Telehealth compliance considerations: looking ahead

Telehealth seems to be here to stay, even as the Coronavirus pandemic begins to recede in the United States. It’s a good time for healthcare institutions to make sure their telehealth practices hold up outside of emergency circumstances. 

From a compliance perspective, that means  patient privacy and technology, valid consent for treatment, visits with minors, and interstate care.    

 

Patient privacy in telehealth

Patient privacy is just as important in telehealth as it is for in-person visits. This includes ensuring the provider conducts visits in a private space and documenting the visit in a secure medical record.   

During the Coronavirus national public health emergency, the federal government has some enforcement discretion with telehealth. Regulators can choose not to impose penalties for Health Insurance Portability and Accountability Act (HIPAA) violations if they see that a provider took precautions to protect patient privacy provider. Good faith might mean using a platform like Microsoft Teams, Zoom, or WebEx and patient-specific passcodes – and still having a privacy breach. In a case like this, the regulator has the discretion not to impose fines under HIPAA. 

 

Consents and visits with minors 

Developing a process to obtain consent to treat before the first visit can help you comply with consent requirements. This may include mailing or securely emailing the consent to the patient (or parent or legal guardian) the week before the telehealth visit and having the patient send it back.  This gives the provider time to answer the patient’s questions about consent for treatment.   

For urgent telehealth visit, make sure there are policies in place to address telephone/verbal consent or to obtain two provider consents.  If your system allows, you may be able to electronically send the consent. The patient can sign it online so you can add it to the electronic health record.  

Whatever method to obtain consent your organization chooses, ensure there is a policy addressing the proper procedure and educate the team on the policy.   

For telehealth visits with minors, try to follow the same process as for in-person visits. That means you should obtain the consent to treat and have it signed by a parent or legal guardian.  Then have the parent or legal guardian attends the telehealth visit with the minor patient.  This way diagnosis, care, and treatment plan can be discussed with the patient and the parent or legal guardian at the same time.  

 

Crossing state lines for telehealth

Things to consider if the patient and provider are not conducting the telehealth visit in the same state: 

  • Licensing: Some state licensing boards have reciprocity. Some may not require an additional license in compact states while others may require a temporary or actual license to provide care in that state. This often applies to care provided via telehealth. 
  • Prescriptions: Can you prescribe across state lines? Avoid compliance issues by sending the prescription to a pharmacy in the provider’s “home” state. Then have the patient request a pharmacy-to-pharmacy transfer of the prescription. 
  • Your insurance: Does your medical professional liability (MPL) insurance provide coverage if you are out of state? How about if the patient is located outside your “home” state? Contact your MPL insurer to be certain you have coverage in the event of an out of state lawsuit. 
  • The patient’s insurance: What will the patient’s insurance cover for visits conducted out of the patient’s “home” state?  Be sure to verify this before the patient’s telehealth visit to ensure proper billing and reimbursement for the visit and to decrease billing denials.   

Considerations for adding telehealth as a service line 

There are resources available for organizations considering adding telehealth as a permanent service line. YouCompli can help you understand which regulations apply to you, stay on top of changes, and manage implementation.  

You can also find many free resources online:  

For many types of visits, patients love the option of telehealth. As providers work to be sure that they continue to deliver quality care, Compliance teams have an equally big job to be sure the systems and processes are in place to support that experience. 

Keep on top of regulations affecting telehealth and making sure those regulations are translated into policies and procedures that affect patient care. YouCompli customers have access to notifications about changes to regulations, resources to inform policy and procedure updates, and tools to track compliance. Contact us today to learn more. 

Denise Atwood, RN, JD, CPHRM is the Chief Risk Officer at District Medical Group (DMG), Inc., vice president of DMG Insurance Company (DMGIC), and owner Denise Atwood, PLLC.   

Disclaimer: The opinions expressed in this blog are the author’s and do not represent the opinions of DMG. 

