Five tips to help providers comply with Stark

The Stark Law creates a whole set of antikickback rules that providers must understand and actively work to comply with. And with all its good intentions, the Stark Law is incredibly restrictive. In fact, even the U.S. Court of Appeals for the 4th Circuit noted that “even for the well-intentioned healthcare provider, the Stark law has become a booby trap rigged with strict liability and potentially ruinous exposure.”

The Centers for Medicare and Medicaid (CMS) and Congress have taken steps to clear up confusion and loosen the rules in some cases (See our article on exceptions for value-based care). Still, your Compliance team has a tremendous responsibility to make sure that policies match the rules and that providers understand and follow the policies.

Policies match the Stark rules

Changes to the Stark Law have been coming out practically since the law was enacted. The law, which aims to protect against kickbacks and self-referrals, has gotten complicated in the details. Congress issues amendments to help  the law catch up to changing business practices. Healthcare organizations may have written policies that facilitated compliance originally. However, those may be completely out-of-date if they weren’t keeping up with the changes in the law.

For example, CMS has introduced modifications that addressed challenges with value-based care and resolve issues restricting coordinated care and health data exchange. Another modification to the law was allowing healthcare providers to accept cybersecurity tech donations from stakeholders.

While the compliance officer enforces the policies, he or she doesn’t have to live them the way those in operations do. Getting input from key stakeholders such as providers, Risk Management, and others in the C-suite can help ensure that final policies are clear. This early feedback and engagement can also help identify how the policy or regulatory changes will affect the individuals who must operate under them. Lastly, they can help identify potential operational conflicts with new policies or regulatory changes.

(See how YouCompli delivers model policies and procedures that help your organization comply.)

Providers following the Stark policies

With compliant policies in place, it’s time to help providers understand how to follow them. This is where communicating what certain key terms in a policy or regulation means in the context of the provider’s particular work becomes critically important.

Compliance officers know that “the road to success is going to run through quality of care,” says Harry Nelson, health care attorney at Nelson Hardiman. “Compliance isn’t the internal police that slows things down, but a strategic part of growth.” When it comes to making sure providers understand how to follow policies, the compliance officer has to look at the language of the policy from the providers’ perspective, not that of the compliance officer.

Here are five steps to help providers understand and follow Stark-compliant policies:

  1. Engage your operational leaders. Make sure the president and CEO understand the nature and intent behind Stark limitations so they can help explain and reinforce them. Give situational examples they can relate to so they understand what the key terminology means.
  2. Invest in training and communication. One email won’t do it with changes to Stark-related policies. Engage providers in small groups, in writing, and in person to explain nuances and answer questions about tricky scenarios. Whenever possible, use real-world scenarios to help illustrate how the regulations and policies impact them. Education and training should also be routine and ongoing with key stakeholders.
  3. Get feedback. Regularly check in to gather feedback from your leaders. Find out if the implemented tools and procedures are working for them, as well as to identify challenges they face. This step will help you see areas where the  words on paper mean something the compliance officer had not thought of. Adapt procedures and tools if necessary.
  4. Encourage people to ask questions. Make sure providers and your operational leaders alike know they can use you as a sounding board for grey areas or possible violations. It’s much better if they proactively ask if a proposed arrangement is compliant. Otherwise, they may have to unwind a relationship if they find out it is not compliant.
  5. Promote awareness to prevent future mistakes. Once an error is made, chances are it will reoccur and lead to additional violations. As you are addressing errors, promote awareness to prevent future mistakes. For example, when you are communicating the fact that a mistake was made, go the extra step to what caused it. This will be an opportunity to find out where their confusion was and use that insight to update policies or training.

Stark compliance starts with knowing about changes to the regulations and continues with crafting policies that providers can understand and follow. Involving stakeholders in policy creation and training, and engaging tech systems to reinforce the lessons will support the long-term success of Stark-compliant policies.

Do you have the tools you need to recognize and manage regulatory change across your organization? Find out how YouCompli can help you manage and coordinate your response to regulatory change or schedule a demo.

