The OIG’s Beneficiary Inducement Final Rule is part of HHS Regulatory Sprint to Coordinated Care – Advancing the transition to value-based care.
Continue readingBeneficiary inducement rule changes promote coordinated care
Communicating Compliance Terms in Plain English…
If you have ever been new to a particular field of the workforce, such as healthcare compliance, you know all too well that the language used by coworkers can sound foreign, like gibberish, or “alphabet soup.” As we continue to work in the field though, we too, start speaking the language. However, while that may be ok for conversing in the compliance department, it still be confusing if we are trying to communicate with, or to educate, other functional areas of the healthcare organization. Without knowing the terminology, the message we are trying to convey is unlikely to be understood when received.
Alphabet Soup
Take a look at an example of terminology just starting with the letter “A” from the Office of the Inspector General Work Plan (reference below):
- ADAP AIDS Drug Assistance Program (note this one includes an abbreviation in the definition);
- AI/AN American Indians and Alaska Natives (I, for one, was unfamiliar with this abbreviation);
- AIDS acquired immunodeficiency syndrome;
- ALF assisted living facility;
- ALJ administrative law judge;
- AMD age‐related macular degeneration (while I have heard of macular degeneration, I did not know this was a standard abbreviation);
- AMP average manufacturer price;
- ASC ambulatory surgical center;
- ASP average sales price; and
- AWP average wholesale price.
Say I am talking to another seasoned compliance professional in front of a new employee. Using the above “A” acronyms only, the conversation may sound something like this,
“Based on the billing audit, I see we are not receiving contracted AWP reimbursement under our AI/AN contract for ALF patients with AMD.”
As you can imagine, a new employee might be confused by the acronyms and terms communicated instead of using common business English. Sometimes just saying the entire word instead of the abbreviation is a good place to start, so instead of saying AWP say average wholesale price.
Repetitive Communication
In order to improve communication between seasoned compliance professionals and other members of the organization, it is important to use repetitive teaching strategies. In addition to saying the entire compliance term and the abbreviation, be repetitive and write out the compliance term in addition to the abbreviation in written communications. That way staff become more familiar with compliance terminology and it becomes a part of their daily vocabulary.
Knowledge in Practice
When it comes to any industry, including healthcare, it is easy to throw around acronyms and jargon that is familiar and efficient. However, it is important to be aware of who you are talking to, and therefore make sure they clearly understand whatever it is you are communicating. Translate and reword industry terminology in emails, policies and teaching materials where necessary in order to improve communication and understanding. Better compliance will ultimately be the result.
PRACTICE TIP:
- Regularly evaluate training and orientation materials to ensure industry specific terminology is defined and understandable.
- Utilize the youCompli system as a centralized hub for new and existing compliance processes and utilize the included model procedures throughout the various areas of your organization.
RESOURCES:
Health Care Compliance Association (HCCA) Compliance Dictionary found at https://www.hcca-info.org/publications/compliance-dictionary
Health and Human Services (HHS), Office of the Inspector General (OIG), Work Plan Appendix B: Acronyms and Abbreviations found at https://oig.hhs.gov/publications/workplan/2011/wp09-appx_b_acronyms.pdf
Denise Atwood, RN, JD, CPHRM
District Medical Group (DMG), Inc., Chief Risk Officer and Denise Atwood, PLLC
Disclaimer: The opinions expressed in this article or blog are the author’s and do not represent the opinions of DMG.
Denise Atwood, RN, JD, CPHRM has over 30 years of healthcare experience in compliance, risk management, quality, and clinical areas. She is also a published author and educator on risk, compliance, medical-legal and ethics issues. She is currently the Chief Risk Officer and Associate General Counsel at a nonprofit, multispecialty provider group in Phoenix, Arizona and Vice President of the company’s self-insurance captive.
Collaboration Between Compliance and Risk: What is Permissible?
Compliance departments, generally speaking, guide staff and boards of directors to comply with the requirements, laws and regulations that govern the organization’s business. They also monitor for compliance via internal audits. Risk departments, on the other hand, address ways to mitigate risk to an organization through such activities as the evaluation and purchase of insurance policies. Given the broad nature of the scope of these two departments within the organization, when is compliance and risk collaboration permissible?