Denise Atwood, RN, JD, CPHRM has over 30 years of healthcare experience in compliance, risk management, quality, and clinical areas. She is also a published author and educator on risk, compliance, medical-legal and ethics issues. She is currently the Chief Risk Officer and Associate General Counsel at a nonprofit, multispecialty provider group in Phoenix, Arizona and Vice President of the company’s self-insurance captive.  

Organization Liability: Impact and Risk Mitigation (Part II)

liability risks in healthcare denise atwood

Impact of Risk Liabilities 

Unmanaged or poorly managed risk can cause devastating effects to the organization from a reputational and financial perspective. 

An extreme example of financial risk, coupled with nationwide reputational risks, was the Tylenol case in the 1980’s. The New York Times describes how, in 1982, Extra-Strength Tylenol capsules were tampered with and laced with potassium cyanide. Seven people in the Chicago area died and copycats caused several more deaths across the U.S. As a result of those incidents, tamper-resistant packaging was created and implemented so over-the-counter products, such as Tylenol, could not unknowingly be laced with a poison which could cause injury or death. 

Despite the fact that the manufacturer had not introduced the poison, this event led to huge financial  and reputational liability for McNeil Consumer Healthcare, the makers of Tylenol. On just the financial side, this cost a considerable amount of money due to decreased sales and increased advertising costs. 

As this example demonstrates, financial and reputational risk for an organization in the healthcare field can have disastrous consequences that threaten to bankrupt or put the organization out of business. If the event or incident is sufficiently egregious, the organization could also face loss of accreditation or state licensure. If this happens, they may also lose Medicare and Medicaid contracts.   

Risk Mitigation 

Proactive risk mitigation strategies include transfer of risk, through such vehicles as contracts and insurance, and early reporting of incidents or events by staff. 

Transfer of risk in contracts in typically done with indemnity or hold harmless clause. Transfer of risk via insurance is done by ensuring the organization has adequate coverages and retentions to meet the organization’s needs.  

The intent of an indemnity clause is to transfer the risk of financial loss from one party to the agreement to another party to the agreement. Generally, this is financial losses or expenses caused by contract breach or default, negligence, or misconduct by one of the parties.  

Hold harmless language in the contract states one party will not hold another party responsible for potential risks or damages. Hold harmless clauses can be unilateral and apply to just one of the parties to the contract or can be bilateral and apply to both parties to the contract. Typically, bilateral hold harmless language is preferred for healthcare organization contracts because each party will assume their own risk and not sue the other party to the contract for the risk which was assumed.   

Early reporting by staff is crucial in order to ensure that appropriate action, discussion, documentation and reporting takes place. Most importantly, this is necessary to ensure that risk mitigation strategies can be implemented to eliminate or decrease risk to the organization.   

PRACTICE TIP:  

  1. Develop and conduct risk assessments of insurance policies and large contracts to identify areas for improvement. 
  2. Review contracts to ensure indemnity or hold harmless clauses have been included.  If not, add the clauses on renewal.  
  3. Work with Risk Management to conduct a risk assessment to evaluate organization risks and implement mitigation plans.  

Denise Atwood, RN, JD, CPHRM 

District Medical Group (DMG), Inc., Chief Risk Officer and Denise Atwood, PLLC 

Disclaimer: The opinions expressed in this article or blog are the author’s and do not represent the opinions of DMG.  

Denise Atwood, RN, JD, CPHRM has over 30 years of healthcare experience in compliance, risk management, quality, and clinical areas. She is also a published author and educator on risk, compliance, medical-legal and ethics issues. She is currently the Chief Risk Officer and Associate General Counsel at a nonprofit, multispecialty provider group in Phoenix, Arizona and Vice President of the company’s self-insurance captive.  

Sign-up for the YouCompli Blog to Stay Up to Date on Compliance Related News!

 Manage your healthcare regulatory change process effectively and efficiently

YouCompli enables the compliance officers to assign ownership and oversight of tasks to different department heads, functional leaders, or specialists. The solution prompts users to accept, reject, or reassign the task by a stated deadline. Manage the rollout and accountability of new requirements with the best workflow in the business.