Subscribe for blog updates

Stark Law: Flexibility for value-based care

The well-intentioned but complex Stark Law has gotten some updates recently. The changes give healthcare providers greater flexibility, especially with value-based care. 

The Stark Law was introduced in 1989 by United States Congressman Pete Stark (D-CA). It aims to protect Medicare and Medicaid from paying for services that may trigger conflict-of-interest concerns. This includes certain healthcare services for which physicians referred their Medicare/Medicaid patients to an organization with which they have a financial relationship. Referrals like this trigger questions about whether the patient really needed the service and raises concerns of physicians referring for their own financial benefit.  

Take, for example, a physician who refers a Medicare/Medicaid patient for an x-ray to a medical imaging facility. The facility then bills Medicare for that service. This may seem appropriate unless the physician has a financial interest in the medical imaging facility.  

The law faced criticism, however, for being too rigid. According to Henry Casale, partner at Horty Springer, “providers have found that the Stark Law is deceptively simple to summarize, but compliance has proven to be difficult and complex.” 

Casale went on to say that “Stark said that ‘the only way to protect healthcare consumers from unnecessary referrals is to impose a bright line rule.’ The Stark Law prohibits a physician from making referrals for certain Designated Health Services (DHS) payable by Medicare or Medicaid to an entity with which the physician (or an immediate family member) has a direct or indirect financial relationship (ownership or compensation). It also prohibits the entity from filing claims with Medicare or Medicaid for those referred DHS, unless the financial relationship complies with an exception to the Stark Law.”  

New value-based exceptions 

New exceptions under Stark allow for physicians to refer Medicare/Medicaid patients to entities they have a financial relationship with and that are part of a value-based program, in some cases. Additionally, the physician may receive remuneration, such as cost savings payments, so long as the requirements of the new exception are met.  

According to Casale, “The Stark value-based rules cover both cash and in-kind remuneration and do not include the term ‘Fair Market Value’.”  These rules have a number of requirements, but those requirements decrease as the value-based physician participants assume more financial risk.  The greatest flexibility is when the physician participants agree to assume full financial risk. (This includes capitation and global budget payment arrangements.) The requirements increase if the physician participants assume only “meaningful” financial risk. (The physician is responsible to repay or forego no less than 10 percent of the total value of the remuneration the physician receives under the value-based arrangement.) The requirements are greatest where the physicians are not at financial risk. 

“The Stark value-based rules are a significant improvement,” Casale said. “But they do leave a number of questions unanswered.” They also differ markedly from the OIG’s value-based safe harbor regulations that were published the same day, especially where the physicians are not at financial risk.  Here the OIG only provides safe harbor protection for in-kind remuneration while the Stark rules permit both cash and in-kind remuneration.  

“So while the Stark rules provide guidance and significant flexibility,” Casale said, “providers need to also consider the OIG’s much more narrow view of value-based arrangements.”   

Related: Discover how CMS is improving patient care while reducing administrative burden for providers. 

Rules related to Stark and anti-kickback legislation have been evolving for decades. These recent changes reflect an effort to add greater flexibility with value-based care and help keep the law responsive to current business practices in healthcare.  

How is your healthcare system adapting to keep up with changes to rules from the Stark Law and other fluid regulations?  Read more about how YouCompli can help you stay on top of regulatory changes or schedule a demo. 

Jerry Shafran

Jerry Shafran is the founder and CEO of YouCompli. He is a serial entrepreneur who builds on a solid foundation of information technology and network solutions. Jerry has founded, managed, and sold software and content solutions that simplify complex work. His innovations enable professionals to focus on their core business priorities.

Subscribe to receive updates from YouCompli

Six key steps to reduce the impact of telehealth audits

Telehealth is almost as old as the telephone itself. In 1879 – just three years after Bell patented the telephone – an article in Lancet described the concept and advocated its adoption. 

A law that’s even older can trigger many telehealth audits today. The 1863 False Claims Act (FCA) was enacted to keep profiteering contractors from defrauding the Union army. It can trigger serious problems for hospitals that don’t take proactive steps to make sure their telehealth practices are audit-proof.  

