hospice regulatory update · 2018-12-14 · $944.79 $40.16 $963.69 inpatient respite $167.45...
TRANSCRIPT
8/26/2016
1
Hospice Regulatory Update
Jennifer Kennedy, MA, BSN, RN, CHCJuly 2016
National Hospice and Palliative Care Organization
Session Objectives
• Review of the current hospice pertinent topics with detail such as new CMS guidance, survey & certification updates, and quality reporting update.
• Discuss information about CMS requirements and what issues they are tracking;
• Discuss scrutiny of hospice claims, provision of care, and on what "hot spots" they are fixing focus.
© National Hospice and Palliative Care Organization, 2016 2
FY2017 Proposed Hospice Rule
• Published in Federal Register on Thursday April 28
• 2% marketbasket increase
• 2 new quality measures proposed
© National Hospice and Palliative Care Organization, 2016 3
8/26/2016
2
TRENDS IN HOSPICE UTILIZATION
Growth in Patients and Expenditures
• 2000: 513,000
• 2015: 1.4 million
• 2000: $2.8 Billion
• 2015: $15.5 Billion
Patients Served Medicare Expenditures
Top 5 Diagnoses in 2015
RankICD-9 Code
DiagnosisNumber of
Hospice Patients
%
1 331.0 Alzheimer’s disease 195,469 13%
2 428.0 Congestive heart failure, unspecified
114,240 8%
3 162.9 Lung Cancer 87,661 6%
4 496 COPD 80,081 5%
5 331.2 Senile degeneration of the brain
46,610 3%
8/26/2016
3
Multiple Diagnoses on Claim Form
77.2%72%
67%
49%
37%
0.0%10.0%20.0%30.0%40.0%50.0%60.0%70.0%80.0%90.0%
% of claims with one diagnosis
% of claims with onediagnosis
MONITORING FOR HOSPICE PAYMENT REFORM IMPACT
Pre-Hospice Spending
• Five broad categories of hospice patients• Alzheimer’s, dementia and Parkinson’s
• CVA/Stroke
• Cancers
• Chronic kidney disease
• Heart (CHF and other heart disease)
• Lung (COPD and pneumonia)
• All other diagnoses
• Analysis of pre-hospice spending -- an initial step in determining whether a case-mix adjustment could be created in the future
8/26/2016
4
Pre-Hospice Spending
DiagnosisMean Lifetime Length of Stay
ALL DIAGNOSES 73.9
Alzheimer’s, Dementia and Parkinson’s
118.8
CVA/Stroke 55.6
Cancers 47.3
Chronic Kidney Disease 29.8
Heart (CHF and Other Heart Disease)
78.8
Lung (COPD and Pneumonias 69.4
All Other Diagnoses 78.2
Pre-Hospice Spending Analysis
$0$50
$100$150$200$250$300$350$400$450$500
180 Days before election 90 days before election
30 days before admission RHC Rate – FY2014 $156.06
“Leakage”
• CMS “believes that it would be unusual and exceptionalto see services provided outside of hospice
• Trend analysis on spending outside the Medicare hospice benefit
• Non-hospice Part A and Part B spending has decreased by 15.4%
• Beneficiary cost sharing: $122.5 million in FY2014, down from $132.5 in FY2013
• NHPCO provided CMS with an extensive list of recommendations to address leakage
8/26/2016
5
Medicare Parts A and B Leakage
$7
10
,08
7,3
21
$6
94
,13
0,8
54
$6
00
,84
2,7
32
$540,000,000
$560,000,000
$580,000,000
$600,000,000
$620,000,000
$640,000,000
$660,000,000
$680,000,000
$700,000,000
$720,000,000
2012 2013 2014
Parts A and B Expenditures After Hospice Election
"Leakage"
Part D Expenditures Outside the Benefit
• 2014 patient pay amount: $41,722.567
• 2013 comparison: $50.9 million
Common Palliative Drugs
• Analgesics
– Anti-inflammatory
– non-narcotic
– Opioids
• Antianxiety agents
• Antiemetics
• Laxatives
8/26/2016
6
Cerebral Degeneration
$1,880,621
$11,563,443
$3,229,221
Overlapping Drugs - Part D Expenditures
Common Palliative Drugs
Psychotherapeutic andNeurological Agents
Antipsychotics/Antimaniac Agents
FY2014 Data
COPD
$1,941,201
$8,768,675
$289,214 $195,780
Part Overlapping Drugs – Part D Expenditures
Common Palliative Drugs
Antiasthmatic andBronchodilator Agents
Respiratory Agents - Misc.