Possible collaborations
- Strategic planning: Collaboration here should include not only compliance and risk but the entire organization and the board of directors, if applicable.
- Disaster response and business continuity: As with strategic planning, disaster response and business continuity planning should also involve input and collaboration from all departments in the organization.
- General security and privacy : Here the compliance/privacy officer, information technology/security officer, and risk management director should all be included in the planning.
- Known security threat and/or breach incident: Compliance, information technology (IT), and risk management would all participate in mitigating a security threat or breach incident on the organization. Each would provide input and guidance on their respective areas of knowledge.
- Risk assessments, gap analysis and mitigation plans: Again, the development of these plans should include leaders from the entire organization; moreover, compliance and risk would specifically collaborate on the assessment, analysis and mitigation activities.
- General policy development: Compliance and risk staff can collaborate and provide feedback and input for all organization policies.
- Record and document retention schedule: Here compliance and risk can collaborate with legal counsel to ensure record and document retention policies comply with state and federal laws.
- Staff education: This is an area where compliance and risk can collaborate to provide training, whether it is done in person, virtually, by email or via online course.
Collaborations to vet and evaluate permissibility
- Security breach: As noted above, compliance, IT, and risk will work together once a security breach has been identified. It is important to ensure compliance addresses HIPAA related information and potential reporting requirements; IT evaluates the technical aspects of the breach; and risk focuses on reporting to the insurance carrier and mitigation strategies in conjunction with compliance and IT. These collaborative activities will usually take place under a breach coach or law firm to protect the confidential nature of the breach.
- Shared work areas: Depending on the confidential nature of discussions, say a lawsuit against the organization, it may or may not be appropriate for compliance staff to be privy to such information. So shared work areas should be closely evaluated.
- Shared staff: As with shared work areas, if a staff member such as a registered nurse (RN) is shared between the compliance and risk department, both leaders and the RN must remain in the scope of the job role in which they are working at the time.
- Reporting to the board: Typically, compliance reports to the organization’s leader (such as a CEO) but also has direct or dotted line reporting to the board of directors. Make sure any collaborations with other departments do not create potential conflicts of interest with reporting up this chain of command.
- Committee membership: As with the analysis discussed above, make sure to vet compliance staff member membership on the risk committee and vice versa to avoid any actual or potential conflicts of interest.
Goal
All organizations should work to develop a culture where permissible collaborations between compliance and risk occur. They should also make certain that staff feel comfortable calling the compliance or risk department with potential concerns while ensuring the staff not crossing any lines when it comes to compliance or risk department confidential matters or conflicts of interest.
PRACTICE TIP:
- Evaluate opportunities for the compliance department to collaborate with the risk management team, as noted above.
- Access youCompli to find resources which address required document and record retention requirements.
Denise Atwood, RN, JD, CPHRM
District Medical Group (DMG), Inc., Chief Risk Officer and Denise Atwood, PLLC
Disclaimer: The opinions expressed in this article or blog are the author’s and do not represent the opinions of DMG.
Denise Atwood, RN, JD, CPHRM has over 30 years of healthcare experience in compliance, risk management, quality, and clinical areas. She is also a published author and educator on risk, compliance, medical-legal and ethics issues. She is currently the Chief Risk Officer and Associate General Counsel at a nonprofit, multispecialty provider group in Phoenix, Arizona and Vice President of the company’s self-insurance captive.
Sign-up to never miss a compliance related article!
Manage your healthcare regulatory change process effectively and efficiently
YouCompli enables the compliance officers to assign ownership and oversight of tasks to different department heads, functional leaders, or specialists. The solution prompts users to accept, reject, or reassign the task by a stated deadline. Manage the rollout and accountability of new requirements with the best workflow in the business.
The Pandemic Is No Excuse: Enforcement Actions Taken by the Office for Civil Rights
We’ve known that enforcement actions were going to pick up again, even though many regulations are still waived or modified during the public health emergency. In the past few months, several decisions have been rendered by the Office for Civil Rights (OCR) which prove the point. Hospitals and other healthcare organizations need remain cautious and cognizant of exactly which regulations are being enforced, and make sure that existing procedures and policies are being followed.