That’s because the 2010 Affordable Care Act updated the FCA to make healthcare providers liable for “retention of any overpayments” from Medicare and Medicaid. This even includes overpayments resulting from accident or error. Indexing penalties for inflation each year, a requirement added in 2015, increased hospital liabilities. This puts liabilities at three times the amount of the overpayment(s) plus $11,803 to $23,607 for each instance. (Some 29 states and the District of Columbia have additional False Claim laws.) 

These laws’ implications and requirements touch every part of the hospital. Keeping the whole organization in compliance means that all departments have to work together. 

New laws, new regs, new worries for telehealth 

Even before COVID, the government audited claims from what was then a smaller, rural telehealth system. Regulators found a trend of incorrect payments to doctors outside rural areas, who were therefore ineligible to receive them. 

Telehealth is on the latest Office of the Inspector General (OIG) work plan, too. The OIG will be addressing remote patient monitoring by telehealth as an area of concern. 

The public health emergency, with its series of 90-day waivers, made it possible for telehealth to grow so fast. Now, as the COVID emergency ebbs, Congress is considering making its current, expanded status permanent. (Two bills were introduced in May. One would enable audio-only telehealth services for Medicare enrollee. The other would expand telehealth for Medicaid and Children’s Health Insurance Programs.) 

That’s good. But with laws come regulations covering acceptable types, locations and forms of delivery of telehealth services. And with regulations come scrutiny and audits. That can create challenges, especially with the specter of FCA liability in the background. 

The best way to cope with audits is to prevent the need for them in the first place. Here are six steps to follow: 

  1. Know what you’re up against. Keep up to date with all the developing federal and state regulations, waivers, and other requirements. That in itself can take up most, if not all, of your personal and your compliance team’s time.  
     
    Related: Find out how a team of expert compliance professionals and a nationally respected law firm track and analyze the latest regulatory changes, keep you updated, and give you actionable ways to adapt your process.  
     
  1. Inventory your waivers. Which waivers do you rely on, in which departments and facilities? Do the providers and staff that they apply to know about them? And who makes sure the requirements are met and documents it? 
  1. Check your records. One of the biggest causes of noncompliance isn’t malice. It’s error. Did an accidental typo in Coding result in an incorrect claim? Does everyone in Billing know which states require what reimbursement levels for telehealth services? Are certain telehealth records missing? Who’s responsible for keeping the signed doctors’ orders and documents that establish medical necessity? Do patients and services meet billing guidelines? Do you have a telehealth compliance policy? Does it need changing? Start conducting spot-checks to find out. 

    Related: Find out about state requirements for telehealth billing.  
     
  2. Audit your process. Another big cause of noncompliance is miscommunication – particularly the assumption that someone else is taking care of something. So put together an internal audit team, with each department represented. That way, each can learn from the other. Hold an entrance conference to highlight what you learned from your spot checks, define the internal audit’s scope, set expectations, and assign specific tasks and timelines. 
  1. Fix whatever’s broken. Reconvene the internal audit team and communicate the findings. Together, use that input to find opportunities to correct or cure what’s wrong in your process. Then, create a Corrective Action Plan (CAP) that will include needed education, training, policy, and process changes. Monitor your CAP over time, to see how it’s working and to spot anything else that needs fixing. 
  1. Rebill and repay. If your internal audit and CAP were successful, you’ll have discovered missing or insufficient documentation. Report it. You may have also have found instances of incorrect payments. Rebill and repay. Yes, it will cost your hospital money. But not nearly as much as a full-blown government audit. A Department of Justice investigation could end up costing you time, legal fees, and FCA triple damages. 

Patient demand for telehealth isn’t going away. Neither are the costs of noncompliance with telehealth regulations. As the public health emergency expires, fines from regulators and denial of claims from payers are sure to add up. The best way for your healthcare organization to solve these potentially massive financial problems is to work together to prevent them. Proactively partnering with colleagues in all relevant departments, your compliance team can lead the efforts to identify and fix issues before they become major problems. That way, you’ll be able to provide the telehealth services patients want in compliance with what the regulations demand. 