Organization Liability: Types of Risk (Part I)

liability types of risk denise atwood

Risk is an important concept for compliance professionals working in the healthcare space to understand. After all, there are many times where risk and liability have crossover to compliance.

For example, in response to a suspected email or electronic health record breach, compliance and risk professionals will need to work together. This work will include:

  • Evaluating the breach
  • Reporting to the insurance carrier
  • Collaborating with a breach coach or legal team to ensure the investigation meets legal requirements and timelines
  • Collaborating with the information technology team and a forensics firm to ensure risk mitigation strategies are implemented and effective

And so on.

Generally speaking, healthcare compliance professionals should have a good working knowledge of organization risks and liabilities, as well as risk mitigation strategies.

This raises two important questions:

  1. What areas of risk do healthcare organizations face?
  2. What are the potential liabilities related to unmanaged or poorly managed risk?

Areas of Risk for a Healthcare Organization

Areas of risk for a healthcare organization are vast, and can involve injury to persons, property and reputation. Several areas of risk include:

Patient safety risks

These include near misses, which are mistakes which almost make it to the patient, as well as events or incidents that do make it to the patient, causing the patient to experience an unanticipated outcome such as a longer hospital stay, disability or death.
For example, a nurse may realize before giving a vaccine to a child that the adult vaccine and dose was drawn up in the syringe instead of the pediatric vaccine and dosage. This would be a near-miss. Along those same lines, a mistake occurs if the adult vaccine dose is actually administered to the child and an allergic reaction occurs.

Operational risks

These include such things as business interruption or supply chain issues. Business interruption incidents may include fire, flood, or pandemic. If the electronic medical record system goes down, and staff have to chart by hand on paper, this would be a business interruption. Supply chain issues can occur due to higher than normal demand or decrease in output by the manufacturer. If an organization cannot obtain needed supplies – such as hand sanitizer or surgical masks – that would be an example of a supply chain issue.

Legal risks

These typically involve lawsuits filed against the organization. Most commonly, lawsuits result from allegations of inappropriate employment practices or medical negligence or malpractice. For example, if a child had an allergic reaction after receiving an adult dose of a vaccine and unfortunately passed away, the parents may file a lawsuit alleging medical malpractice or negligence on behalf of the organization, the provider or the nurse who administered the incorrect vaccine.

Insurance risks

Insurance risks generally stem from a lack of adequate or appropriate insurance coverage or failure to transfer risk. Insurance risks can also connect to legal risks, which can stem from contracts with inadequate risk transfer or failure to conduct due diligence to vet the vendor. In the case of a pandemic, healthcare and other organizations may not have realized that pandemics and resulting business closures may be excluded from their business interruption insurance policy.

Human capital risks

These encompass the inability to hire, contract or retain appropriately trained staff. A lack of ICU level nurses causing staffing shortages would be an example. Human capital risks can also include professional board or licensing complaints against the organization’s doctors, nurses, therapists, or other licensed staff.

Reputational risks

Reputational risks are often forgotten or invisible to an organization until a bad event happens and it is announced to the public – at which point it is too late.

Reputational risk used to be limited to bad publicity which was published in print or reported on television. However, with the increased acceptance and use of social media, reputational risks are more far-reaching than the local newspaper or evening news program, and could potentially have national reach and negative impact on the organization . A newspaper may not run a story about a child who received an incorrect vaccine, but the child’s mother could post to Facebook or other social media platforms that the organization and providers are terrible and not to be trusted.

Practice Tips:

  1. Schedule a meeting with your insurance broker to evaluate your insurance policies by product line (i.e., general liability, property, cybersecurity, etc.) to ensure the organization is adequately covered to protect against most business losses.
  2. Educate staff to ensure they know how and where to report near-misses and mistakes that occur in the organization.
  3. Work with Risk Management to conduct a risk assessment to evaluate organization risks and implement mitigation plans.