Corticosteroids
FY2014 Data
CMS Concern
• Hospices are required to cover drugs for the palliation and management of the terminal prognosis
• We remain concerned that common palliative and other disease-specific drugs for hospice beneficiaries are being covered and paid for through Part D.
8/26/2016
7
Part D Expenditures Outside the Hospice Benefit
$3
34
.9
$3
47
.2
$2
91
.6
$260.0
$270.0
$280.0
$290.0
$300.0
$310.0
$320.0
$330.0
$340.0
$350.0
$360.0
CY2012 FY2013 FY2014
in M
illio
ns
Part D Expenditures
Part DExpenditures
Live Discharge Rates
• All reasons for discharge, including revocation
• Live discharge rates have declined over time
• Leveling off at ~ 18%
• Analysis of hospice
– live discharge rate
– amount of non-hospice spending
– average length of stay
– incidence of cap overpayments
CMS Concern
• “Some hospices may be using the Medicare Hospice program inappropriately as a long-term care (“custodial”) benefit rather than an end of life benefit for terminal beneficiaries
8/26/2016
8
Live Discharge Rate 2006-2014
NHPCO Concerns
• All types of discharges included
• Patient revocation is a patient right
• No way for the individual hospice to respond or correct their practices without additional information
– % of revocations
– Reasons for hospice-initiated discharge
• Use PEPPER report for additional analysis
Skilled Visits in the Last Days of Life
• On any given day during the last 7 days of a hospice election, “nearly 47% of the time the patient has not received a skilled nursing or social worker visit
• On the day of death nearly 26% of beneficiaries did not receive a skilled nursing or social work visit
8/26/2016
9
Incentives for Skilled Visits
• Service Intensity Add-on
– RN and social worker visits
– Up to 4 hours per day combined disciplines
– Paid at CHC hourly rate
• New quality measure measuring visits when death is imminent
• What is CMS telling us?
CMS Data Monitoring
Monitoring will include:
• hospice diagnosis reporting
• length of stay
• live discharge patterns and their relationship to the provision of services and the aggregate cap
• non-hospice spending for Parts A, B and D during a hospice election
• trends of live discharge at or around day 61 of hospice care, and readmissions after a 60 day lapse since live discharge
FY2017 Wage Index Update and Rates
8/26/2016
10
FY2017 Wage Index Update
• Proposed marketbasket increase of 2.0%
• Final market basket for FY2017
– May increase or decrease slightly based on updated hospital information
• Good for planning purposes
• Official % increase – released with final rule in mid-summer for October 1, 2016 implementation
FY2017 Proposed Rates
Level of Care FY2016 NationalRate
Proposed FY2017 National Rate
Routine Home Care 1-60 days $186.84 $190.41
Routine Home Care 61+ days $146.83 $149.68
Service Intensity Add-on Hourly rate $39.37 $40.16
Continuous Home CareHourlyFull 24 hours
$39.37$944.79
$40.16 $963.69
Inpatient Respite $167.45 $170.80
General Inpatient $720.11 $734.22
FY2017 Rates with No Quality Reporting
Level of CareFY2016 Payment
RatesFY2017 Proposed
Payment Rates
Routine Home Care (days 1-60) $186.84 $186.67
Routine Home care (days 61+) $146.83 $146.74
Service Intensity Add On $39.37 $39.37
Continuous Home CareHourlyFull 24 hours
$39.37$944.79
$39.37$944.79
Inpatient Respite $167.45 $167.45
General Inpatient $720.11 $719.82
8/26/2016
11
Rate Charts for Your Area
• NHPCO has created an Excel spreadsheet with every county in the country – includes:
– Proposed wage index for CBSA or rural area
– Phase in of 2010 US Census complete
– All levels of care
• Go to:
– NHPCO.org/regulatory
– Hot Topics
– FY2017 Hospice Wage Index, Payment Rate Update and Hospice Quality Reporting Proposed Rule
CAP AMOUNT AND CAP CALCULATION
Cap Amount
• October 1, 2016 and before October 1, 2025
• Cap calculation update
– Same calculation as the hospice payment update percentage
• Cap amount for 2017: $28,377.17
– May adjust slightly based on marketbasket update in final rule
• Cap year for 2017: October 1, 2016 to September 30, 2017
33
8/26/2016
12
Cap Calculations for FY2017
Cap Year Beneficiaries Payments
StreamlinedMethod
Patient-by-Patient
ProportionalMethod
StreamlinedMethod
Patient-by-Patient
ProportionalMethod
2016 9/28/15 –9/27/16
11/1/15-10/31/16
11/1/15-10/31/16
11/1/15-10/31/16
2017 (Transition 9/28/16 – 11/1/16 – 11/1/16 – 11/1/16 –Year) 9/30/17 9/30/17 9/30/17 9/30/17
201810/1/17– 10/1/17– 10/1/17– 10/1/17–9/30/18 9/30/18 9/30/18 9/30/18
34
PROPOSED QUALITY MEASURES
© National Hospice and Palliative Care Organization, 2016 35
Summary of Quality Reporting Section
• All current measures continue: CMS is not proposing to remove any of the current HQRP measures.