Religious Rights
For example, OCR resolved a complaint against Prince George’s Hospital Center of the University of Maryland Medical System (UMMS). The complaint was raised by a woman who wanted to have a priest attend her critically injured husband during the pandemic. Despite the priest’s willingness to wear any necessary personal protective equipment (PPE), he was refused entry. UMMS implemented a new policy guaranteeing “adequate and lawful access to chaplains or clergy” in order to resolve the complaint.
A second religiously-based complaint was also resolved recently by OCR. In this complaint, filed by a civil rights group, a medical student at Staten Island University Hospital (SIUH) in New York City was ordered to shave his beard, which he kept for religious reasons. The hospital stated that this was in order to ensure his N95 respirator mask had a tight seal around his nose and mouth, even though he had passed a fit test. In resolving the complaint, SIUH provided the student with a Powered Air Purifying Respirator (PAPR) as a religious accommodation.
Privacy
OCR also recently resolved a HIPAA-based complaint. Lifespan Health System Affiliated Covered Entity (Lifespan ACE) in Rhode Island agreed to pay OCR $1,040,000 and to implement a corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules related to the theft of an unencrypted laptop. Not only did the laptop contain electronic protected health information (ePHI) for 20,431 individuals, OCR found systemic noncompliance with HIPAA, including lack of encryption on laptops and a lack of device and media controls.
A Warning for Compliance
All these enforcement actions took place during the COVID-19 pandemic. The presence of the pandemic is not being taken as a reason for not proceeding with enforcement action. Compliance professionals need to be very aware of what regulations still apply, and how their organizations are continuing to stay within the scope of existing regulations.
Organization Liability: Types of Risk (Part I)
Risk is an important concept for compliance professionals working in the healthcare space to understand. After all, there are many times where risk and liability have crossover to compliance.
For example, in response to a suspected email or electronic health record breach, compliance and risk professionals will need to work together. This work will include:
- Evaluating the breach
- Reporting to the insurance carrier
- Collaborating with a breach coach or legal team to ensure the investigation meets legal requirements and timelines
- Collaborating with the information technology team and a forensics firm to ensure risk mitigation strategies are implemented and effective
And so on.
Generally speaking, healthcare compliance professionals should have a good working knowledge of organization risks and liabilities, as well as risk mitigation strategies.
This raises two important questions:
- What areas of risk do healthcare organizations face?
- What are the potential liabilities related to unmanaged or poorly managed risk?
Areas of Risk for a Healthcare Organization
Areas of risk for a healthcare organization are vast, and can involve injury to persons, property and reputation. Several areas of risk include:
Patient safety risks
These include near misses, which are mistakes which almost make it to the patient, as well as events or incidents that do make it to the patient, causing the patient to experience an unanticipated outcome such as a longer hospital stay, disability or death.
For example, a nurse may realize before giving a vaccine to a child that the adult vaccine and dose was drawn up in the syringe instead of the pediatric vaccine and dosage. This would be a near-miss. Along those same lines, a mistake occurs if the adult vaccine dose is actually administered to the child and an allergic reaction occurs.
Operational risks
These include such things as business interruption or supply chain issues. Business interruption incidents may include fire, flood, or pandemic. If the electronic medical record system goes down, and staff have to chart by hand on paper, this would be a business interruption. Supply chain issues can occur due to higher than normal demand or decrease in output by the manufacturer. If an organization cannot obtain needed supplies – such as hand sanitizer or surgical masks – that would be an example of a supply chain issue.
Legal risks
These typically involve lawsuits filed against the organization. Most commonly, lawsuits result from allegations of inappropriate employment practices or medical negligence or malpractice. For example, if a child had an allergic reaction after receiving an adult dose of a vaccine and unfortunately passed away, the parents may file a lawsuit alleging medical malpractice or negligence on behalf of the organization, the provider or the nurse who administered the incorrect vaccine.
Insurance risks
Insurance risks generally stem from a lack of adequate or appropriate insurance coverage or failure to transfer risk. Insurance risks can also connect to legal risks, which can stem from contracts with inadequate risk transfer or failure to conduct due diligence to vet the vendor. In the case of a pandemic, healthcare and other organizations may not have realized that pandemics and resulting business closures may be excluded from their business interruption insurance policy.