Denise Atwood, RN, JD, CPHRM
District Medical Group (DMG), Inc., Chief Risk Officer and owner of Denise Atwood, PLLC
Disclaimer: The opinions expressed in this article or blog are the author’s and do not represent the opinions of DMG.

Denise Atwood, RN, JD, CPHRM has over 30 years of healthcare experience in compliance, risk management, quality, and clinical areas. She is also a published author and educator on risk, compliance, medical-legal and ethics issues. She is currently the Chief Risk Officer and Associate General Counsel at a nonprofit, multispecialty provider group in Phoenix, Arizona and Vice President of the company’s self-insurance captive.  

Sign-up for the YouCompli Blog to Stay Up to Date on Compliance Related News!

Manage your healthcare regulatory change process effectively and efficiently

YouCompli enables the compliance officers to assign ownership and oversight of tasks to different department heads, functional leaders, or specialists. The solution prompts users to accept, reject, or reassign the task by a stated deadline. Manage the rollout and accountability of new requirements with the best workflow in the business.

Protecting Hospital Finances in the Post-Pandemic Environment

It’s become a cliche, especially in healthcare, to say that COVID-19 has changed “everything”. One thing that has clearly changed, however, is hospital finances.

Pandemic response stretched every healthcare system in the United States, many to the breaking point. Revenues from non-COVID procedures were significantly reduced, to the point that furloughs of vital medical staff have become necessary.

In this environment, compliance professionals have an important role to play. Ensuring that all payment compliance regulations are being followed helps to protect existing revenue streams, and helps to get the system back on a strong financial footing. As hospitals are getting “back to normal” and trying to find ways to bolster their budgets, good compliance practices are vital.

Outstanding Payments and Patient Insurance

In-hospital treatments declined during the pandemic; however, virtual health visits significantly increased. It’s crucial to continuously monitor payment compliance practices, which include patient insurance information, especially when offering this new treatment vector.

Pre-pandemic, the number of Medicare patients increased by 11 million since 2014, and at least 37 states expanded Medicare eligibility in 2019. While it’s hard to say where Medicare coverage will go as government budgets also come under pressure, these numbers could mean that some outstanding medical bills may be covered.

Historically, about 1% to 5% of self-pay accounts, or patient out of pocket costs, are written off by hospitals as bad debt. Checking and double-checking that your institution has the right information about patients, now and going forward, can be a key step in keeping the hospital financially strong.

The number of uninsured patients has continued to grow — by 12% towards the last months of 2017, and 27 million Americans have lost their employer-provided insurance during the pandemic. Overall, improving payment compliance practices in relation to insurance is an important step in effectively managing these, and other, challenges with patient payment balances.

Reducing Readmission Rates and Penalties

If your hospital serves Medicare and Medicaid patients, you probably know the high number of readmissions that occur in typical months. Readmissions that take place within 30 days of an initial visit cost hospitals a staggering $41.3 billion. In a post-COVID world, these patterns may not hold — but that could mean that readmissions are going to go up, not down.

CMS instituted several programs to try to manage these readmission challenges.

  • The Hospital Readmissions Reduction Program (HRRP): rewards hospitals for lowering readmission rates for common health conditions like heart attacks, pneumonia, COPD, and total hip and knee replacement surgery
  • The Hospital-Acquired Condition Reduction Program (HACRP): encourages a reduction in avoidable infections resulting from colon surgeries and hysterectomies, bedsores, sepsis, and even blood clots

Hospitals with, according to CMS, higher than average readmission rates face steep penalties and lower claims reimbursement. In the fiscal year 2020, pandemic notwithstanding, 83% of the 3,300 hospitals in the U.S. were projected to face penalties. And these penalties can be as high as a 3% reduction in repayment. Across the United States, CMS penalizes the worst-performing hospitals with a 1% reduction in total claim reimbursement.

As hospitals reopen and restart regular procedures and treatment, and try to rapidly scale revenue generation, more hospitals may face penalties, if compliance practices are not strong. Surprisingly, at least 12% of readmission cases of readmission cases are preventable, according to the Medicare Payment Advisory Commission (MedPAC).