It’s a big effort to keep your compliance champions connected and communicating. See how YouCompli can help you manage the rollout of new regulations and verify best efforts to regulators and your board. YouCompli is the only healthcare compliance software combining actionable regulatory analysis with a simple SaaS workflow. 

Differing state regulations make telehealth compliance more complex

The beauty of telehealth is that it connects patients and providers through technology that transcends boundaries. But when that connection crosses state lines, your healthcare organization could find itself responsible for complying with regulations from jurisdictions hundreds, maybe thousands, of miles away.  

Or from states just down the road. 

Many of those are stricter than the federal regulations, and many cover issues that the federal government doesn’t. Here are some of the key issues to look out for. 

Related: Growth in telemedicine could mean trouble if you are not careful   

Differing reimbursement structures and rates 

Reimbursement structure and rates vary by state and form of telehealth. For instance, all states pay Medicaid reimbursement for some form of live telehealth, but in different ways, and all states reimburse for interactive, real-time telehealth. However, only 14 reimburse for sessions where the patient records a call for later physician review (store-and-forward), and only 22 reimburse for remote patient monitoring of recently discharged hospital patients. There are eight states that reimburse for all three telehealth methods. 

There are two opposite views about reimbursement rates. One view is that a service is a service, so being virtual or in person shouldn’t affect reimbursement. 

The other penalizes telehealth for its efficiencies. In face-to-face visits, “there are built-in inefficiencies that isn’t time spending with the person,” says Dr. Katherine Dallow, vice president of Clinical Programs at Blue Shield Blue Cross of Massachusetts. “I probably spend somewhere between two to five minutes per patient moving from one room to another or pausing to document or checking something on their file or handing something off.” With less provider time and less pro rata overhead, some states reason, there should be less reimbursement. 

Forty states have their own private payer telehealth reimbursement policies, and six have private payer parity laws requiring the same reimbursement for in-person and telehealth care. 

Stricter privacy protections 

The Health Insurance Portability and Accountability Act (HIPAA) is the federal umbrella protecting privacy and confidentiality of patient records, but states are allowed to go beyond it. Many do. 

For example, if there’s a breach of privacy, HIPAA requires that the patient be notified within 60 days. Some states shorten that to 30 days, and California shortens it to ten. Some states also require hospitals to notify the state attorney general and the three major credit reporting companies: Equifax, Experian, and TransUnion. If there’s a breach of an out-of-state telehealth patient’s confidentiality, do you know what the originating state requires? 

Multi-state provider licensure 

Almost all states require physician licensure where the patient is (also known as the originating location). Same for nurses, nurse practitioners, physicians’ assistants, clinical psychologists, registered dieticians, and physical therapists. Different states have different licensing procedures, and there’s no federal umbrella. That’s something you’ll need to look out for, not only with faraway states, but also in New York, New York; Chicago/Hammond, Ind.; Texahoma, Texas/Okla.; or any of 84 other communities that straddle state lines. 

(Speaking of licensure, is your hospital licensed to provide telehealth services? In how many states?) 

Can doctors prescribe online? 

State regulations for phone-in prescriptions from the late 1990s adapt pretty well to online prescriptions today. The problem is, they differ from one state to the next. Different states have different regulations on just what a valid prescription is. About whether the doctor can prescribe without seeing the patient first, and whether seeing a patient on a computer screen is really “seeing.” About whether there has to be a previous doctor/patient relationship, and whether that relationship can be remote or has to be face-to-face. 

Related: Interstate regulations aren’t the only telehealth complexity. Check out this blog post for more: Telehealth compliance considerations: looking ahead. 

Two ways to keep up; one is practical. 

Complying with more than 50 sets of regulations takes a lot of attention to detail and a lot of reading. One way to keep up is with sheer effort: health organizations designate one or more people to read and track all the regulations that affect them.  

A better, more practical way is to rely on expert compliance professionals and nationally respected law firms to keep you up to date on interstate issues in telehealth regulation. YouCompli users select the agencies that matter to their organizations and receive updates and resources to help them know about new regulations, decide their applicability, manage policy changes, and verify compliance.  