Human capital risks
These encompass the inability to hire, contract or retain appropriately trained staff. A lack of ICU level nurses causing staffing shortages would be an example. Human capital risks can also include professional board or licensing complaints against the organization’s doctors, nurses, therapists, or other licensed staff.
Reputational risks
Reputational risks are often forgotten or invisible to an organization until a bad event happens and it is announced to the public – at which point it is too late.
Reputational risk used to be limited to bad publicity which was published in print or reported on television. However, with the increased acceptance and use of social media, reputational risks are more far-reaching than the local newspaper or evening news program, and could potentially have national reach and negative impact on the organization . A newspaper may not run a story about a child who received an incorrect vaccine, but the child’s mother could post to Facebook or other social media platforms that the organization and providers are terrible and not to be trusted.
Practice Tips:
- Schedule a meeting with your insurance broker to evaluate your insurance policies by product line (i.e., general liability, property, cybersecurity, etc.) to ensure the organization is adequately covered to protect against most business losses.
- Educate staff to ensure they know how and where to report near-misses and mistakes that occur in the organization.
- Work with Risk Management to conduct a risk assessment to evaluate organization risks and implement mitigation plans.
Denise Atwood, RN, JD, CPHRM
District Medical Group (DMG), Inc., Chief Risk Officer and owner of Denise Atwood, PLLC
Disclaimer: The opinions expressed in this article or blog are the author’s and do not represent the opinions of DMG.
Denise Atwood, RN, JD, CPHRM has over 30 years of healthcare experience in compliance, risk management, quality, and clinical areas. She is also a published author and educator on risk, compliance, medical-legal and ethics issues. She is currently the Chief Risk Officer and Associate General Counsel at a nonprofit, multispecialty provider group in Phoenix, Arizona and Vice President of the company’s self-insurance captive.
Sign-up for the YouCompli Blog to Stay Up to Date on Compliance Related News!
Manage your healthcare regulatory change process effectively and efficiently
YouCompli enables the compliance officers to assign ownership and oversight of tasks to different department heads, functional leaders, or specialists. The solution prompts users to accept, reject, or reassign the task by a stated deadline. Manage the rollout and accountability of new requirements with the best workflow in the business.
Earning the Gold Seal of Approval from the Joint Commission
Revised September 2022
Complying with the latest regulations will always be a critical priority for healthcare compliance professionals. But earning approval from The Joint Commission, the recognized global leader for health care accreditation, is growing in importance across healthcare organizations, including hospitals, physician group practices, surgery centers, and other treatment facilities.
This accreditation, known as The Gold Seal of Approval®, acknowledges an organization’s dedication to providing quality care and services to patients. Some states require health care organizations to be accredited by the Commission in order to participate in particular insurance programs.
If a healthcare organization is accredited by The Joint Commission, it may be deemed to exceed Centers for Medicare and Medicaid (CMS) requirements, along with state law requirements. Additionally, with the public’s attention increasingly focused on becoming informed consumers, earning accreditation also offers organizations a competitive edge.
Meet the Joint Commission
The Joint Commission is an independent, not-for-profit organization based in Illinois. Founded more than 65 years ago, the Commission provides an unbiased assessment of a health care organization’s quality achievements in patient care and safety.
It offers the following accreditation programs:
- Ambulatory Care Accreditation
- Behavioral Health Care Accreditation
- Critical Access Hospital Accreditation
- Home Care Accreditation
- Hospital Accreditation
- Laboratory Services Accreditation
- Nursing Care Center Accreditation
- Office-Based Surgery Accreditation
In addition, The Joint Commission offers 20 different certifications for a variety of clinical programs and services.
Understand the Accreditation Process
The Commission’s standards set expectations for an organization’s performance that are reasonable, achievable, and measurable. Its on-site surveys are rigorous and are customized for each organization and its efforts to improve patient outcomes. And the start of a survey is usually unannounced.