Two ways hospitals can comply with CMS’ regulations and boost patient care are:

  1. Embrace a process that sends discharge summaries to the primary care physician
  2. Assign staff follow-up on post-discharge test results.

Setting up such a process can be tricky, especially in larger hospital facilities and in facilities that are still challenged in the aftermath of COVID. Medical staff need to be able to consistently and quickly assign, track, and review summaries and test results.

Monitoring each step of the process is necessary to ensure that your organization is taking the proper steps to adhere to Medicare and Medicaid requirements. That way, your hospital easily avoids significant penalties while boosting patient care. CMS also recommends that hospitals be on the lookout for hospital-related illnesses, which can derail patient care standards.

What You Can Do

Staying on top of the ever-changing world of CMS regulations isn’t easy, especially as we emerge from the pandemic crisis. But we can help by providing you with expert advice and tools that target the regulations and policies needed to run your hospital compliance program more effectively.

Our fully customizable software helps you and your revenue cycle team stay on top of every regulation, so you’ll have the best possible chance of meeting essential mandates, keeping cash flowing and avoiding penalties.

See YouCompli in Action

Easier, faster, more effective compliance is possible

Learn More

Earning the Gold Seal of Approval from the Joint Commission

Revised September 2022

Complying with the latest regulations will always be a critical priority for healthcare compliance professionals. But earning approval from The Joint Commission, the recognized global leader for health care accreditation, is growing in importance across healthcare organizations, including hospitals, physician group practices, surgery centers, and other treatment facilities. 

This accreditation, known as The Gold Seal of Approval®, acknowledges an organization’s dedication to providing quality care and services to patients. Some states require health care organizations to be accredited by the Commission in order to participate in particular insurance programs.  

If a healthcare organization is accredited by The Joint Commission, it may be deemed to exceed Centers for Medicare and Medicaid (CMS) requirements, along with state law requirements. Additionally, with the public’s attention increasingly focused on becoming informed consumers, earning accreditation also offers organizations a competitive edge.   

Meet the Joint Commission 

The Joint Commission is an independent, not-for-profit organization based in Illinois. Founded more than 65 years ago, the Commission provides an unbiased assessment of a health care organization’s quality achievements in patient care and safety. 

It offers the following accreditation programs: 

  • Ambulatory Care Accreditation 
  • Behavioral Health Care Accreditation 
  • Critical Access Hospital Accreditation 
  • Home Care Accreditation 
  • Hospital Accreditation 
  • Laboratory Services Accreditation 
  • Nursing Care Center Accreditation 
  • Office-Based Surgery Accreditation 

In addition, The Joint Commission offers 20 different certifications for a variety of clinical programs and services. 

Understand the Accreditation Process 

The Commission’s standards set expectations for an organization’s performance that are reasonable, achievable, and measurable. Its on-site surveys are rigorous and are customized for each organization and its efforts to improve patient outcomes. And the start of a survey is usually unannounced. 

During an on-site survey, Commission surveyors perform their evaluation by: 

  1. Tracing the care delivered to patients, residents, or individuals served 
  1. Reviewing the information and documentation provided by the organization 
  1. Observing and interviewing staff and, when appropriate, patients 

The Commission provides a Summary of Survey Findings Report at the conclusion of the on-site survey, with a final accreditation decision made at a later date. Surveyors could recommend: 

  1. Preliminary accreditation 
  1. Accreditation 
  1. Accreditation with follow-up survey 
  1. Preliminary denial of accreditation 
  1. Denial of accreditation 

An organization’s accreditation is continuous as long as it has a full, unannounced survey within 36 months of the previous survey and it meets all accreditation-related requirements. 

Benefits from Accreditation 

The Gold Seal of Approval is a way to let medical professionals, government regulators, and patients know that an organization stands for quality care, and that it’s always seeking ways to identify known or unknown risks to patient safety. 