• Two new quality measures proposed: CMS is proposing changes to the hospice quality reporting program, including 2 new quality measures.
• Public display and reporting: – All 7 current HIS measures will be considered for public reporting
– Similar to other Medicare provider types
– CMS “Hospice Compare” website
– Spring/summer of CY 2017
© National Hospice and Palliative Care Organization, 2016 36
8/26/2016
13
Hospice Visits When Death is Imminent
• Two measures that assess hospice staff visits to patients and caregivers in the last week of life
• Measures give flexibility for individualized care in line with patient/family preferences and goals of care
© National Hospice and Palliative Care Organization, 2016 37
Hospice Visits When Death is Imminent Measure Pair
Measure 1
• Assesses the percentage of patients receiving at least 1 visitfrom:
• registered nurses
• Physicians
• nurse practitioners or
• physician assistants
• in the last 3 days of life
• Measure addresses case management and clinical care
1 visit in 3 days
Measure 2• Assesses the percentage of
patients receiving at least 2 visits from:• medical social workers,
• chaplains or spiritual counselors,
• licensed practical nurses, or
• hospice aides
• in the last 7 days of life
2 visits in 7 days
© National Hospice and Palliative Care Organization, 2016
38
Hospice Visits When Death is Imminent
• New Items on HIS Discharge Record:
– 4 new items added to the HIS Discharge record
– Will collect necessary data
• Start date for data collection:
– No earlier than April 1, 2017
© National Hospice and Palliative Care Organization, 2016 39
8/26/2016
14
Hospice and Palliative Care Composite Process Measure
• All 7 current HQRP measures
• No new data collection will be required; data for the composite measure will come from existing items from the existing 7 HQRP component measures
• Start date: No earlier than April 1, 2017
© National Hospice and Palliative Care Organization, 2016 40
Proposed Enhanced Data Collection
• Considering new data collection mechanism for use by hospices
• Hospice patient assessment instrument
1) Provide the quality data necessary for HQRP requirements and the current function of the HIS; and
2) Provide additional clinical data that could inform future payment refinements.
• In line with other post-acute care settings (e.g. OASIS)
© National Hospice and Palliative Care Organization, 2016 41
Public Reporting
• Public reporting via a Hospice Compare website in Spring/Summer CY 2017
• All 7 HIS measures
• Eventual 1 to 5 stars rating
• Expect that CAHPS will also be included, but no word at this time
© National Hospice and Palliative Care Organization, 2016 42
8/26/2016
15
Preview Reports
• Hospices will have time to review and correct their own data
• Two types of preview reports will be available in CASPER
– Results for public reporting
– Provider-level feedback reports (separate from public reporting) for provider viewing only for the internal provider quality improvement
© National Hospice and Palliative Care Organization, 2016 43
PEPPER REPORTS AS A COMPARATIVE REPORT
© National Hospice and Palliative Care Organization, 2016
44
Use of PEPPER Reports
• PEPPER
– Roadmap to help a provider identify potentially vulnerable or improper payments
– Assist providers in identifying
• Free comparative report from CMS contractor
• Go to www.PEPPERresources.org
• Click on “PEPPER Distribution … Get your PEPPER”
© National Hospice and Palliative Care Organization, 2016 45
8/26/2016
16
Retrieving your PEPPER Report
© National Hospice and Palliative Care Organization, 2016 46
Hospice Target Areas – 2016 PEPPER
Live discharges – not terminally ill
Live discharges –revocations
Live discharges – 61-179 days
Long length of stay
Claims with single diagnosis coded
CHC in assisted living facility
RHC in assisted living facility
RHC in nursing facility
RHC in skilled nursing facility
Episodes with no CHC or GIP
© National Hospice and Palliative Care Organization, 2016
47
OTHER OFFICE OF INSPECTOR GENERAL ACTIVITY
Released November 3 2015
© National Hospice and Palliative Care Organization, 2016
48
8/26/2016
17
OIG Releases Guidance for Health Care Governing Boards
• Guidance updates board responsibility and accountability– Ensures that compliance issues are reported to the board
– Ensures that regular reports are provided from compliance personnel
• OIG Guidance, "Practical Guidance for Health Care Governing Boards on Compliance Oversight," http://oig.hhs.gov/compliance/compliance-guidance/docs/Practical-Guidance-for-Health-Care-Boards-on-Compliance-Oversight.pdf (April 20, 2015).