During an on-site survey, Commission surveyors perform their evaluation by:
- Tracing the care delivered to patients, residents, or individuals served
- Reviewing the information and documentation provided by the organization
- Observing and interviewing staff and, when appropriate, patients
The Commission provides a Summary of Survey Findings Report at the conclusion of the on-site survey, with a final accreditation decision made at a later date. Surveyors could recommend:
- Preliminary accreditation
- Accreditation
- Accreditation with follow-up survey
- Preliminary denial of accreditation
- Denial of accreditation
An organization’s accreditation is continuous as long as it has a full, unannounced survey within 36 months of the previous survey and it meets all accreditation-related requirements.
Benefits from Accreditation
The Gold Seal of Approval is a way to let medical professionals, government regulators, and patients know that an organization stands for quality care, and that it’s always seeking ways to identify known or unknown risks to patient safety.
For example, healthcare organizations that want to participate in Medicare have to be certified to have met specific CMS quality-related standards. If the organization is accredited by The Joint Commission, CMS will have deemed the entity to have met or exceeded these requirements. That means the organization is not subject to Medicare’s survey and certification process because it has already gone through the Commission’s survey process.
Additionally, being Commission-accredited may allow the organization to be exempt from meeting state law survey or quality or requirements. Here you want to be sure and check your state laws to see if they exempt entities accredited by The Joint Commission.
In what other ways can an organization benefit from Joint Commission accreditation?
- It can earn various Joint Commission certifications for continued improvement and maintaining performance excellence
- It can connect with other like-minded organizations to collaborate on issues affecting the quality and safety of patient care
- It can attract more qualified personnel who prefer to serve in a prestigious environment
Earning Accreditation Means Maintaining Compliance
Earning the Joint Commission’s Gold Seal of Approval depends on a strong culture of compliance. Organizations that are challenged to manage compliance, or effectively demonstrate compliance, are unlikely to meet the Joint Commission’s rigorous standards. (Read more about Compliance Culture on the YouCompli blog.)
A culture of compliance is a commitment throughout all levels of an organization to do the right thing and do things right. When an organization has a strong culture of compliance, there is a spillover effect to obtaining and maintaining Commission accreditation. Employees see their leaders ensuring the organization is maintaining compliance with elevated standards. Additionally, they see their leaders making business decisions based on organizational policy requirements. The end result is actions being taken that demonstrate leading by example and modeling that behavior to employees.
The Gold Seal of Approval accreditation is an important acknowledgment of an organization’s dedication to providing quality care and services to patients. The effort to earn this accreditation is certainly significant, but the payoff in terms of reputation, recruiting and deeming status is worth the effort. Not only that, the process of earning accreditation can help you uncover opportunities to further shape your culture of compliance so that a mindset of always doing the right thing permeates all levels of your organization. All of that is good for the long-term health of your business – and your patients.
The accreditation process requires significant metrics to demonstrate the effectiveness of your compliance program, YouCompli can help you verify that you took the proper steps to comply with the regulations that apply to you. Find out how.
Jerry Shafran is the founder and CEO of YouCompli. He is a serial entrepreneur who builds on a solid foundation of information technology and network solutions. Jerry launches, manages, and sells software and content solutions that simplify complex work. His innovations enable professionals to focus on their core business priorities.
Never Miss a Compliance Related Article
5 Payer Audit Errors Every Hospital Must Avoid
Revised September 2022
Most healthcare providers, from large hospitals to solo practitioners, experience an external audit at some point. The scrutiny can unveil errors and violations, which can lead to hefty penalties.
The key to surviving an external audit, with the least amount of frustration, is to avoid these five common mistakes.
1. Late Responses
Your deadline to submit relevant documentation begins upon receiving that external audit request.
External audits may be requested by a commercial health insurance payer, or government agencies such as the Centers for Medicare and Medicaid Services (CMS) or Office for Civil Rights (OCR). While the origin of the audit request doesn’t matter, a timely response is essential.
Take all deadlines seriously. If an extension is needed, ask for one, immediately. Missing deadlines can result in hefty fines and penalties.
2. The Wrong Documentation
A common trigger for payer audits is improper or lack of necessary documentation. As a healthcare practitioner, you must prove the medical necessity of each test or procedure used to diagnose and treat your patients.