For example, healthcare organizations that want to participate in Medicare have to be certified to have met specific CMS quality-related standards. If the organization is accredited by The Joint Commission, CMS will have deemed the entity to have met or exceeded these requirements. That means the organization is not subject to Medicare’s survey and certification process because it has already gone through the Commission’s survey process. 

Additionally, being Commission-accredited may allow the organization to be exempt from meeting state law survey or quality or requirements. Here you want to be sure and check your state laws to see if they exempt entities accredited by The Joint Commission. 

In what other ways can an organization benefit from Joint Commission accreditation? 

  • It can earn various Joint Commission certifications for continued improvement and maintaining performance excellence 
  • It can connect with other like-minded organizations to collaborate on issues affecting the quality and safety of patient care 
  • It can attract more qualified personnel who prefer to serve in a prestigious environment 

Earning Accreditation Means Maintaining Compliance 

Earning the Joint Commission’s Gold Seal of Approval depends on a strong culture of compliance. Organizations that are challenged to manage compliance, or effectively demonstrate compliance, are unlikely to meet the Joint Commission’s rigorous standards. (Read more about Compliance Culture on the YouCompli blog.) 

A culture of compliance is a commitment throughout all levels of an organization to do the right thing and do things right.  When an organization has a strong culture of compliance, there is a spillover effect to obtaining and maintaining Commission accreditation.  Employees see their leaders ensuring the organization is maintaining compliance with elevated standards. Additionally, they see their leaders making business decisions based on organizational policy requirements.  The end result is actions being taken that demonstrate leading by example and modeling that behavior to employees. 

The Gold Seal of Approval accreditation is an important acknowledgment of an organization’s dedication to providing quality care and services to patients. The effort to earn this accreditation is certainly significant, but the payoff in terms of reputation, recruiting and deeming status is worth the effort. Not only that, the process of earning accreditation can help you uncover opportunities to further shape your culture of compliance so that a mindset of always doing the right thing permeates all levels of your organization. All of that is good for the long-term health of your business – and your patients.  

The accreditation process requires significant metrics to demonstrate the effectiveness of your compliance program, YouCompli can help you verify that you took the proper steps to comply with the regulations that apply to you. Find out how.  

Jerry Shafran is the founder and CEO of YouCompli. He is a serial entrepreneur who builds on a solid foundation of information technology and network solutions. Jerry launches, manages, and sells software and content solutions that simplify complex work. His innovations enable professionals to focus on their core business priorities.

Never Miss a Compliance Related Article

How to Juggle Medicare and Medicaid Compliance in a Fluid Regulatory Landscape

Do you treat patients insured by Medicaid or Medicare at your hospital? While participation is voluntary for for-profit healthcare systems, accepting Medicaid and Medicare patients is a condition of federal tax exemption for non-profits. Currently, Medicare and Medicaid account for more than 60 percent of care provided by hospitals making it nearly impossible for healthcare systems to forgo these programs.

So, if the stark reality is that you must participate, compliance becomes an issue. And it’s complex. Especially for hospitals that have multiple outpatient locations and inpatient campuses. Under Medicare provider-based rules, it’s not possible to certify just part of the system. When you consider there’s nearly a 500-page certification process, it’s clear that it’s crucial to have effective compliance tracking.

An effective compliance program is multi-faceted and includes monitoring and auditing, legal reviews of procedures and contracts, reporting mechanisms as well as training for employees. Healthcare systems are multi-faceted too with labs, pharmacies, rehabilitation centers, clinics, surgery centers and more. Keeping on top of compliance not only to effectively report but to identify and then prevent misconduct before it balloons into a much bigger problem is anything but easy.

The Centers for Medicare & Medicaid Services has attempted to streamline information into quarterly updates for providers, suppliers and the public. While this helps curate the information and updates to regulations, management and oversight of compliance and putting these regs into practice represents an enormous task for each healthcare system. The distance between knowing and doing can be vast when providers are juggling regulations alongside providing quality patient care. Maintaining oversight of not just the Medicare and Medicaid federal regulations, but compliance with other state and local regulations is required.

