Health Law Update February 2014

1.  First HIPAA Fine and Settlement for Dermatology Practice’s Failure to Have Breach Notification Policies

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR), and Adult & Pediatric Dermatology (APDerm), reached a $150,000 settlement for privacy and security violations of the Health Insurance Portability and Accountability Act (HIPAA). The alleged violations related to the theft of an unencrypted USB drive that contained the protected health information (PHI) of around 2,200 patients. The OCR’s investigation allegedly revealed that APDerm had not conducted a thorough analysis of the potential risks to the confidentiality of PHI as part of its security management process. It’s also alleged that APDerm failed to fully comply with the Health Information Technology for Economic and Clinical Health (HITECH) Breach Notification Rule, which requires organizations to have written policies and procedures in place and to train employees.

This is the first settlement with a covered entity for not having policies and procedures in place to address the breach notification provisions of the HITECH Act.

This settlement is an important reminder about equipment designed to retain electronic information. HIPAA covered entities are responsible for making sure all PHI is protected. Entities are also required to undertake a careful risk analysis to understand the threats and vulnerabilities to individuals’ data and have safeguards in place to protect this information. HIPAA laws have most likely changed since you last edited your privacy forms and procedures.


2.  Backlog of Medicare RAC Audit Appeals Causes Frustration with Health Care Providers

Appealing a bad decision by Medicare’s Recovery Audit Contractors (RACs) is taking longer than ever. In December 2013, hospitals, doctors, nursing homes and other health care providers were notified that due to a backlog of RAC appeals, the agency would be suspending acting on new requests for hearings. Health care providers were told they would not be able to submit any new appeals until the existing backlog clears, which could take two or more years.

RACs (also known as “bounty hunters”) are private companies contracted by CMS and are used to identify Medicare overpayments and underpayments. RAC audits are not going away. It has become common for state and federal regulators to enforce even the smallest violations, resulting in investigations, monetary fines and penalties. If found in violation, you will not only have to pay fines and face disciplinary action, you will also lose revenue because of the time it takes to deal with the investigation. As much as possible, providers need to avoid mistakes when dealing with RAC audits.


3.  Bipartisan Plan for Medicare Sustainable Growth Rate (SGR) Repeal

After months of negotiations on how to revise Medicare’s payment system for physicians, a bipartisan team of Senate and House committees have reached a deal on the policy. On February 6, 2014, lawmakers unveiled the SGR Repeal and Medicare Provider Payment Modernization Act, an agreement to repeal Medicare’s sustainable growth rate (SGR). The legislation would replace the SGR with a system that would provide stable payment updates for five years and shift Medicare to a system based on quality care versus quantity care.

In the bill, physicians will get a 0.5% pay increase each year for five years. This is designed to provide payment stability and help physicians transition to new models of care.  Other provisions of the new system outlined by lawmakers include:

–  Consolidation of existing payment incentive programs into a single value-based
performance incentive program, in which high-performing professionals would earn payment increases;
–  Incentivized care coordination efforts for patients with chronic care needs;
–  Payment data on providers becomes more publicly available;
–  Implementation of a process to re-base misvalued codes; and
–  Development of quality measures in close collaboration with physicians.

The bill also provides a 5% bonus to physicians who receive at least 25% of their Medicare revenue from an alternative payment model in 2018. These alternative payment models include accountable care organizations (ACOs), patient-centered medical homes, and others. The 25% threshold increases over time.

The bill still needs approval from both chambers. The next task for the committees is to outline how Congress will pay for a full repeal.

Since 2003, Congress has spent about $150 billion to provide short-term fixes to spare physicians from a huge Medicare payment cut each year. If Congress passes legislation to permanently eliminate the SGR, Medicare-participating physicians would avert the nearly 24% payment cut scheduled for April 1, 2014.


4.  Doctors’ Medicare Payment Data to be Released This Spring

Since 1979, the Centers for Medicare and Medicaid Services (CMS) has kept private its records on Medicare claim payments made to individual physicians. However, beginning March 18, 2014, the government may disclose the payment data on a case-by-case basis. According to CMS, this directive is a push to crack down on doctors who are making a habit out of repeatedly overcharging Medicare. In January 2014, CMS stated that recalcitrant providers could face civil fines and exclusion from Medicare and other federal health care programs. According to CMS, a recalcitrant provider is defined as one who is abusing the program and not changing inappropriate behavior even after extensive education to address these behaviors.