Here’s the tricky part. Sometimes payers and providers disagree on what tests or procedures are medically necessary. Additionally, medically necessary guidelines change frequently. CMS provides local coverage determinations (LCDs) and national coverage determinations (NCDs) to help with your documentation. Be sure you are aware of changes to these coverage determinations.
The best way to mitigate this problem is to educate your staff on what services the payer considers medically necessary, and what documentation is required to establish medical necessity.
Additionally, clearly document the need for a particular procedure to treat or diagnose a patient. Finally, when required, ensure that authorization is received from the payer before rendering services.
3. Billing the Wrong Codes
Incorrect billing and coding practices can raise suspicion of fraud, failed claims, or delayed reimbursement, and — you guessed it — external payer audits. Providers and patients overpay a whopping $68 billion annually due to incorrect billing.
Coding systems developed by the American Medical Association and the Centers for Medicare and Medicaid are designed to streamline the billing process. Every medical procedure and service from ambulance rides to chemotherapy drugs to doctor visits are contained within coding systems such as the ICD-10, CPT, and HCPCS.
Studies show 80 percent of medical bills in the U.S. contain errors. This percentage can decrease by ensuring appropriate staff stay current with billing and coding updates and communicate those changes to the right clinical and administrative staff to avoid old and outdated codes.
4. No Self-Audit
One way to prepare for payer audits is to perform regular self-audits within your facility. Internal audits are great for identifying and eliminating weak spots that can potentially lead to headaches down the road, like rejected claims and costly compliance failures.
One drawback is the strain on precious resources like time and personnel. You can get around this problem by hiring a third-party audit service. Make sure you have HIPAA-compliant Business Associate Agreements (BAA) so that you’re allowed to share your patient health information with third parties providing auditing services.
Another option is to use software provides 24/7 access to survey compliance data. Ideally, this software will provide automatic tracking of all documentation and decisions involved in the process of running your organization.
This ensures that compliance professionals can get immediate reporting on how well their team is doing, conducting audits more efficiently and effectively. It’s a time and cost-effective solution to hiring an outside third-party provider.
5. No Legal Help
Having a healthcare attorney in your corner can mean the difference between a smooth audit experience and an audit nightmare.
Here’s how a healthcare legal team can benefit your health practice:
- Work intimately with your staff to analyze any risky billing procedures.
- Challenge any demands from payers for overpayment.
- Challenge any allegations of fraudulent billing practices.
- Push back on any denied claims and the overuse of service claims.
Again, software is a useful tool to support your attorney’s work. A system that stores all compliance information, including payment practices, and has search capability will provide your legal team with the information they need to fight payer audit discrepancies when the time arrives.
External payer audits don’t have to be a nightmare. By being adequately prepared and vigilant, your next audit experience can be more streamlined and less stress-inducing.
Learn More About YouCompli
The best way to prepare for a payer audit is to carefully manage changes to regulatory changes and coverage determinations. YouCompli can help you establish a scalable, repeatable process so you don’t miss a relevant change and you can equip your clinical colleagues to respond to the change. Then, when the audit does happen, you’ll have an easy way to demonstrate your work to comply with the requirements. Find out more.
Jerry Shafran is the founder and CEO of YouCompli. He is a serial entrepreneur who builds on a solid foundation of information technology and network solutions. Jerry launches, manages, and sells software and content solutions that simplify complex work. His innovations enable professionals to focus on their core business priorities.
Never Miss an Article on Healthcare Compliance
youCompli Team Heads to Compliance Institute
The youCompli team is looking forward to heading to Boston for the HCAA’s Compliance Institute from April 7-10. The HCAA calls this event the single most comprehensive healthcare compliance conference. That’s why we think it’s a terrific chance to learn more from our colleagues in specialties such as Healthcare Reform, Hospital Physician Alignment, and […]
Continue reading78 Pages. 1 Regulation. Analyzed by Experts in Days.
Final rule 42 CFR Part 59 is 78 pages long. Have you read it yet? How about your team? How long will it take? And then, will you feel confident in what actions you may take? Or is there another process you’ll undertake to make sure? At youCompli, it took us just a few days to […]
Continue reading