© National Hospice and Palliative Care Organization, 2016 49
Physicians and NPPs Ordering Medications and Supplies
• NEW Physicians–referring/ordering Medicare services and supplies
• OIG will review select Medicare services, supplies and durable medical equipment (DME) referred/ordered by physicians and non-physician practitioners. Were payments made in accordance with Medicare requirements? (ACA Sec. 6405)
• Details:– CMS requires that physicians and non-physician practitioners who order
certain services, supplies and/or DME are required to be Medicare-enrolled physicians or nonphysician practitioners and legally eligible to refer/order services, supplies and DME.
– If the referring/ordering physician or non-physician practitioner is not eligible to order or refer, then Medicare claims should not be paid.
– Expected issue date: FY2016
© National Hospice and Palliative Care Organization, 2016 50
Palliative Care Issues
Physician home visits–reasonableness of services
Prolonged services–reasonableness of services
The necessity of prolonged services are considered to be rare and unusual
© National Hospice and Palliative Care Organization, 2016 51
8/26/2016
18
On the OIG Hospice Horizon
Hospice general inpatient care• Review use of GIP • Assess the appropriateness of hospices’ GIP claims • Assess content of election statements for hospice beneficiaries
who receive GIP • Review hospice medical records to assess appropriateness of level
of care • NEW! Review beneficiaries’ plans of care and determine whether
they meet key requirements. • Determine whether Medicare payments for hospice services were
made in accordance with Medicare requirements.
• Expected issue date: FY 2016
© National Hospice and Palliative Care Organization, 2016 52
Future Hospice Issues
• Future planning efforts for FY 2016 and beyond will include:
– additional oversight of hospice care
– oversight of certification surveys
– hospice-worker licensure requirements
© National Hospice and Palliative Care Organization, 2016 53
OTHER CURRENT REGULATORY ISSUES
© National Hospice and Palliative Care Organization, 2016 54
8/26/2016
19
NOE/NOTR SUBMISSIONS
© National Hospice and Palliative Care Organization, 2016 55
NOE Issues
• MAC acceptance of NOEs
– Timeliness
– Provider liable days -- Hospice not paid for any days prior to the MAC acceptance of NOE
– Could be 5-30 days of lost revenue
• Exception requests
– MAC denial of exception requests
– MACs report no decrease in the number of exception requests
• Difficult to gather adequate data for advocacy
© National Hospice and Palliative Care Organization, 2016 56
Components of Discussion
• Patient who revokes and returns quickly– System cannot track changes
• Sequential billing
• Patient transfers from one hospice to another– Final claim not submitted from first hospice
– NOE cannot be submitted timely
• Keying errors in NOE data submitted– 100% accuracy required for payment
– If not, then CMS database could take up to 3 weeks to find patient
© National Hospice and Palliative Care Organization, 2016 57
8/26/2016
20
Advocacy
• Meetings with Congressional and committee staff
• Meetings with MACs, including possible solutions suggested by MACs to CMS
• Meetings with CMS Claims Processing
• Meetings with HHS and OMB
Single biggest question: What is the size of the problem?