Supporters of releasing the data say it could help identify patterns of waste and fraud. Physician groups express caution in Medicare releasing individual payment information, saying it could lead to public misunderstanding and unintended consequences.

Although it remains to be seen how CMS will implement its new policy, health care providers should be prepared for the possibility that their coding, billing and reimbursement patterns could become the subject of public scrutiny, particularly those providers in specialized areas including internal medicine, radiation oncology and ophthalmology.


5.  Medicare’s List of Excluded Individuals and Entities (LEIE) Recently Updated by OIG

The Office of Inspector General (OIG) updated the List of Excluded Individuals and Entities (LEIE) on January 8, 2014. Currently, there are more than 66,000 health care providers excluded from participating in all federal health care programs, such as Medicare, Medicaid and Tricare. Providers receiving funding from federal health care plans are required by law to determine if potential and current employees and subcontractors are excluded. A provider who employs an excluded individual and is reimbursed by federal health care program funds will be required to pay back 100% of the funds received and may be subject to liability under the Civil Monetary Penalties Law.

Few health care providers really understand what it means to be excluded from a federal health care program. Exclusion usually occurs as a result of disciplinary action being taken by the state board of medicine, board of nursing, board of psychology, board of pharmacy or other health care licensing entity.

What may be even more devastating are the additional collateral consequences that may result from such an exclusion. These include, for example:

–  Termination for cause from all state Medicaid Programs;
–  Loss of state professional licenses in other states and jurisdictions;
–  Loss of hospital, ambulatory surgical center, and nursing home clinical privileges;
–  Removal from the provider panels of health insurers;
–  Loss of ability to contract or work for any individual or entity that contracts with the  Medicare Program in any capacity (officer, agent, shareholder, director, employee or        independent contractor, even for non-Medicare products and services such as office supplies, building and construction services, software and systems support, etc.), including physicians, medical groups, hospitals, healthcare systems, ambulatory surgical centers, skilled nursing facilities, health insurance companies, etc.;
–  Placement on the General Services Administration (GSA) Exclusions List (or “Debarred” List) from government contracting; and
–  Loss of ability to contract or work for any individual or entity that contracts with the federal government in any capacity (officer, agent, shareholder, director, employee or independent contractor, even for such services as construction projects, janitorial contracts, computer equipment and software services, real estate brokers on federally underwritten housing loans, sales of motor vehicles, products and services to the government, etc.).

6.  CMS Delays Stage 3 Meaningful Use for Medicare and Medicaid EHR Incentive Programs

In December 2013, CMS announced a revised timeline for the implementation of Stage 3 meaningful use measures for the Medicare and Medicaid Electronic Health Record (EHR) Incentive Programs. According to CMS, Stage 2 will be extended through 2016, and Stage 3 will begin in 2017, for those hospitals, physicians and other eligible providers that have completed at least two years of Stage 2 meaningful use.

This announcement does not change when providers must start Stage 2, nor does it affect the requirement for hospitals and critical access hospitals to upgrade to EHR technology to receive incentive payments. Eligible providers who do not meet meaningful use requirements will still be penalized with reduced Medicare reimbursement starting January 1, 2015.

What This Means for You

If you begin participation with your first year of Stage 1 for the Medicare EHR Incentive Program in 2014:

–  You must begin your 90 days of Stage 1 of meaningful use no later than July 1, 2014,  and submit attestation by October 1, 2014, in order to avoid the 2015 payment adjustment.

If you have completed one year of Stage 1 of meaningful use:

–  You will demonstrate a second year of Stage 1 of meaningful use in 2014, for a three-month reporting period fixed to the quarter for Medicare or any 90 days for        Medicaid.
–  You will demonstrate Stage 2 of meaningful use for two years (2015 and 2016).
–  You will begin Stage 3 of meaningful use in 2017.

If you have completed two or more years of Stage 1 of meaningful use:

–  You will still demonstrate Stage 2 of meaningful use in 2014, for a three-month reporting period fixed to the quarter for Medicare or any 90 days for Medicaid.
–  You will demonstrate Stage 2 of meaningful use for three years (2014, 2015 and 2016).
–  You will begin Stage 3 of meaningful use in 2017.