Are you looking for ways to track telehealth regulations in all the states your patients receive treatment? Take a look at YouCompli, the only healthcare compliance software combining actionable, regulatory analysis with a simple SaaS workflow.  

Jerry Shafran is the founder of YouCompli. 

Take as directed: Medication compliance and the Compliance office

Working toward higher rates of patient medication compliance is a critical component of patient care. That includes communicating what the medications are, what they do, and how to take them. Providers are keen to ensure they provide clear directions and to be sure patients can pay.  

It’s no wonder they take such care: Each year, about 125,000 Americans die due to poor medication adherence, according to the American Heart Associationi. Improper compliance practices come with a hefty price tag of $528 billion in annual expenses, according to a 2019 OptimizeRx surveyii.  

What’s more, medication mismanagement is a strong predictor of hospital readmission rates. Individuals who failed to take prescribed medication as directed had a 20 percentiii chance of hospital readmission within 30 days, compared to 9 percentiv for patients who take meds as directed.  For the compliance officer, keeping hospital readmission rates low is crucial to avoid wasteful spending, per the Centers for Medicare and Medicaid guidelines.    

So many factors contribute to whether a patient properly follows through with medication instructions. Providers and administrators alike do their best to put systems and communications in place that make compliance easier. While not within a compliance officer’s direct control, there are policies and procedures that can help hospitals comply with CMS requirements to lower readmission rates. This helps facilitate better health outcomes and increased quality of life for patients.    

So how can you ultimately help patients improve medication management skills? Here are a few tips you can include in your medication compliance plan to help reduce readmission rates. 

Discuss side effects 

Patients who experience side effects may stop taking their medication altogether; without discussing this decision with their healthcare provider.   

That’s why it’s so important for doctors to discuss common and possible side effects with patients.  

Work with healthcare providers at your facility about how they can discuss any treatment plan changes to lessen the chances of side effects. Make it known that the treatment plan may include adjusting the dosage or changing the medication altogether.  Cut Out Distractions 

According to BMC Health Services Researchv, three out of five patients often forget to take their medication.   

Are distractions the main culprit? Encourage providers to discuss the importance of taking meds at the same time each day.  

Maybe patients can use a cell phone alarm to set up reminders. Taking multiple medications at different times? The workaround may be to set other alarm times for numerous times during the day.  

To make things even easier on patients, providers may consider prescribing once-daily medications.  

Providers may consider collaborating with the patient on the best time to take the medications when distractions are at their lowest.  

Money worries 

Sometimes the issue of medication compliance comes down to cost. About 70 percentvi of physicians link high prescription costs to a lack of medication adherence.  

To save money, they may ration meds or not take them at all.  

In a study published in Circulation, viione in eight patients with heart disease didn’t take prescribed medication because of the expense.  

Luckily, there are resources such as GoodRx, an app that allows anyone to shop at local pharmacies for the lowest prescription medication prices.   

Doctors can also prescribe generic versions of meds whenever possible to cut back on costs.   

Communicate more 

Poor communication is a deterrent to medication compliance, which is in turn linked to poor health outcomes.  

Fortunately, Motivational Interviewing can help. With Motivational Interviewing, health care providers are encouraged to ask open-ended questions beginning with What, Why, How, and When during discussions about medication usage. This technique is shown to improve behavioral change and adherence, as reported in Perspect Public Healthviii.   

This PDF by The Motivational Interviewing Network of Trainers provides more information on motivational interviewing.  

Medication compliance helps patients experience better health outcomes, reducing readmission rates and helping the hospital avoid tripping CMS’s indicators for fraud, waste and abuse. While much of the responsibility lies with the patient, hospital policies and procedures can help ensure the patient has the best possible chance to understand and comply with medical guidance.  

YouCompli helps healthcare facilities know about regulations, decide if they apply to them, manage policy and procedure rollout, and verify compliance efforts. Learn more 

i American Heart Association 
ii OptimzieRX survey 
iii 20 percent 
iv 9 percent 
v BMC Health Services Research 
vi 70 percent 
vii Circulation 
viii study