© National Hospice and Palliative Care Organization, 2016 58
NHPCO Letter to CMS
• Developed by NOE/NOTR workgroup of the NHPCO Regulatory Committee
• Detailed description of problem
• Recommendations for changes
• Sent in March 2016
© National Hospice and Palliative Care Organization, 2016 59
CMS Letter to NHPCO
• Working on benefit period issues
• Looking at options for electronic submission
• Opportunity for more dialogue
– Meeting scheduled for continued discussions on options and solutions
– Very complex issue
© National Hospice and Palliative Care Organization, 2016 60
8/26/2016
21
HIPAA SECURITY ACTIVITY
© National Hospice and Palliative Care Organization, 2016
61
Phase 2 OCR HIPAA Audit Program
• The 2016 Phase 2 OCR HIPAA Audit Program
– will review the policies and procedures adopted and employed by covered entities and their business associates to meet selected standards and implementation specifications of the Privacy, Security, and Breach Notification Rules
• Phase 2 OCR HIPAA Audit Program information
– http://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/index.html#when
© National Hospice and Palliative Care Organization, 2016 62
When Will the Next Round of Audits Commence?
• They are already underway!
• Communications from OCR will be sent via email and may be incorrectly classified as spam.
• If a provider’s spam filtering and virus protection are automatically enabled, OCR expects you to check your junk or spam email folder for emails from OCR; [email protected].
• Click here to view a sample email letter.
© National Hospice and Palliative Care Organization, 2016 63
8/26/2016
22
Who Will Be Audited and How Will They be Chosen?
• Every covered entity and business associate is eligible for an audit
• Information from OCR is that 200 hospices will be chosen
• OCR will not audit entities with an open complaint investigation or that are currently undergoing a compliance review
© National Hospice and Palliative Care Organization, 2016 64
Common Audit Deficiencies Identified
• Failure to conduct Security Risk Analysis
• Lack of training
• Lack of safeguards for mobile or portable devices
• Failure to implement encryption
• Lack of secure transmission (email or text)
© National Hospice and Palliative Care Organization, 2016 65
Safe Use of Mobile Devices
• Use encryption
• Use a password or other user authentication
• Activate wiping and/or remote disabling for use if lost
• Enable security software
• Maintain physical control
• Use only secure public Wi-Fi networks
• Delete all PHI when device no longer in use.
© National Hospice and Palliative Care Organization, 2016 66
8/26/2016
23
Social Media
• Need defined policies on employees posting PHI on any public site
• Examples:– Yesterday was a hard day! 68 year old admitted to hospice facility with
intractable vomiting. Tough seeing her two children in late teens. Then had 37 year old with skin cancer with horrible wound that won’t heal. Some days I’m not sure why I do this. Thanks for listening.
– Had a 33 year old female with dx leukemia. Scheduled to sit for caregiver as they have 3 year old, 5 year old and 9 year old with autism so husband could rest. Patient symptomatic. Had multiple transfusions in last month with no success. Having continuous nosebleeds. Children running around. Patient struggled, couldn’t get her comfortable. (Details on medications, events, etc.).
© National Hospice and Palliative Care Organization, 2016 67
MEDICARE WASTE, FRAUD AND ABUSE
68© National Hospice and Palliative Care
Organization, 2016
False Claims Act Cases and Hospice
• At least 9 hospice FCA cases initiated or settled in 2015– Settlements combined for approximately $37 million
– 5 hospices entered into corporate integrity agreements (CIAs)
• First hospice FCA went to trial in 2015 (AseraCare)– Government focusing on whether the documentation supports the
physician's clinical judgment
– Difference of medical opinion does not make the claim a false claim
• May 2016 – Government appealed
© National Hospice and Palliative Care Organization, 2016 69
8/26/2016
24
Conditions of Payment
• Found at 42 CFR § 418.200
• Distinct from the Conditions of Participation (CoPs) found at § 418.52 through § 418.116
• Failure to meet one or more requirements could lead to the denial or repayment of hospice services
© National Hospice and Palliative Care Organization, 2016 70
To be covered, hospice services must meet the following
• Reasonable and necessary for the palliation and management of the terminal illness as well as related conditions
• Individual must elect hospice care in accordance with § 418.24
• Plan of care must be established and periodically reviewed by the:
– attending physician
– medical director
– interdisciplinary group of the hospice program
– as set forth in § 418.56
• Plan of care must be established before hospice care is provided
• Services provided must be consistent with the plan of care
• Certification that the individual is terminally ill must be completed as set forth in section § 418.22
• § 418.200
© National Hospice and Palliative Care Organization, 2016
71
New Audit Strategies
• United Program Integrity Contractors (UPIC)– Will combine ZPIC and MIC audit functions
• Seven vendors competing for the open slots are:– AdvanceMed
– Health Integrity LLC
– HMS Federal
– Noridian Healthcare Solutions LLC
– Safeguard Services LLC
– StrategicHealthSolutions LLC
– TriCenturion Inc.