The regulatory landscape continues to be muddled with additional requirements to safeguard privacy and to fight fraud and abuse today. Since governing bodies are vigilant about fighting fraud, your compliance process needs to be tight or you’ll risk criminal charges, fines and even the possibility of losing licenses. Every state has its own Medicaid Fraud Control Unit (MFCU), typically as part of the State Attorney General’s office. When your compliance tracking system is thorough, the auditing process and working with your MFCU becomes simpler.

Streamline Compliance Tracking

If your hospital is juggling Medicare and Medicaid payment compliance along with all the other mandates and reporting requirements, it can easily get overwhelming. But, it doesn’t have to be that way. Solutions such as youCompli’s compliance system monitors and translates Medicare and Medicaid regulations for easier understanding. Then, it helps you track and oversee your hospital’s compliance.

If you’re ready to take the headache out of Medicare and Medicaid compliance, it’s time to see what a compliance management system can do for you. Schedule a call today where you can see how our risk management software can support your healthcare system’s compliance program.

Legal Challenges and the Benefit of a Comprehensive Compliance Program

The list of compliance and legal challenges facing providers, hospitals and healthcare systems over the next year is long:

  • Physician arrangements and fair market value;
  • Mergers and acquisitions;
  • Quality metrics and risk sharing;
  • Fraud, waste, and abuse;
  • Coding and billing transactions;
  • Reimbursement;
  • Medical staff issues and burnout;
  • Labor and employment issues;
  • HIPAA and HITECH; and
  • Technology and integrated medical devices.

A list like this can seem daunting. However, a comprehensive compliance program with appropriate resources can help avoid disastrous results related to healthcare compliance and legal challenges.

Labor and Employment Law

The Atlantic reported in January 2018, “Health Care Just Became the U.S.’s Largest Employer In the American labor market.”  The growth of the healthcare sector brings increased labor and employment challenges.  Although the terms are often used synonymously, labor law focuses on groups of workers (think unions and collective bargaining) while employment law focuses on individual workers, (think discrimination of an individual in a protected class).

A comprehensive compliance program will decrease labor and employment law challenges, by ensuring human resource policies and procedures comply with federal and state laws.  Moreover, personnel file audits will demonstrate compliance with those laws.

Transactional Law

Mergers, acquisitions, partnerships, joint ventures and U.S. antitrust law

The Agency for Healthcare Research and Quality (AHRQ) reported in its 2018 National Healthcare Quality & Disparities Report that almost 70% of U.S. hospitals and 43% of primary care physicians are part of consolidated health care systems. Consolidations require an astute compliance and legal team to ensure compliance with antitrust law. These transactions continue to draw scrutiny from the Federal Trade Commission due to monopoly concerns.

The challenge for healthcare organizations is even greater when business crosses state lines. The organization must then comply with multiple state laws simultaneously.  As part of a comprehensive compliance program, a compliance professional should work closely with in-house or outside counsel to ensure the business transactions and consolidations include a compliance due diligence perspective, for example reports to the board of directors.

Security Law

HIPAA

Compliance is mandatory; failure to comply is an opportunity to ruin an organization both financially and reputationally.  Ransomware attacks on healthcare providers through their computers and medical devices are on the rise. While most IT departments focus on HIPAA security for computers, few address security issues with interconnected medical devices.

A comprehensive compliance program will include recommendations to address the management of cybersecurity for medical devices like those outlined by the U.S. Food and Drug Administration (FDA).

Practice Tips

  1. Use of reports to support legal defense of employment or labor law violations, if needed.
  2. Use of notification and management system to prevent legal challenges by providing up-to-date guidance to support compliance activities.
  3. Conduct an evaluation of medical devices in accordance with the FDA FAQ. Disable the voice recognition feature of smart devices while conducting confidential discussions in a room with a smart TV or speaker.

A system such as youCompli is a strong addition to a comprehensive compliance program, providing up to date notifications of regulatory change, as well as full insight and audit of the compliance process.

