to draft findings, and the written responses will be included in the final audit report. Final audit reports will describe how the audit was conducted, present any findings and contain entity responses to the draft findings. Although OCR claims the audits are “a compliance improvement activity,” OCR has the authority to initiate a separate compliance review or investigation if significant threats to the privacy and security of PHI are revealed through the audit.

How to Prepare for HIPAA Audits

Conduct Mock Audits – OCR has published the letters it will send to auditees. OCR has also published its audit protocol.² These resources, and others, can be used to conduct mock audits.
Conduct a Risk Assessment – HIPAA requires that entities conduct risk assessments to identify areas in which the entity is vulnerable or susceptible to violations. OCR has prepared a Security Risk Assessment Tool (https://www.healthit.gov/ providers-professionals/securityrisk-assessment) where entities can conduct their own risk assessments in evaluating their compliance with HIPAA’s Security Rule.
Implement and Update Policies and Procedures – Following a risk assessment, entities should develop and/or update their policies and procedures to ensure the areas of vulnerability are addressed.
Educate Employees and Staff – Employees and staff should regularly be educated on their obligations with respect to the privacy and security of health information traveling in and out of the organization.
Organize Materials – Begin to organize the materials and documents that could be requested in an audit. These materials would include policies and procedures, historical risk assessments, notifications to individuals and others of breaches, and lists of business associates and their contracts.³
Respond to OCR – If you receive an audit letter, do not ignore it! There will be a short timeframe in which to respond. Contact an attorney or a HIPAA professional to assist in responding to the audit request and any subsequent OCR communications.

Conclusion

OCR’s auditing activity is only increasing. What was once limited to covered entities has been expanded to business associates, and what once involved fewer than 200 entities, now involves up to 250. All entities should be prepared for the possibility of an audit. OCR has many resources to assist organizations in understanding the requirements and implementing the necessary measures to promote compliance. In today’s auditing environment, entities cannot delay in complying with what is required of them.

1 Lessons Learned from OCR Privacy and Security Audits, Program Overview and Initial Analysis, Presentation to IAPP Global Privacy Summit, March 7, 2013 (https://clearwatercompliance.com/wp-content/uploads/2014/06/4-1.-Lessons-Learned-from-OCR-Privacy-and-Security-Audits-Sanches_Rinker_03-07-2013.pdf).
2 http://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html
3 A sample list of business associates is available here: http://www.hhs.gov/hipaa/for-professionals/complianceenforcement/audit/batemplate/index.html.

Neda M. Ryan, Esq is a Corporate Compliance Attorney for Anesthesia Business Consultants. Ms. Ryan has experience in all areas of healthcare law, including healthcare transactional and corporate matters; healthcare litigation matters; providing counsel regarding compliance and reimbursement matters; and third party payer audit appeals. She can be reached at (517) 787-7432 or Neda.Ryan@AnesthesiaLLC.com.

Keep in Touch
Twitter
Facebook
LinkedIn