72
8/26/2016
25
Highlights in the False Claim Arena Allegations underlying hospice FCA cases remain fairly consistent
Eligibility – Prognosis or Level of Care
Beneficiary Inducement
Anti-Kickback Violation
Incentive Compensation
Violation of Conditions of Payment
Deceptive Marketing
Admission/Discharge Practices
Pressure to Meet Business Targets
Falsifying Documents
73
DOJ and HHS ROI
• Three year return on investment (2013-2015)
$7.70 returned for every $1.00 expended
$27.8 Billion returned to US Treasury
74
OIG Recoupments
• First 6 months of FY2016
– $554 in audit receivables
– $2.2 billion in investigative receivables
– 1,662 individuals and entities excluded from participation in Federal health care entities
© National Hospice and Palliative Care Organization, 2016
75
8/26/2016
26
New Audit Strategies
• United Program Integrity Contractors (UPIC)– Will combine ZPIC and MIC audit functions
• Seven vendors competing for the open slots are:– AdvanceMed
– Health Integrity LLC
– HMS Federal
– Noridian Healthcare Solutions LLC
– Safeguard Services LLC
– StrategicHealthSolutions LLC
– TriCenturion Inc.
© National Hospice and Palliative Care Organization, 2016 76
Medicaid Fraud Prevention System
• Example of new technologies to fight fraud
• Predictive analytics system, introduced in 2011
– Intended to stop improper payments before they are made
– Reviews 4.5 million Medicaid claims a day
– Return on investment: $11 recouped for $1 spent
© National Hospice and Palliative Care Organization, 2016 77
Selection for a Government Audit
• Complaint
• Former employee whistleblower
• Data mining/referral with claims data from the MAC
• Data mining/referral from PEPPER reports
© National Hospice and Palliative Care Organization, 2016 78
8/26/2016
27
HIPAA SECURITY ACTIVITY
79© National Hospice and Palliative Care
Organization, 2016
Enforcement Activity
• Increased focus on audits, investigations, and corrective action plans
• Financial costs are large – potential fines, expense of corrective action plan, damage to agency reputation
• OCR will pursue civil monetary penalties for egregious behavior
• Ongoing review of rule implementation with revisedguidance issued as indicated
© National Hospice and Palliative Care Organization, 2016 80
Complaints to OCR
• Web portal implemented in July 2013
• FY2013 – 15,000+ complaints
• FY2014 – 21,200+ complaints
• Investigation will be conducted
• Can lead to fines
© National Hospice and Palliative Care Organization, 2016 81
8/26/2016
28
Penalties for Rule Violations
• Civil Monetary Penalties (CMP)
– $100 to $50,000 or more per violation
– Calendar year cap is $1.5 million
• Criminal penalties for knowingly obtaining or disclosing PHI
– Up to $50,000 fine and up to 1-year imprisonment
© National Hospice and Palliative Care Organization, 2016 82
Hospice Violation Examples
• Hospice in Louisiana, Sept. 2014, 700+ individuals
– 10 encrypted laptops and 1 external hard drive were stolen
– Laptops contained reports with patient information
– Hard drive contained bereavement files
– Able to remotely wipe the laptops
• Hospice and Palliative Care in Illinois, May 2010, 1000 individuals
– Employee laptop stolen while on home visit
– Policy to encrypt and password protect not followed
– Employee bypassed security
© National Hospice and Palliative Care Organization, 2016 83
Hospice Violation Examples
• Hospice in Maryland, Nov. 2013, 7035 individuals
– Employee emailed spreadsheets to personal account which may have been viewed by third party
• Hospice in Idaho, June 2010, 441 individual
– Unencrypted laptop stolen
– $50,000 settlement with OCR
– 1st settlement involving less than 500 individuals
– Corrective Action Plan required
© National Hospice and Palliative Care Organization, 2016 84
8/26/2016
29
Audit Focus AreasFocus Area Action
Breach NotificationReview breach notification process to ensure compliance with rule. Maintain documentation of breach risk reviews.