Denise Atwood, RN, JD, CPHRM
District Medical Group (DMG), Inc., Chief Risk Officer and owner of Denise Atwood, PLLC
Disclaimer: The opinions expressed in this article or blog are the author’s and do not represent the opinions of DMG.

Denise Atwood, RN, JD, CPHRM has over 30 years of healthcare experience in compliance, risk management, quality, and clinical areas. She is also a published author and educator on risk, compliance, medical-legal and ethics issues. She is currently the Chief Risk Officer and Associate General Counsel at a nonprofit, multispecialty provider group in Phoenix, Arizona and Vice President of the company’s self-insurance captive.  

Audit Expectations and Challenges

When it comes to hospitals providing best-in-class health care, stress comes with the territory. From stabilizing trauma victims, to accurately distributing medications, to physicians and nurses working long shifts, increased demands are everywhere — including operations not directly involved with patient care. One demand that can turn daily routines completely upside-down and compound stress is an audit. A GRC compliance audit can be conducted internally by various hospital committees or externally, often by government-approved contractors.

Internal Audits

An internal audit seeks to determine if a hospital’s financial and operational controls, and their related policies and procedures, meet compliance and risk management demands.

Based on a hospital’s risk assessment, management develops and reviews the scope and goals of an audit. Running the audit is then delegated to a committee, with the most common committees focusing on:

  • Patient safety
  • Nursing staffing
  • Clinical quality
  • Medical staff

An internal audit involves interviews and evaluating personnel or procedures. Upon the audit’s completion, a report of its findings is prepared by the appropriate committee and shared with management. Corrective recommendations of action to any areas of noncompliance are collaboratively developed, and a finalized report is presented to the hospital’s board of directors, chief compliance officer, and audit and compliance committee.

The ultimate goal of an internal audit is to improve patient care. Who in a hospital wouldn’t want to improve it, right? But the truth is that an audit can diminish quality of care while it’s in progress. That’s because committees are often comprised of physicians, nurses, and technologists who are pulled away from patient-care responsibilities to work on compliance administrative tasks.

External Audits

According to a 2017 AHA report, four federal agencies — the Centers for Medicare & Medicaid Services, the Office of Inspector General, the Office of Civil Rights, and the Office of the National Coordinator for Health Information Technology — are the primary drivers of regulations and compliance costs across eight domains for hospitals:

  • Hospital conditions of participation
  • Billing and coverage verification requirements
  • Meaningful use of electronic health records
  • Quality reporting
  • Privacy and security
  • Fraud and abuse
  • Program integrity
  • New models of care

The frequency and pace of regulatory changes implemented by multiple federal agencies are dizzying. Hospitals are often required to comply with regulations in very short timeframes, requiring a significant investment of staff time and finances. What’s more, responding to multiple external audits increases administrative costs, and funds could be tied up in lengthy appeals processes contesting an auditor’s inappropriate determination.

External audits are conservatively estimated at $100 per hour. For example, consider the total costs of a HIPAA audit:

  • HIPAA Gap Assessment — Identifies gaps and provides remediation plans for those gaps
    (40 hours average, $24,000–34,000)
  • Full HIPAA Audit — Assesses hospitals against all the requirements in the HIPAA Security Rule
    (100 hours average, $30,000–60,000)
  • Validated HITRUST Assessment — Provides the most complete, certifiable framework for HIPAA to mirror PCI compliance (400 hours average, $100,000–160,000 — with costs much higher for larger organizations)

Protect Your Hospital

If your hospital is like most others, it’s spending too much staff time and money dealing with a blizzard of regulations and an avalanche of red tape. Fortunately, there are solutions. youCompli GRC risk management software monitors, reads, and translates complicated regulations into plain English. Our solution enables you to fully understand which rules are pertinent to maintaining compliance, further simplifying the auditing process. And it tracks everything, from end to end, making audits much less painful.

Learn how youCompli regulatory compliance management software protects your hospital.