Encryption and Decryption
Record devices that store or transmit ePHI. Ensure encryption is in use.
Workforce Training and Education
Ensure staff education is current. Maintain copies of materials and documentation of attendance.
Policies and ProceduresReview privacy, security, and breach notification policies to ensure compliance with current rules.
Security Risk Assessment
Ensure risk assessment is current and that action plans have been implemented.
© National Hospice and Palliative Care Organization, 2016 85
Audit Focus AreasFocus Area Guidance
Notice of Privacy Practices
Review NOPP to ensure it is current and being share appropriately.
Individual Access to PHIReview the process for fulfilling requests for individual access to PHI.
Data TransmissionEnsure implementation of security measures to protect ePHI in transit.
Business Associates Update list of BAs and ensure agreements are current.
Physical SecurityReview physical safeguards and ensure functioning – locks, alarms, etc.
Device SafeguardsReview policies and processes to ensure correct handling of devices that contain ePHI.
© National Hospice and Palliative Care Organization, 2016 86
Security Risk Assessment (SRA) Key Points
• Not optional!
• Must be detailed and written
• Requires a multidisciplinary team approach
• Consider using a matrix to guide the assessment
• Cost of not doing an assessment can be great
• Can be done in-house by staff or using a outside consultant
• Must be updated regularly – at least annually and with significant changes in equipment or processes
© National Hospice and Palliative Care Organization, 2016 87
8/26/2016
30
Identify and Document Threats
• Identify and document reasonably anticipated threats to PHI and EPHI
• Compile a categorized list of threats
– Natural, human, environmental
• Identify different threats unique to the circumstances of their environment
• Determine likelihood of threats
• Determine the potential impact of threat occurrence
© National Hospice and Palliative Care Organization, 2016 88
Common Deficiencies Identified
• Failure to conduct Security Risk Analysis
• Lack of training
• Lack of safeguards for mobile or portable devices
• Failure to implement encryption
• Lack of secure transmission (email or text)
© National Hospice and Palliative Care Organization, 2016 89
Safe Use of Mobile Devices
• Use encryption
• Use a password or other user authentication
• Activate wiping and/or remote disabling for use if lost
• Enable security software
• Maintain physical control
• Use only secure public Wi-Fi networks
• Delete all PHI when device no longer in use.
© National Hospice and Palliative Care Organization, 2016 90
8/26/2016
31
Social Media
• Need defined policies on employees posting PHI on any public site
• Examples:– Yesterday was a hard day! 68 year old admitted to hospice facility with
intractable vomiting. Tough seeing her two children in late teens. Then had 37 year old with skin cancer with horrible wound that won’t heal. Some days I’m not sure why I do this. Thanks for listening.
– Had a 33 year old female with dx leukemia. Scheduled to sit for caregiver as they have 3 year old, 5 year old and 9 year old with autism so husband could rest. Patient symptomatic. Had multiple transfusions in last month with no success. Having continuous nosebleeds. Children running around. Patient struggled, couldn’t get her comfortable. (Details on medications, events, etc.).
© National Hospice and Palliative Care Organization, 2016 91
© National Hospice and Palliative Care Organization, 2016
92
Questions
NHPCO members enjoy unlimited access to Regulatory AssistanceFeel free to email questions to [email protected]
© National Hospice and Palliative Care Organization, 2016
93
8/26/2016
32
How to keep up…
• NHPCO provider members have access to:
– NHPCO News Briefs• Every Thursday
• Regulatory and compliance updates every week
– Regulatory Alerts• For time sensitive and important regulatory issues
• Sign up to receive email regulatory alerts
– Regulatory Round Ups• Once a month, all regulatory issues summarized
– My.NHPCO – regulatory entries for specific groups
© National Hospice and Palliative Care Organization, 2016 94
Regulatory and Compliance Team at NHPCO
Jennifer Kennedy, MA, BSN, RN, CHC
Senior Director, Regulatory and Quality
Judi Lund Person, MPH, CHC
Vice President, Regulatory and Compliance
Email us at: [email protected]
© National Hospice and Palliative Care Organization, 2016 95
NHPCO Regulatory Resources
• NHPCO website
– Regulatory – check Hot Topics for latest issues
– Compliance guides, tip sheets, wage index rate charts and detailed regulatory/compliance information
• Regulatory technical assistance
– Contact [email protected]
© National Hospice and Palliative Care Organization, 2016 96